Protection is the product. Detection just saves you a keypress.
StealthShare does two separate jobs. Reliable on-screen protection is the primary product that guards your windows. Automatic detection simply saves you a keypress by deciding when to switch it on before you share.
Two halves, and only one of them can miss
Protection — the hiding itself
Desktop icons and widgets hidden, wallpaper swapped for a neutral backdrop, chosen app windows blurred in the shared feed, notification banners silenced, risky pastes blocked.
This never depends on detection. However Privacy Mode gets turned on — your hand, the hotkey, the calendar, or auto-detect — the hiding is identical, and identical in both the App Store and direct-download builds. Nothing here is guesswork.
Detection — the "when"
Watching for a live microphone, a live camera, a screen being shared, or a meeting on your calendar, so protection is already on before your screen is visible.
This is the part that can be wrong — it can miss a silent meeting, and it can fire when you did not want it to. Everything below is about being precise on exactly when.
So the honest summary: if you press ⌘⇧P yourself, StealthShare is deterministic. Detection is a convenience layer bolted on top of something that already works.
How it works out that you are in a call
Three independent layers, running at the same time. They overlap on purpose — if one misses, another usually catches it.
The meeting watcher — your calendar
Reads your calendars locally and arms Privacy Mode 1 to 30 minutes before a scheduled video call — 15 minutes by default, and you pick the number. The only layer that protects you before anything happens.
- Counts down in the menu bar and in the popover, so you see it coming
- Armed too early? Not now gives your screen back until the call starts
- Holds protection through the scheduled end time
- Works with iCloud, Google and Exchange calendars added to macOS
- Off by default — you turn it on
Live detection — what the Mac is doing
Checks every second whether hardware is actually live. Not whether an app is open — whether something is genuinely capturing.
- Microphone live — about a second
- Camera live — about a second
- Screen being shared or recorded — about ten seconds, on purpose
The ten seconds are there so that pressing ⌘⇧4 never flips your desktop: macOS keeps its recording light on for ~3.8 seconds after any screenshot, and duration is the only thing that separates one from a real share. It only applies when you are muted with the camera off — the moment either goes live, you are protected in about a second.
You — manual control
The fallback that cannot fail, and the one that overrides everything else. If you flip the switch yourself, StealthShare will never turn it off behind your back.
- ⌘⇧P from any app
- The switch in the menu-bar popover
- Auto-detect never overrides a manual choice
What does not count as being in a call
An app simply being open — or being the window you are looking at — is not evidence of anything. Slack, Teams and Zoom sit open with a window all day between meetings. Treating that as "in a call" meant Privacy Mode stayed on permanently for anyone who leaves them running, so it does not count any more. Only live mic, live camera, or a live screen share.
A consequence worth knowing: the built-in app list and any apps you add under Custom Monitored Applications now only decide the label you see ("Zoom" instead of "Microphone in use"). They do not change whether you get detected. Detection is hardware, full stop.
Try the logic yourself
Flip the switches on the right the way a real call would, and watch the desktop on the left. Click any window to work in it — that is how Present Mode decides which one stays readable. This runs the same rules the app does, including the delay before it arms.
What's happening on your Mac
Five things worth knowing exist
Everything here is reachable from the menu-bar popover or the Control Panel — and the Control Panel has its own Privacy Mode switch, so a hidden menu-bar icon never leaves you stuck.
Blur everything but this window
Every background window is covered; only the one you're working in stays readable. Click a different window and the clear one follows you. It's remembered between launches, so turning it off sticks.
Reveal one window for 8 seconds
For "let me just show you this". Works even on an app from your blur list, then re-covers itself automatically so you can't forget.
For deliberate recordings
15 minutes to 4 hours, or until you turn it back on. Everything but the last expires by itself, and it asks first — spelling out that your real desktop will be recorded.
Yours to edit, all of it
Ships covering Slack, Mail, Messages, WhatsApp, 1Password, Bitwarden, KeePassXC, Apple Passwords, Signal and Telegram. Every entry can be switched off or deleted, including the built-in ones, and you can add any app.
Both are yours to change
The Privacy Mode toggle and the peek key are click-to-record in Settings. A shortcut with no ⌘/⌥/⌃ is rejected — it would fire while you type.
Armed before the call, on your terms
Pick how early: 1, 5, 10, 15 or 30 minutes. The popover and the menu bar count down to it. If it arms sooner than you wanted, Not now hands the screen back — and it arms again when the meeting actually starts, because that is the moment that matters.
What armed it, and for how long
The last 100 sessions, with the trigger spelled out — "Zoom · 12 minutes", "Calendar · 34 minutes", "Turned on manually". It records what switched protection on, never what was on your screen, and it never leaves your Mac.
Dock icon, not just the menu bar
A crowded menu bar on a notched Mac makes macOS silently drop the icon. StealthShare sits in the Dock and ⌘-Tab too, and the Dock icon opens the Control Panel — the one route that can't be hidden.
What actually happens, situation by situation
| Situation | Auto-arms? | What happens |
|---|---|---|
| Zoom/Teams call, you unmute | Yes | Mic goes live → protected within about a second. |
| You click "Share screen" | Yes | The strongest trigger, and the one that matters most. Fires for whole-screen and single-window shares. With your mic or camera live: about a second. Muted with the camera off: about ten seconds, so a screenshot can't be mistaken for a share. |
| You press ⌘⇧4 to take a screenshot | No | macOS lights the same recording light for ~3.8 seconds afterwards. StealthShare waits it out instead of flipping your desktop for four seconds every time. |
| Browser meeting (Google Meet, web Teams) | Yes | Same rule — mic, camera or sharing. The browser being open is irrelevant. |
| An app nobody has heard of | Yes | Detection never looks at which app. If it uses mic, camera or screen, it is caught. Shown as "Microphone in use" rather than a name. |
| Muted, camera off, not sharing — just listening | No | Nothing is capturing, so nothing fires. Use the calendar layer, or ⌘⇧P. This is the real gap. |
| Dial-in by phone, screen not shared | No | Your Mac is doing nothing. Nothing to detect. |
| Scheduled call with a Zoom/Teams/Meet link | Yes | Armed as early as you chose — 15 minutes by default — before you even join. This is what covers the muted case above. |
| It armed early and you're not ready | Snoozed | Press Not now. Your screen comes back until the meeting's real start time, and then it arms again. There is deliberately no way to skip the meeting itself. |
| You turn protection off during the meeting | Stays off | That's an unambiguous no and it's respected — it won't arm itself again for that meeting. |
| A meeting added five minutes before it starts | Yes | The watcher re-checks every 20 seconds and also the instant macOS reports a calendar change, so a late invite is normally picked up within seconds. |
| Recording a screencast on purpose | Yes — maybe unwanted | Sharing is sharing as far as the Mac is concerned, so it arms and your wallpaper changes mid-recording. See the limits below. |
| Listening to music | No | Playback is not capture. Deliberately ignored. |
| Slack open all day, no call | No | An open window is not a meeting. |
| An app you never added — a vault, a terminal, notes | Covered | Not by the blur list, which only knows what you listed — by Present Mode, which blurs every background window. This is the gap a list can never close. |
| You click a window on your blur list | Stays covered | On purpose. It comes to the front but keeps its mask, so reaching for your password manager mid-call cannot reveal it. ⌘⇧E shows it for eight seconds if you mean to. |
| You edit the blur list mid-call | Applies at once | Switch an app on or off and the masks change immediately. No need to turn Privacy Mode off and on again. |
| Afterwards: "what turned it on at 14:15?" | Logged | History shows every session with its trigger and duration — calendar, detection, or your own hand. |
How well the calendar layer really works
It is not a guess or a confidence score — it is a plain matching rule, so it is either 100% for a given meeting or 0%. What matters is which of your meetings qualify.
It always arms when…
- The invite contains a link to zoom.us, teams.microsoft.com / teams.live.com, meet.google.com, or webex.com
- …in the event's URL field, notes, or location
- The event is on a calendar macOS knows about, and is not an all-day event
- You granted calendar access and switched the feature on
Meet all four and it arms every time, as far ahead as you set — 1, 5, 10, 15 or 30 minutes, 15 by default. It re-checks every 20 seconds, and immediately whenever macOS says a calendar changed, so a meeting added at the last minute is still caught.
It never arms when…
- The meeting uses anything else — Slack huddles, Discord, Whereby, GoTo, BlueJeans, Around, or an in-house tool
- A Teams tenant on a non-standard domain (e.g. government teams.microsoft.us)
- There is no link at all — a phone bridge, or an in-person meeting where you still share your screen
- The event is all-day, or the link only exists in an attachment
Realistically: high coverage if your workplace auto-inserts Zoom/Teams/Meet links (most do), near zero if it does not.
Because it is exact-match, the calendar layer is best thought of as a safety net for the muted-and-listening case, not as your primary defence. Live detection is the primary one.
The limits, including the awkward ones
There is a gap — about a second, or about ten
StealthShare checks the hardware once per second. Between the instant your microphone or camera goes live and the instant protection lands, your real desktop can be on the call for up to a second — usually less.
One case is slower on purpose. If you are muted with the camera off and the only signal is the screen being captured, StealthShare waits ten seconds before believing it. macOS keeps its recording light on for about 3.8 seconds after any capture — including one ⌘⇧4 screenshot — and duration is the only thing that tells the two apart. Without the wait, every screenshot anyone took hid the desktop and swapped the wallpaper for four seconds.
Neither number can be tuned to zero: macOS gives no notification when capture begins, so the only option is to keep asking. If the gap matters to you, use the meeting watcher, or arm it yourself before you join — then there is no gap at all.
The App Store build cannot tell a camera from a screen recording
The Mac App Store sandbox blocks reading the camera directly, so that build watches the recording indicator macOS shows instead. It works — but macOS lights the same indicator for screen recording, and the two are genuinely indistinguishable without a permission StealthShare does not ask for.
Practical effect: the App Store build may say "camera or screen capture" rather than naming which. The direct-download build reads the camera directly and can tell them apart.
Recording on purpose? Pause it
Your Mac cannot tell a screencast you are making deliberately from a meeting you are sharing into — both are just "the screen is being captured". Left alone, Privacy Mode would arm and change your wallpaper in the middle of your own recording.
So there is a Pause auto-arm control in the popover. Pick how long — 15 minutes, 30 minutes, 1, 2 or 4 hours, or until you turn it back on — and detection keeps watching and reporting, but stops arming. ⌘⇧P still works throughout if you want protection anyway.
Every option except the last expires by itself, and the popover counts down the time left. That is deliberate: a pause you forget about is how you end up unprotected on your next real call.
Because pausing is the one action in StealthShare that can leave something exposed, it asks first and spells out what follows — that nothing will arm on its own, that whatever you record will show your real desktop, wallpaper and open Slack or Mail windows, that any protection StealthShare armed switches off while protection you switched on stays, and the exact time auto-arm returns. Tick "Don't ask again" once you know the drill.
The blur list only covers apps you listed
Window blurring is opt-in per app, so it fails open: an app nobody added — a password manager, a terminal, a notes app — is shown in full while StealthShare still reports that it is protecting you. The defaults now include password managers, Signal and Telegram for exactly this reason.
Present Mode inverts it. Turn it on and every background window is blurred, leaving only the window you are working in readable — so it fails closed and covers apps that were never on any list. Click a different window and the clear one follows you. Listed apps stay blurred even in front, so switching to your vault mid-call does not reveal it, and ⌘⇧E reveals the front window for 8 seconds when you genuinely want to show it.
It is deliberately manual. Engaging it by itself would mean knowing your screen is really being shared, and that cannot be separated from an ordinary call while your microphone is live — macOS lights one shared indicator for mic, camera and screen capture. Since you are almost always unmuted while sharing, an automatic version would fail exactly when it mattered.
Blurred windows are hidden from you too
A blurred window is covered on your own display, not just in the shared feed. macOS gives no way to draw one image to the screen and a different one to a capture, so anything hidden from your audience is hidden from you as well. ⌘⇧E is the escape hatch.
What it cannot hide at all
- The macOS menu bar and Spotlight — drawn by the system, above everything
- Other tabs inside a browser window you are deliberately sharing
- Your webcam video and your actual room
- The contents of held notifications — it tells you how many were held, never what they said