You should not have to believe any of this. Each claim is a command.

Before you run any of them

The permission belongs to the binary that reads.

The Accessibility API is permission-gated by macOS, and the grant is held by whatever binary walks the tree — your terminal, if you run these from a shell, and not an application bundle. Grant it in System Settings → Privacy & Security → Accessibility, then build the probe once:

If the grant is missing, the probe says so and reads nothing. It does not fail quietly, because a capture tool that reads nothing and prints nothing looks exactly like a capture tool that is working.

Some things about you are inferred. This kind, the machine is simply told.

This one was found by running the live path rather than by reading the code. A Terminal window went through the redactor with an account name sitting in its title line, and not one pattern pass had an opinion about it. Nothing in it looked like a name. It was a lowercase token next to a path, which is precisely the shape a pattern cannot claim.

The machine knows who it is running as. The macOS account name, the home directory and the device name are known at runtime, not detected, so they are removed by exact match — longest first, so that a home directory is taken before the account name inside it — at full precision, with nothing to tune and no threshold to get wrong. That pass runs first, because pass order decides which label a span ends up with and exact knowledge has to outrank every guess.

It is deliberately not counted in the published twenty. That number describes patterns, and this is not one. Adding it to the pattern table would change a number printed on four surfaces without anybody editing the copy, which is the sort of tidy-up that looks like housekeeping and reads like a claim. A check asserts it stays out.

That is the trust demo, and it is the one worth running first. It prints the sketch after redaction, names each kind it removed and how many of each, reports whether the sketch was truncated at the cap, and runs the leak guard over the result before showing you the sketch as it would leave this Mac.

  1  Mail             41 nodes     6.2 ms read   5.36 ms redact    77 chars  1x email, 2x self  correspondence 0.80
  2  Preview          18 nodes     4.4 ms read   0.05 ms redact    46 chars  nothing matched  unclassified

The screen is thrown away before the note exists.

Five mechanisms, in the order they run. Twenty-one passes over fifteen kinds — names, email addresses, phone numbers, street addresses, card and account numbers, social security numbers, other national identifiers, record ids, dates of birth, amounts, meeting links, file names, keys and URLs — plus the exact-match pass above, which runs before all of them.

Then the 800-character cap truncates what is left — at the end of the redaction pass itself, not on the way out, which is why it is second here and not last. The cap exists for the privacy claim and not for the bill, and it is not going up.

Then the sketch is a branded type with exactly one constructor, and that constructor takes a redaction result. An un-redacted sketch is not a thing you could write down: it does not typecheck. Then exactly one file in the codebase may build the outbound object, from a dedicated struct, re-checked against an allowed-keys set that throws on an extra key and on a missing one — because a serializer that only catches extras is a serializer that will one day send seven fields and call it eight.

Then the leak guard, which is three tests and not one. The first refuses a field that shares a run of more than twelve characters with the text as it was before redaction — every field except the sentence itself, and except a label that is a member of the closed vocabulary. Those two exemptions are the honest part: the sentence is by construction made out of the raw text, so applied to it that rule would refuse every crossing including the correct ones, and a practitioner reconciling an account has the word “reconciliation” on screen all morning. What guards the sentence is the other two tests, and they apply to every field with no exemption: one refuses anything in which text the redactor removed has survived, and one refuses anything still holding a URL, an email address or a key, whether or not the redactor ever saw it.

This section is the one you can check without a Mac and without building the probe: the reading is a line of JSON on standard input, so you can put your own sentence in it and watch what comes out. It prints what the redactor removed, whether the cap truncated anything, what the leak guard made of the result, and the sketch as it would leave the machine. Feed it something the redactor half-catches and it will refuse the sketch rather than send one that looks redacted and is not.

Nobody switches it on for you. The person whose screen it is does.

This is copied, deliberately and almost line for line, from the only consent model a capture product has ever shipped into companies with. On a managed device, Microsoft Recall is removed by default, and an IT administrator can never enable it on a user’s behalf — each person opts in individually, on their own machine. An admin cannot export another user’s data either. Every capture product that tried the other arrangement, where the organisation switches it on for everybody, got a rewrite or a recall.

So Octopus is switched on by the person whose screen it is, on their own Mac and their own Claude or ChatGPT plan — or it does not run at all. There is a second thing to say about that, and it is a practical argument rather than an ethical one: when the company chooses the tool, about one in three people end up using it, and when the person chooses, five in six do.