Built around whatstays on your device
Actions see only the text you select. Memory sessions stay on your Mac. Nothing else leaves the device without you asking.
Four things we promise
Khint is a client on your machine, not a service watching it. It runs when you press a shortcut and sits idle the rest of the time. Each promise below is a design consequence you can verify, not a policy you have to trust.
On-device by default
Screen capture happens on-device. OCR text extraction uses Anthropic's Claude Vision API: the screenshot is not stored beyond that call. Memory sessions live in a SQLite file on your Mac. Nothing else leaves the device unless you trigger an Action.
Action-driven, not always-on
Khint isn't watching screens or keystrokes. The only things sent to the inference API are the text you highlighted, plus (optionally) the compact context of your active session.
No training on your data
Our cloud inference provider contractually doesn't train on inputs or outputs. We don't run any model fine-tunes on user data ourselves.
Explicit cloud sync
Cloud sync is opt-in via sign-in. If you don't sign in, nothing leaves your machine. If you do, Packs sync in full but history syncs as metadata only: the text in and out stays local, and Memory sessions never sync. Hashed session tokens; the database is reachable only via our service key.
Where every byte goes
- 1You highlight text in any app
- 2Your shortcut opens the palette
- 3You pick an Action
- 4Khint sends the selected text, plus the optional compact session context, to the inference API
- 5The API returns the rewritten text
- 6Khint pastes it back where your cursor was
- 7Local SQLite logs input and output for your history
Two other outbound calls exist: if you are signed in, Packs sync to Supabase and history syncs as metadata only (never the text), and Khint checks for app updates on launch. Both are detailed on the Privacy page.
What we don't claim
A young product earns trust by naming its gaps, not by renting badges. Here is where we actually are.
We're pre-audit. The design compensates: action text and Memory sessions never reach our servers, so the sensitive surface stays on your machine.
Responsible disclosure goes straight to the founder's inbox and gets a reply, not a triage queue. Reward money comes with revenue.
Uninstalling wipes the local database. For server-side data, one email and we delete it. Self-serve deletion ships once we have the users to justify it.
The questions a security team would ask
Does Khint watch my screen all the time?
No. Khint reads selected text only when you press your shortcut and pick an Action, and reads pixels only when you press the capture shortcut for OCR. There is no background screen capture, no keystroke logging.
Where does the AI run?
On a hosted inference API. When you trigger an Action, the highlighted text (plus optionally the compact session context) is sent to the API. The response comes back, gets pasted, and is logged in your local SQLite history.
Do you train on my data?
No. Our inference provider's API terms prohibit training on customer inputs and outputs. We don't run any fine-tunes ourselves.
What about OCR? Is the screenshot uploaded?
On macOS, Khint captures the screen on-device: the screenshot stays on your Mac. The image is then sent to Anthropic's Claude Vision API to extract the text; nothing is stored beyond that single call. The screenshot itself is never uploaded to Khint's servers.
What is stored, where?
Everything lives in local SQLite on your Mac: Actions, Memory sessions, and your full history including inputs and outputs. If you sign in, your Packs and Actions sync to a Supabase Postgres database (encrypted at rest), and history syncs as metadata only: action name, timestamp, duration. The text you ran an Action on and the result never leave the device, and Memory sessions never sync at all. Stripe holds your billing details if you upgrade.
What macOS permissions does Khint need?
Accessibility only: it's what lets Khint read the selected text and paste the result back. Khint never asks for Screen Recording: captures are delegated to macOS's own screenshot picker, which runs with your authority, so Khint's process can't see your screen on its own.
Where are my integration credentials stored?
In the macOS Keychain. Your Jira/Confluence API token, Linear, Notion and Slack tokens, and the Gmail OAuth grant live in the system keychain, never in a plain config file, never on our servers. Khint calls those APIs directly from your machine.
What can MCP clients like Claude Desktop actually do?
Reads go through a read-only handle on the local database. Writes go through a localhost-only endpoint protected by a 256-bit token (file mode 0600), Host/Origin checks, and a 60 writes/min rate limit. And every write is appended to a local audit log and surfaced as an OS notification, so nothing lands in your Memory silently.
Can I delete everything?
Yes. Uninstall Khint to wipe the local database. If you signed in, email us and we'll delete your server-side data. (We'll automate this once we have more users.)
Found something? Tell us
We don't run a bug bounty yet, but we read every email. Responsible disclosure goes a long way at this stage.