Skip to content

ADR 0004: Content Protection (Stealth Mode)

Accepted

Accepted — legal review pending before default or framing changes

2026-07-15

The desktop overlay floats over call applications. Users have requested that the window be invisible to screen sharing, screenshots, and screen recordings. This is technically achievable via setContentProtection(true) (Windows: WDA_EXCLUDEFROMCAPTURE, macOS: NSWindowSharingNone). However, “invisible to the other call participant” is a legal/compliance/trust decision, not just an engineering toggle.

  1. Build content protection as a user-controllable capability
  2. Default: OFF in all environments (dev, staging, production). No environment branching.
  3. User toggles ON via settings or overlay quick-action
  4. When ON, a persistent shield icon is visible in the overlay header
  5. Preference persists across sessions via electron-store

The default (ON vs OFF in production) and all marketing/sales framing require legal sign-off before changing. This is a compliance decision, not an engineering one. The current OFF default must not change without that review.

Content protection is OS-level best-effort:

  • A phone camera defeats it
  • Certain capture tools may bypass it
  • Coverage varies by OS version and GPU driver
  • Remote desktop protocols may not respect it

The product never claims “guaranteed invisibility.”

  • Same binary ships everywhere — no if (isDev) branching
  • Spike must verify transparent + alwaysOnTop + setContentProtection coexistence on Windows before launch
  • If content protection forces the overlay opaque, the product behavior is: transparent when OFF, opaque when ON — a designed behavior, not a limitation