Privacy
BaoCut runs on your Mac. Your media, your transcripts, and your edits stay on your Mac. This page describes the only five things that ever leave it, and how to stop four of them.
What never leaves your Mac
No part of BaoCut — not the app, not the command line tool, not the agent skill — ever sends us any of the following. Not in analytics, not in a crash report, not in any form:
- Your audio, video, or recordings
- Your transcripts, subtitles, translations, or chapter titles
- Your file names, folder names, or file paths
- URLs you import from, or the titles of what you import
- Prompts you write, or anything an AI model writes back
- Your API keys
- Raw error messages from BaoCut itself (see Anonymous usage data)
- Your name, email, account, or any identifier you gave us — there is no account to give
We do not use Google Analytics, PostHog, Mixpanel, Firebase, Sentry, or any other third-party SDK inside the app. There is no session replay and no click tracking. There is no automatic crash reporter either: when BaoCut crashes, macOS writes a report on your Mac, and BaoCut leaves it there — it does not ask you about it and does not send it unless you go and tell it to. See Crash reports.
1. This website
When you load a page here, our own server records that a page was viewed. When you click Download for Mac, it records that a download was clicked. Both records contain the same short list, and nothing else:
- Which of the two happened, and the current release version
- Your country, as Cloudflare's network reports it
- Your browser family — safari, chrome, firefox, and so on
- Whether the request looked automated
- The hostname that referred you (for example news.ycombinator.com) — never the full referring URL, which can carry search terms and private page titles
- Campaign tags (utm_source and friends) if the link you followed had them, reduced to lowercase letters, digits, and dashes, and capped at 64 characters
We do not store your IP address, and we do not store your User-Agent string. There is no cookie, and nothing is written to your browser's storage except the theme and language choices you make on this site, which never leave your browser.
We also enable Cloudflare Web Analytics on this site, for browser and page-performance breakdowns. It is cookieless, does not fingerprint visitors, and does not track people across sites. We keep it separate from the numbers above on purpose: it relies on a script that many people block, so it undercounts, and mixing it into a conversion rate would produce a number that is wrong in a flattering direction.
2. Anonymous usage data in the app and CLI
BaoCut can send a small amount of anonymous usage data so we can see which features people actually use and whether they work. It is on by default, we ask you about it before anything is ever sent, and you can turn it off at any time in Settings → Privacy.
The anonymous installation ID
When you agree, BaoCut generates a random 128-bit identifier. It is not derived from your hardware, your network, your macOS install, or anything about you — it is random numbers, generated on your Mac. It is what lets us tell "one person opened BaoCut on thirty days" apart from "thirty people opened it once", and it is the only reason it exists.
The app and the CLI share one ID, so agent-driven work is not counted as a separate person. If you turn analytics off and later back on, BaoCut throws the old ID away and generates a new one — the two are not linked, and the old history is already gone.
What is sent
Events are batched, at most twenty at a time. Each carries the BaoCut version and build, whether it came from the app or the CLI, and a UTC date — the date, never a timestamp. Beyond that, each event may carry only the following, and every one of them is a fixed choice from a fixed list. There is no field anywhere in which free text can be sent:
- Active day — that BaoCut was used at all on a given date, and your macOS major version
- Transcription — started, completed, failed, or cancelled; whether the media came from a file, a recording, or a URL; whether it was the sample project; which of the three built-in speech models ran; and coarse length bands for the media and the processing time (under 5 min, 5–30 min, 30–60 min, 60 min+)
- AI flows — which flow ran (polish, translate, and so on), whether it ran through your coding agent or a cloud provider, and for cloud runs the provider family (anthropic, openai, gemini, xai, or custom) — never the model id, the endpoint, or anything you typed
- Exports — completed, failed, or cancelled; whether it was a transcript, subtitles, or video; and the format
- Updates — that an update installed, and which version it replaced
When something fails, we send a category — one of network, auth, quota, model_missing, media_missing, permission, disk, engine, timeout, or unknown. The original error message stays on your Mac. It has to: those messages routinely quote a file path or a provider name, which is exactly what we are not collecting. (A crash report is the one exception, and only because you read it first and pressed Send.)
Your IP address
Sending anything over the internet necessarily reveals your IP address to the server receiving it. We do not log it, we do not store it, and we never write it next to your installation ID. Your installation ID is also kept out of the request URL for the same reason — a URL is the one part of a request that infrastructure logs by default, and putting an identifier there would hand our own hosting provider a durable link between your ID and your IP no matter what our code did. The ID travels in the request body, where it is not logged.
3. Crash reports
This one is not covered by the analytics setting either, it is off until you turn it on, and BaoCut never interrupts you to ask about it. When an app crashes, macOS — not BaoCut — writes a diagnostic report into ~/Library/Logs/DiagnosticReports. It does that for every app on your Mac and has done for years, whether or not BaoCut ships a single line of code about it.
BaoCut installs no crash handler and uploads nothing. On the next launch it reads that file, replaces the identifying parts, renders a short report, and puts it in Settings → Diagnostics. That is all that happens. There is no dialog: a window that reappears after every crash is one people learn to click through without reading, and a single recurring bug would turn it into a tax on every launch. The only sign anything happened is a small dot on Settings in the sidebar.
So by default, nothing is sent — not once, not ever. A report sits on your Mac until you either open that section and press Send on it yourself, or switch on Send crash reports automatically and decide the question once instead of per crash. Delete removes it, unsent.
Repeats of the same bug are folded into one entry with a count. If a recursion bug crashes you five times, that is one fact and a number — not five near-identical stack traces, and not five things to send.
What is replaced before you ever see it:
- Your macOS user name, everywhere it appears in a path
- The folders inside your home folder — the file name at the end survives, the folders leading to it do not
- The two per-Mac identifiers Apple stamps into every crash log (crashReporterKey and bootSessionUUID)
Expanding a report counts those replacements rather than asking you to take our word for it — 6 replacements · 2 × user name · 2 × path · 2 × device id — and a switch turns the highlighting off so you can read the exact text that would be sent. What is in that box is the whole message: no attached log folder, no second payload, and no installation ID. A crash report is anonymous and is not linked to anything else on this page — which is also why switching analytics off does not switch this off. They are unrelated.
What it does contain is a stack trace, the exception type, your BaoCut and macOS versions, your Mac's model, and how many times that bug hit you — plus one optional line you can write yourself. That line is sent exactly as you type it: it is your sentence, and quietly editing it would be worse than leaving it alone. The field says so right underneath, and your words appear inside the preview with everything else.
This is the only thing on this page that carries free text instead of a fixed list of values, and it is worth being plain about why. Everything else is safe by construction — there is no field anywhere in the analytics code that could hold a file name, so no one has to remember to leave it out. A stack trace has no such shape. It is safe because it does not move until a person decides it should, and for no other reason. If you would rather never think about it, do nothing: that is the default, and nothing is what gets sent.
4. Update checks
This one is not covered by the analytics setting. Roughly three seconds after launch and every 24 hours thereafter, BaoCut asks baocut.app/appcast.json whether a newer release exists. That request tells our server your IP address (as any web request does) and your current BaoCut version, which is in the User-Agent header. It carries no installation ID and nothing else about you, and it happens whether or not you turned analytics on — including before you have answered the analytics question at all. If an update is available and you open its window, BaoCut also asks baocut.app/releases/ for release-note pages as you scroll. Those requests carry the same IP and User-Agent information and no installation ID.
We do not aggregate or analyse these requests. We are telling you about them because they are outbound network traffic and you deserve a complete list, not a convenient one. Turning off Check for updates automatically in Settings stops the scheduled check; the app then only asks when you press Check for updates yourself. The agent skill's own update check works the same way.
5. Cloud AI models
BaoCut's speech recognition runs entirely on your Mac. The AI flows — proofreading, translation, segmentation, and so on — run through your own coding agent by default, which also stays on your machine.
If you choose to configure a cloud provider and enter your own API key, then the text of your transcript is sent to that provider, under your account and your agreement with them, not to us. We never see it, and we never see your key. Which provider family you used is included in the anonymous usage data described above; what you sent them is not.
How long anything is kept
| Data | Kept for |
|---|---|
| Anonymous installation record and daily activity | 400 days after the last day it was active, then deleted |
| Duplicate-detection receipts (an event id and a date, nothing else) | 14 days |
| A crash report you sent (no installation ID) | 90 days |
| Feature breakdowns in Cloudflare Analytics Engine (no installation ID) | 3 months, per Cloudflare's retention |
| Website page views and download clicks (no installation ID) | 3 months, per Cloudflare's retention |
| Cloudflare Web Analytics | Per Cloudflare's own retention for that product |
A nightly job does the deleting. 400 days is chosen so a full year of seasonality stays comparable, plus enough margin to compute it. Crash reports get 90 — a stack trace stops being useful once the code that produced it has moved on, and it is the only thing we keep that contains text a person wrote, so it earns the shortest life here.
Who else touches it
Cloudflare hosts this website, serves the download, and runs the database and analytics storage described above, as our infrastructure provider. Nobody else receives any of it. We do not sell it, share it, or use it for advertising — and since none of it identifies anyone, there is nothing there to sell.
Turning it off, and deleting what is there
Open Settings → Privacy and switch off Share anonymous usage data. Immediately, and in the same click:
- Collection stops, in both the app and the CLI
- Anything still queued on your Mac is discarded
- BaoCut asks our server to delete your installation record and all of its history
If you are offline at that moment, the deletion request is the one thing BaoCut keeps — it retries later, then gives up. Until it succeeds, Settings shows Deletion pending. If it never succeeds, the nightly 400-day sweep removes the record anyway.
Deletion is immediate and permanent where we can reach it: the installation row, every daily activity row, and every receipt are gone in one transaction. The aggregate feature breakdowns in Analytics Engine contain no installation ID, so there is nothing in them to find and nothing to delete; they age out within three months on their own.
Contact
Questions, or a request about your data: privacy@baocut.app.
Changes
If we ever collect something not on this page, we will raise the version number at the top and ask you again inside the app before anything new is sent. We will not quietly widen what is collected under a policy you already agreed to.
Version 3 (17 July 2026) added the language preference to the browser-storage disclosure above. The preference stays in your browser and is never sent to us. This did not change app analytics, so BaoCut did not ask the analytics question again.
Version 2 (16 July 2026) added Crash reports, and it is worth saying exactly how that rule was applied. The version number went up, because this page changed. The analytics question was not asked again, because analytics did not change — re-showing that notice would have re-opened a settled decision about a thing we did not touch. Nor did we add a new question anywhere else: BaoCut does not prompt you about crashes at all. It collects them on your Mac and sends nothing, and it keeps sending nothing until you go and ask it to. If you never do, nothing about this change ever reaches us, and the switch you already set still means what it meant.