PDigger
Report an issue
PDigger is made by eprojac Ltd. Report security issues in the website, Mac app, or local.pdigger.com proxy to admin@eprojac.com. Privacy and data-subject requests use the same address. Please mark vulnerability reports in the subject line.
Please include enough detail to reproduce the issue and avoid accessing other users’ data. We read every report.
We follow coordinated disclosure. Give us a reasonable time to fix an issue before you publish it; we are a one-person company and do not promise a response time, but we read every report. Do not access, modify, or keep other people’s data, and stop as soon as you have shown the issue exists. We do not run a bug bounty programme and do not pay for reports. We will not take legal action against good-faith research that follows these rules.
Permissions and what is recorded
PDigger asks macOS for three permissions. Screen Recording and Accessibility are needed to capture; Input Monitoring is optional.
- Screen Recording: captures the screen through ScreenCaptureKit.
- Accessibility: reads the roles and names of controls in every window it captures (all visible windows it records, not only the one in front). It also looks at the browser address bar (currently Google Chrome) only to recognise Google Docs, Sheets, and Slides, and keeps only the document identifier and the sheet, slide, or tab identifier; nothing is kept from any other web address, and URL credentials are never kept.
- Input Monitoring: records keyboard and pointer events, including key codes and the active keyboard layout, modifier keys, pointer positions, clicks, and scrolling. Without it there is no keystroke evidence.
While macOS secure input is active (password fields and similar), keyboard events and accessibility reads are skipped. Local history in ~/Library/Application Support/PDigger is integrity-hashed but is not encrypted by PDigger; it relies on FileVault. Keep FileVault on.
How PDigger is built to fail closed
- Work history, document maps, and the capture buffer stay on the Mac. Native OCR and local embeddings run on the device.
- Local files are not encrypted by PDigger. Encryption at rest on the Mac comes from FileVault, which we recommend enabling.
- The proxy receives only bounded evidence and input counts. Key codes and typed text never leave the Mac.
- VLM assistance is optional, after Google sign-in from the app. The OpenAI project key never enters the app, the website, or client logs. It is read by the proxy from a server-side config store.
- The proxy accepts only the authorised model, disables provider storage, rejects hosted tools, and records a usage ledger of counts — not screen contents.
- Uploads larger than 5 MiB use an S3 object that is deleted as soon as it is read; an object that is uploaded but never submitted expires under a one-day S3 lifecycle rule (removed within about two days).
- Site and upload buckets are private. The website is served over HTTPS (TLS 1.2 or higher) through CloudFront. AWS-managed stores are encrypted at rest.
- Screening of uncertain media uses an ephemeral crop and does not write that crop into durable history.
We do not claim SOC 2 or a UK/EU-only region. Infrastructure runs in AWS us-east-1.
Retention
- Usage ledger rows: 7 days. Daily quota counters: 2 days. Application logs: 7 days.
- Amazon Cognito sign-in events (recorded in AWS CloudTrail event history): 90 days.
- Sign-in profile and Cognito user record: 12 months after the last signed-in use of VLM assistance (the last authenticated request the app made to local.pdigger.com).
- Large-request upload objects: deleted as soon as they are read; unsubmitted objects expire under a one-day S3 lifecycle rule (removed within about two days).
- Database backups: 7-day point-in-time recovery window.
- Expired rows are purged by DynamoDB TTL, typically within a few days.
Full details are in the Privacy Policy.