Skip to content

Data, privacy, and security

Local-first operation

Controll3r's primary video, audio, input, OCR, session, and macro workflows run on the operator computer. The target does not need a Controll3r account, network connection, or target-side service.

No cloud service is required for:

  • live control
  • recording and snapshots
  • OCR
  • Visual Anchor matching
  • macro playback
  • session storage

Files stored on the operator computer

Roaming application data:

%AppData%\Controll3r\settings.json
%AppData%\Controll3r\sessions\*.json

Local application data:

%LocalAppData%\Controll3r\macros\*.c3rm
%LocalAppData%\Controll3r\paste-snippets\*.txt
%LocalAppData%\Controll3r\paste-snippets\index.json
%LocalAppData%\Controll3r\shortcuts.json
%LocalAppData%\Controll3r\webserver\
%LocalAppData%\Controll3r\logs\

Default capture output:

%UserProfile%\Pictures\Screenshots\
%UserProfile%\Videos\

The output folders are configurable.

Potentially sensitive content

Review these before sharing:

  • screenshots and recordings
  • OCR text
  • Paste Snippets
  • .c3rm macros containing Visual Anchor images
  • session files containing device configuration
  • diagnostic logs and copied diagnostic reports

Visual Anchor images are small, but they can still reveal target labels, usernames, system names, or other screen content.

REST API defaults

In the normal UI:

  • the server is disabled by default
  • loopback mode binds only to 127.0.0.1
  • LAN access must be selected deliberately

In headless mode, the API is forced on because it is the control surface.

GET /v1/health is unauthenticated. Every other /v1 route requires a bearer token.

Bearer-token handling

  • Treat the token like a password.
  • Do not put it in screenshots, public logs, shell history, or shared scripts.
  • Regenerate it if exposure is suspected.
  • Restart the webserver after regeneration.
  • Give API clients only the network access they need.

The token is stored unencrypted in %AppData%\Controll3r\settings.json — anyone who can read your Windows user profile can read the token, so protect the operator account accordingly. It persists across normal restarts rather than changing unexpectedly on every launch.

LAN HTTPS

LAN mode uses a locally generated self-signed certificate stored under the Controll3r local data directory.

For managed environments:

  • distribute/trust the certificate deliberately
  • restrict the port with Windows Firewall
  • limit source addresses where possible
  • do not bypass certificate verification in production clients
  • rotate the bearer token when access changes

Hardware ownership

Only one Controll3r process can use the capture device and Controll3r Interface at a time; a second process must explicitly take over through the handoff prompt rather than competing for the hardware.

Macro playback also owns target input. Live keyboard and mouse delivery is paused during playback to prevent accidental operator input from corrupting automation.

Uninstall and retention

Interactive uninstall asks whether to preserve user data and defaults to preserve. Silent uninstall preserves data unless REMOVEUSERDATA=1 is passed. The current delete option removes only %LocalAppData%\Controll3r; it does not remove roaming settings or saved sessions under %AppData%\Controll3r.

Before decommissioning an operator computer, review and securely remove:

  • %AppData%\Controll3r
  • %LocalAppData%\Controll3r
  • configured screenshot and recording folders
  • copied or exported .c3rm files

Backup

For a complete user-level backup, include both Controll3r AppData roots and configured capture-output folders. Close Controll3r first so JSON and macro files are not changing during the copy.