The Spectate app iconSpectate

Privacy

What this website and the Spectate app do with data, in plain words, checked against the code.

The short version

This website

spectate-app.com is served by Cloudflare. Like any host, Cloudflare keeps the standard logs a web request produces (your IP address, browser and the page you asked for) for the time and purposes set out in Cloudflare’s privacy policy. I do not add tracking of my own.

Each page loads a small beacon from Cloudflare Web Analytics that counts visits. It uses no cookies, stores nothing in your browser and does not fingerprint you, which is why there is no cookie banner. What I see is a count of visits per page, not who made them.

If you email me, your message stays in my mailbox and I use it to reply to you. I keep no mailing list and I do not pass your address to anyone.

The app on the Pro’s Mac

The standard Spectate app has no telemetry, no crash reporting and no analytics, and it does not know who you are. The things that send data off the Mac beyond the update check, all of which need the app to be set up with a recordings service of mine, are described under Branded editions.

Without any of those, the app makes one request outside the room: once a day and when it launches (those automatic checks wait while you are sharing), and whenever the Pro chooses Check for Updates, it asks the update feed whether a new version exists. That request carries the app’s name and version, plus the details any web request carries, and Cloudflare, which serves the feed for me, sees the Mac’s IP address in its edge logs. Nothing else goes out, and nothing installs until the Pro clicks Install.

With Record Sessions on, the app records the shared screen and the Pro’s microphone to a file on the Pro’s Mac. With the transcript switch on, it also makes a plain text transcript on that Mac from the Pro’s microphone while it records, using Apple’s on-device speech recognition; nothing leaves the Mac. The recording stays on the Pro’s Mac, and so does its transcript; both are served only to the room over the local network, the same way the live stream is. They leave the Mac only if the Pro puts them online with Put Online for Participants, described under Branded editions. Without that, the update check is the only request the app makes outside the room. The one other thing that comes in from outside is the speech model: macOS fetches the speech model for the Pro’s language once, from Apple.

macOS asks for up to four permissions. Screen Recording lets Spectate capture the display, window or app the Pro chose; those frames go to the browsers in the room and nowhere else. Local Network lets it publish its <name>.local address so people can type it. The third is the Microphone, asked the first time a recording starts, so your voice reaches the recording. The fourth is Speech Recognition, asked the first time a transcript is made. Its prompt says speech data will be sent to Apple. That is the standard wording macOS uses for this permission, not what the app does: the transcript is made on the Mac, by Apple’s on-device speech model. None of it sends anything to me.

On the Mac itself, Spectate remembers the source you picked and your upload settings, and reads the optional config file described on the help page. Both stay on that Mac.

In the room

People on the same network open the app’s address in a browser and the Pro’s screen is sent to that browser and nowhere else. There is no password on the stream: anyone on that network who has the address can watch, so keep the Mac on networks you control. The menu shows how many people are watching; Spectate does not store a list of them.

When the Pro turns uploads on, participants type a name and drop photos. The photos land in a folder on the Pro’s Mac and the typed name becomes part of the file name. I never receive the photos. The typed names stay on the Pro’s Mac too, except inside a diagnostics report the Pro chose to send (see Branded editions). What the workshop company then does with participants’ photos is between the company and its participants, and the company is responsible for it.

Branded editions

An edition built for a workshop company carries that company’s name, logo, colours and address inside the app. It holds nothing about the company’s people. It checks its own update feed the same way the standard app does.

An edition set up to reach my server (today, the one built for Muench) does three more things. The standard app, with no recordings service, does none of them.

Anonymous performance numbers. This is on by default, and the Share anonymous performance data switch in Settings › Support turns it off. While the Pro shares, the app notes only numbers and short labels from a fixed list: the frame rate and data rate, how many people are watching, processor and memory use, how warm the Mac is, whether it is on a cable or Wi-Fi, how long frames take to encode, and events such as a share starting or stopping, a viewer joining or leaving (with their browser and system family, for example Safari on macOS), a viewer’s player retrying or falling back with a short reason, and a recording starting, finishing or failing. Each session also notes the app version, the macOS version, the Mac’s model and chip, and a random install ID that stands for the Mac and names no one. There are no names, file names, folder names, window titles, network names or addresses in it, and nothing of what was shared.

The numbers stay on the Mac while the Pro shares. Afterwards, when the Mac can reach my server, the app sends each finished session and deletes it once my server confirms it has it; with no connection it keeps the file and tries again later. It never sends while the Pro is sharing. Switching the setting off stops the collecting and deletes anything not yet sent. I keep the numbers for 2 years, stored without the Mac’s IP address. Cloudflare, which runs my server, sees the address in its edge logs, like any web request.

Put Online for Participants. When the Pro presses it in Recordings…, the current workshop’s recordings are uploaded to my server so participants can watch them afterwards: each recording’s video and, if there is one, its transcript. Recordings the Pro has hidden stay on the Mac. The first time, the Pro gives a name and email and types the 6-digit code I email them, and that email address identifies the Pro to me. Nothing goes up until the Pro presses the button, it pauses while the Pro shares, and the Pro can take a recording offline again.

Diagnostics reports. A report is made only when the Pro chooses Send Diagnostics…, in Settings › Support or the Help menu, or answers Send Report… to the question the app asks after it quit unexpectedly. A sheet first lists what the report holds and lets the Pro cancel: the app’s log from the last 7 days (which includes file names and participant names), crash reports from the last 30 days, the settings without the Pro’s email or any keys, the Mac’s model, macOS version and free disk space, permissions, microphones and network status, the list of recordings with their names, sizes and lengths, and the recordings waiting to go online. It holds no video, no photos and no transcripts. Nothing is sent unless the Pro confirms. I use a report to find out what went wrong, and I delete it after 90 days.

Changes to this page

If Spectate or this site starts doing something new with data, this page changes and so does the date at the bottom. The date is the record.

Contact

Konrad Michels, konrad@tonalphoto.com. Ask me anything about this page and I will answer in plain words.

Version 2026-11-10