Nothing leaves your Mac.

What the app reads

To draw a key on screen, Show KeyPress has to be told which key you pressed. macOS grants that through Input Monitoring — the only privacy permission the app requests. You approve it yourself, and you can revoke it at any time in System Settings › Privacy & Security.

With that permission the app observes keyboard events through a listen-only event tap. Each event is used to draw a keycap and is then discarded. The tap cannot modify or inject keyboard input; it can only watch.

The app does not write keystrokes to disk or to any log, does not send them anywhere, and does not reconstruct typed text beyond the handful of keys currently on screen — which disappear after a short timeout.

The pointer and the pet

When the cursor halo or the pet's cursor reactions are enabled, the app observes pointer movement, button, drag and scroll events through a second listen-only tap. Coordinates are used for the reaction being drawn and are then discarded.

When the pet is enabled, recent key-down timestamps are held in memory for about a second and a half so its typing animation can match your speed. Those are timings only — the app does not retain which characters were typed.

What macOS never delivers

While macOS Secure Input is active — password fields, and anywhere else an app asks the system to protect typing — key events are not delivered to the app at all. Your passwords never reach it, so they can never be drawn. That is a guarantee of the operating system, not a promise of ours.

No network access

The Mac App Store build runs in Apple's App Sandbox and is not granted the network entitlement. It has no ability to make network connections, by design. There is no account, no sync, no telemetry and no analytics in the app, which is also why it works fully offline.

What is stored on your Mac

Your preferences — overlay and pet position, colours, keycap style, display mode, shortcuts and pet behaviour — are saved locally in macOS `UserDefaults` on your own machine. They never leave your device.

macOS may keep those preferences in the app's sandbox container after you remove the app; that retention is the system's, not the app's.

How visits here are counted

This website is separate from the app. Visits are counted with privacy-friendly, cookie-less analytics: the page address and title, the site that linked you here, and your browser language and screen size. A country, browser, operating system and device type are derived from your IP address and user agent. None of it names you, and nothing follows you across other sites.

Clicks on the Mac App Store buttons are recorded the same way, so we can tell which part of the page sends people to the listing.

To stop an automated flood running up the analytics bill, the endpoint that receives those events counts them per visitor. The counter is keyed by a one-way hash of your IP address and browser, held by Upstash for about two hours and then gone. It can tell one browser from another for that window — that is what makes it a counter — but it is never linked to a name, never joined to the analytics data, and never used to build a profile.

What this site does not do

There is no contact form, no newsletter and no account, so the site never asks for or receives an email address. It sets no advertising cookies and shares nothing with advertisers.

Nothing you type into the keyboard demo on the home page is transmitted or stored. It is drawn in your browser and discarded, exactly as the app behaves on your Mac.