Questions and answers
Does everything stay on my Mac?
Yes. Detection and redaction happen on-device, with no network calls — it works fully offline, even with no internet connection at all. Nothing is sent to Apple, and nothing is sent to us.
What does ClipScrub store on my Mac?
Redacted copies, kept encrypted. Your history is sealed on disk with AES-GCM under a key held in your Mac’s Keychain, device-only — originals are never written. While you record, the raw clip sits in a temporary file so it can be redacted, and it’s deleted once you export or close the card. The audit log is sealed too, under its own key. It keeps counts and fingerprints rather than the text that was removed, and alongside those it records the name of the file each entry wrote, which app the content came from and your Mac account name — so an entry can be tied to the work and to the person who did it.
Does it remove the data or just cover it?
Removes. The copy you export has the underlying content removed and flattened — not a black box drawn on top that can be lifted or copied out. Your original stays untouched. Only the copy you share is redacted. Solid (the default) and gradient discard the covered pixels. Blur and pixelate are opt-in because they can be partially reversed.
Can I redact things myself, by hand?
On images, yes. Drag a box over anything else in a screenshot or a PDF page — a corner of a chart, a logo, something the model didn’t flag — and it’s removed with the rest. In plain text you’re working from what the engine found: you review every match and can keep or drop each one before export, but you can’t yet paint over a phrase it missed. What you see is what you get.
I'm here for GDPR or CCPA, not HIPAA — is this for me?
Yes. ClipScrub is built HIPAA-first, but it targets the direct identifiers these frameworks define — names, contact details, IDs, faces and more — in text, images and exports. The same on-device redaction applies to any personal data you need to remove. You stay responsible for compliance.
Does it work without Apple Intelligence?
Yes. A deterministic engine — on-device OCR, pattern matching, face and barcode detection — redacts without it. We do recommend turning Apple Intelligence on where you can: Apple’s on-device model catches the context-dependent identifiers that rules miss. Either way it stays on your Mac. The app needs macOS 15 (Sequoia) or later and the command-line tool runs on macOS 14 and up. The on-device model needs macOS 26 (Tahoe) on Apple silicon.
Do I need a Business Associate Agreement (BAA) with you?
No. A BAA is required when a vendor creates, receives or stores PHI on your behalf. ClipScrub runs entirely on your Mac and never receives your data — there’s nothing for us to sign a BAA over, because we never touch what you redact.
Is ClipScrub HIPAA compliant?
No — no software is. “HIPAA compliant” describes an organisation and its workflow, not an app. ClipScrub helps you find and remove identifiers on your own Mac. Whether your process meets HIPAA is your organisation’s determination to make.
Does it guarantee every identifier is removed?
No. Automated detection isn’t exhaustive — it can miss things or over-flag. ClipScrub is built so you review what it caught before you export, and you’re responsible for verifying the result before sharing. It’s an aid, not a guarantee.
What happens the first time I open ClipScrub?
macOS asks once whether you’re sure. That’s the standard confirmation for an app downloaded from the internet — click Open and you’re in. The app and the disk image are notarized by Apple and stapled, so your Mac can verify them with no internet connection. ClipScrub sits outside the App Store on purpose: the sandbox rules there forbid shipping the separate clipscrub command-line tool.
Can it redact a screen recording or only screenshots?
Both. Record your screen inside ClipScrub or open a clip you already have — MP4 and MOV — with Capture ▸ Redact Video…. It reads four frames a second and shows only the frames it read, so a box can never sit over a frame nobody checked. Boxes you draw by hand follow their content as the window moves or the page scrolls. What you export is the redacted copy. Your original is untouched.
What does the licence key look like?
An offline, Ed25519-signed key — shape CLIP1.<base64url(payload)>.<base64url(sig)> — verified on your Mac against a public key inside the app. No server, no activation.
What does ClipScrub cost?
$49, paid once — the founder price, down from $99. That buys a perpetual licence: the version you get is yours to keep, with twelve months of updates included. After the year, renewing is optional and costs about 50% of what you paid, so an early buyer renews cheapest for good. Skip it and the version you have keeps working.
Is there a free trial?
Yes — 14 days, fully functional. Every tool works, there is no account to create and no card to enter. Download it, use it on real work, and decide after.
Can I get a refund?
Yes — 30 days, no questions asked. Email us and we refund it.
How many Macs does one licence cover?
Up to 3. It is a stated policy rather than something the software checks — the offline key carries no device count and the app enforces none. We are trusting you, and saying so.
Is ClipScrub open source?
The engine and the command-line tool are. The redaction engine and the clipscrub CLI are Apache-2.0 at github.com/tugboatcoding/clipscrub-core, with no third-party dependencies, so you can read exactly what the redaction does. The Mac app itself and the licensing code are closed and never published — the part you can read is the part that touches your data.
What do I need to run it?
A Mac on macOS 15 (Sequoia) or later. The clipscrub command-line tool goes back further, to macOS 14. Apple’s on-device model is the one part with a higher floor: macOS 26 (Tahoe) on Apple silicon with Apple Intelligence turned on — without it the deterministic engine still does the work.
ClipScrub helps you find and remove sensitive information. It is not a compliance service, does not guarantee complete de-identification, and is not legal advice. Detection is not exhaustive — review every result before sharing. For a formal de-identification determination, consult a qualified expert.