Why a markup tool should not upload your screenshots
What a screenshot actually contains, what an upload means in practice and in a contract, why a retention promise is not the same as never holding the file, and the airplane-mode test any reader can run in a minute.
Drawing an arrow on an image is arithmetic on a grid of pixels. Your phone does billions of comparable operations to render this page. There is no computational reason for a markup tool to send your screenshot anywhere, and yet a large share of the free ones do, because a browser tab is the cheapest thing to build and a server is where the business model lives.
This page argues the case, rather than asserting it: what is actually in a screenshot, what an upload means when you look at it practically and contractually, why "we delete it after an hour" is a different claim from "we never had it", and how to check any tool yourself in about a minute.
What is actually in a screenshot
A screenshot is not a picture. It is a photograph of your private state at a moment you chose, and the reason you took it is almost always that something on it mattered.
- The content you meant to capture: a message, a balance, a medical result, an internal dashboard, a contract clause.
- The identity furniture around it — your name in the account row, your email in the sidebar, your company in the workspace switcher.
- The tab strip, which is a list of the other things you were doing.
- The address bar, which frequently contains an account id, a tenant name, or a share token that grants access to whoever holds it.
- The status bar: carrier, time to the minute, battery, and on a desktop your Wi-Fi network name and the menu-bar icons of every app you run.
- A notification banner that arrived mid-capture, which is somebody else’s private message.
- Anything about other people. Their name, their number, their face, their words. You can consent to your own data leaving; you cannot consent on their behalf, and in many workplaces you are contractually not allowed to try.
That last point is the one that converts a personal preference into an obligation. The screenshot you are about to paste into a web editor to blur a customer’s address contains the customer’s address. Uploading it to blur it is a disclosure of the exact thing you were trying not to disclose.
What an upload actually means
Set aside malice, which is rare, and look at the ordinary case. The file leaves your device over the network. It lands on a server you do not control, in a jurisdiction you did not choose, operated by a company you have not researched, which almost certainly uses subcontractors — object storage, a CDN, an error-tracking service, an image-processing library running on someone else’s infrastructure. Each of those is a copy or a potential copy. The file appears in access logs, in backups, in caches, and in whatever queue processed it.
Then there are the terms. Many free image tools include a licence grant broad enough to permit storing, reproducing and processing what you upload — often written for the mundane purpose of making the service function, and drafted wide enough to cover a great deal more. You are unlikely to have read it, and reading it is not really the point: the point is that you have handed over a file you cannot get back, and the terms are the only thing standing between that file and any future use of it, including whatever the company decides after its next acquisition.
And "we delete uploads after one hour" is a genuinely different claim from "we never had your file". The first depends on a policy being implemented correctly, on backups honouring it, on every subprocessor honouring it, and on the company continuing to exist and continuing to care. The second depends on nothing. When the difference is free, take the second.
The argument that is not being made
Not every cloud service is reckless and not every local app is trustworthy. Plenty of hosted tools are run carefully by serious people, and a native app can quietly ship an analytics SDK that phones home with more than a web editor ever asked for. Local is not a virtue in itself.
The argument is narrower and, I think, harder to dispute: for this specific task, the upload buys nothing. Blurring a region and drawing an arrow need no server-side model, no shared state and no collaboration. Where a cloud service earns its keep — synchronising across devices, sharing with a team, doing work your device genuinely cannot — there is a trade to weigh. Here there is no trade. There is only a risk taken in exchange for someone else’s convenience in building the product.
How to check, in one minute
- Put the device in airplane mode, or turn off Wi-Fi and mobile data.
- Open the app and load an image. If it cannot open one, it needed the network to do something it should not have needed the network for.
- Do the actual work: cover something, draw something, crop it.
- Export or save the result. If a complete round trip works with no network, the processing is happening on your device.
- Turn the network back on and see whether anything appears — a queued upload, a sudden sync, a login prompt that was not there before.
The limit of this test, stated plainly: it proves the app can work offline, not that it never sends anything when online. A tool could process locally and still report telemetry. For that, the next checks are the App Store privacy label — specifically whether it declares collecting anything at all — the permissions it asks for, and the size of the download, since an app carrying several analytics SDKs is rarely small. None of these is proof. Together they are a reasonable basis for a decision.
Where Marka stands
Marka has no server to upload to. There is no account, no sign-in, no analytics, no crash reporting and no third-party SDK of any kind — and there is no networking code in the app at all. The Mac sandbox grants exactly three capabilities: run sandboxed, read and write the files you explicitly choose, and network access, that last one solely so Apple’s StoreKit can verify a purchase. On iPhone and iPad the only permission requested is add-only photo library access, which is permission to save the finished image and not permission to read your library; you choose the original through Apple’s own picker, so the app never sees anything you did not hand it.
It is also a scratch pad rather than a library: it holds the image you are working on and keeps no copy after you close it. That is a deliberate limitation with a cost — there is no history to go back to — and it is the right shape for a tool that handles screenshots of your bank statements. The download is 2.4 MB, which is roughly what an app with no server, no analytics and no framework overhead weighs. Run the airplane-mode test on it; that is what it is for.
Frequently asked questions
Is it really a problem to use a web-based blur tool once?
It depends entirely on what is in the screenshot. For a game score, no. For anything containing another person’s data, a work document or an account identifier, you have disclosed the exact thing you opened the tool to hide — and in many workplaces that is a policy breach regardless of what the service does with the file afterwards.
Does an app deleting uploads after an hour solve it?
It reduces the exposure; it does not remove it. That promise depends on the policy being implemented correctly, on backups and caches honouring it, on every subprocessor honouring it, and on the company continuing to exist and to care. "We never had the file" depends on none of those things, and for image markup it is available at no cost.
How can I tell whether an app uploads my screenshots?
Run it in airplane mode: load an image, edit it, export the result. If the whole loop works with no network, the processing is local. Then check the App Store privacy label and the permissions it requests. The test proves the app can work offline, not that it sends nothing when online, so treat these as converging evidence rather than proof.
Why does an offline app need network permission at all?
On the Mac, Marka declares network access for one reason: Apple’s StoreKit has to reach Apple to verify a purchase. That entitlement is unavoidable for any app with an in-app purchase. What matters is whether there is any code that sends your image anywhere — in this case there is no networking code in the app at all.
What does add-only photo access mean on iPhone?
It is permission to write a new image into your photo library and nothing else. The app cannot browse, read or search your photos with it. You select the screenshot you want to edit through Apple’s own picker, which hands over that one image, so the app only ever sees what you explicitly gave it.
Is Marka available in English?
The interface is Simplified Chinese in this version, with no localized strings in other languages. The tools are icons and on the Mac each has a single-letter shortcut, but if you need an English interface you should know before installing.
Do it in Marka
Marka is a screenshot markup app for iPhone, iPad and Mac. Brush a mosaic over what should not be seen, point an arrow at what should, number the steps, crop it to the shape you are posting in, and send. Everything is processed on the device — no upload, no account, no analytics, and a 2.4 MB download. Opening, cropping, the mosaic brush and export are free; Pro is a one-time purchase that covers all three platforms.