Why SimpleShot asks for Screen Recording, and how to check it yourself

One permission for every screenshot app.

On macOS, an app can see what’s on the screen only with the Screen Recording permission, in System Settings › Privacy & Security › Screen & System Audio Recording. There is no separate permission for screenshots: a screenshot is one look at the screen, so every screenshot app asks for the same permission as a screen recorder.

When SimpleShot reads the screen.

Only when you take a capture: with a shortcut, from the menu bar, from one of its windows, or when a timer you set runs out. For an area, it reads each screen once and shows it to you still, with the magnifier, while you choose. A scrolling capture reads the screen as you scroll; a recording reads it until you stop. Between captures it reads nothing, and nothing is sent: text recognition and hiding private details run on your Mac.

SimpleShot › Settings › Privacy lists every time: when, what was read and what started it. The list stays on your Mac for 90 days, and you can clear it. It is still SimpleShot’s own account, so the checks below don’t rely on it.

Check 1: macOS’s own log, in Terminal.

macOS checks an app’s Screen Recording permission each time the app reads the screen, and writes it down. Open Terminal (in Applications › Utilities), paste this line and press Return:

log stream --style compact --predicate 'process == "tccd" AND eventMessage CONTAINS "kTCCServiceScreenCapture" AND eventMessage CONTAINS "Allowed"'

Leave it running while you use your Mac. Each line names the app that read the screen after Sub: (SimpleShot is dev.stillbyte.SimpleShot), and where it lives after binary_path=. A capture with SimpleShot brings a few lines at the same second, and SimpleShot adds one when it opens; between captures, none. Other apps appear too, when they read the screen or the names of other apps’ windows. Press Control-C to stop.

Check 2: what leaves your Mac.

SimpleShot connects to three addresses: updates.stillbyte.dev to look for updates, proof.getsimpleshot.com when you ask for a time proof (it sends the image’s fingerprint, never the image), and links.getsimpleshot.com once you have made a link. A capture leaves your Mac only when you make a link of it.

To see it yourself, use a firewall that shows every connection an app makes, such as the free and open-source LuLu: for SimpleShot it shows only these. Or, in Terminal, this line shows SimpleShot’s connections live, with how much each one sent; while you don’t use updates, time proofs or links, the list stays empty. Press Q to quit.

nettop -p SimpleShot

The question macOS asks again every month.

About once a month, macOS asks again whether SimpleShot may keep reading the screen, in its own words: the app “is requesting to bypass the system private window picker and directly access your screen and audio.” Every screenshot and screen-recording app gets the same question, 30 days after the last time, for each copy of the app on your Mac: it doesn’t mean the app did anything new. Choose Allow. SimpleShot still reads the screen only when you take a capture, and the checks above show it.

An app avoids the question only by sending every capture through macOS’s window picker, which can’t select an area of the screen. Apple makes an exception only for remote-desktop apps.

Windows macOS keeps out of every capture.

macOS keeps some windows out of every app’s captures: its security prompts, such as the ones that ask for a permission, and windows their app marks as private. They are missing from SimpleShot’s captures, and from its still screen while you choose an area; when SimpleShot can tell that one was in a capture, it says so. SimpleShot can’t change that; other screenshot apps meet the same rule.

macOS’s own Screenshot app captures them: open it from Applications › Utilities, or press ⇧⌘5 if SimpleShot doesn’t use the system’s screenshot keys.

Turning it off.

Turn SimpleShot off in System Settings › Privacy & Security › Screen & System Audio Recording, at any time. It then can’t read the screen at all, and says so when you try to take a capture.