ADR 0004: Content Protection (Stealth Mode)
Status
Section titled “Status”Accepted — legal review pending before default or framing changes
2026-07-15
Context
Section titled “Context”The desktop overlay floats over call applications. Users have requested that the window be invisible to screen sharing, screenshots, and screen recordings. This is technically achievable via setContentProtection(true) (Windows: WDA_EXCLUDEFROMCAPTURE, macOS: NSWindowSharingNone). However, “invisible to the other call participant” is a legal/compliance/trust decision, not just an engineering toggle.
Decision
Section titled “Decision”- Build content protection as a user-controllable capability
- Default: OFF in all environments (dev, staging, production). No environment branching.
- User toggles ON via settings or overlay quick-action
- When ON, a persistent shield icon is visible in the overlay header
- Preference persists across sessions via electron-store
Legal-Review Dependency
Section titled “Legal-Review Dependency”The default (ON vs OFF in production) and all marketing/sales framing require legal sign-off before changing. This is a compliance decision, not an engineering one. The current OFF default must not change without that review.
Best-Effort Disclosure
Section titled “Best-Effort Disclosure”Content protection is OS-level best-effort:
- A phone camera defeats it
- Certain capture tools may bypass it
- Coverage varies by OS version and GPU driver
- Remote desktop protocols may not respect it
The product never claims “guaranteed invisibility.”
Consequences
Section titled “Consequences”- Same binary ships everywhere — no
if (isDev)branching - Spike must verify
transparent+alwaysOnTop+setContentProtectioncoexistence on Windows before launch - If content protection forces the overlay opaque, the product behavior is: transparent when OFF, opaque when ON — a designed behavior, not a limitation