Your input stays on your machine.
ShortcutCast handles keystrokes. That's why we're explicit about how we treat your input and what we send over the network.
TL;DR
- ✕ Does not read your normal typing — passwords, messages, or anything else.
- ✕ Does not capture the screen or collect files automatically.
- ✕ Does not send telemetry, usage analytics, or crash reports.
- ✕ Does not send your input, key history, or usage anywhere off your machine.
- ✕ Does not store settings in the cloud or on any server.
1. How we handle keystrokes
ShortcutCast receives keystrokes only in these two situations:
- Detecting the trigger: Only the trigger you recorded (a specific key or mouse button) is registered with the OS. Other keystrokes do not pass through ShortcutCast.
- Keys pressed while the grid is open: While the grid is visible, ShortcutCast captures the grid keys (QWERTY, digits, Space) and runs the matching action. Close the grid and keystrokes go back to the app underneath.
No other keystrokes, no screen contents, no window text — none of it is read.
2. Clipboard and files
The clipboard is touched only when you explicitly use a feature that does so.
- Clipboard snippet action: Writes your saved text to the clipboard and triggers a paste. Write-only — existing clipboard contents are not read.
- Pasting an icon: An image is read from the clipboard only when you explicitly select "paste" while setting an action icon.
Files you configure — contexts, actions, icon images — are saved in:
-
macOS:
~/Library/Application Support/ShortcutCast/ - Windows:
%APPDATA%\ShortcutCast\
These files never leave your machine. No cloud sync, no account.
3. Outbound traffic
ShortcutCast connects to the internet only in these three situations. None of them ever carry your input, key history, or usage data.
- Update checks: ShortcutCast asks our GitHub release endpoint whether a newer version exists. It sends little more than the current version number, and a download only starts after you agree to it.
- License verification: Your license key is sent to our payment provider's license API (Lemon Squeezy) to confirm it is valid. Only the license key and an identifier for your device are sent.
-
Favicon fetching: When you set up an action
that opens a URL, ShortcutCast fetches that site's favicon
to use as its icon. It first tries the target domain
directly, and as a last resort asks Google's favicon service
(
google.com/s2/favicons) for that domain. Only the site's domain name leaves your machine — never the full URL path or your input. The fetched icon is stored only on your machine.
That's the full list. No telemetry. No usage analytics. No crash reporting.
4. Contact
Questions about this page or security disclosures? Email support@shortcutcast.app.