Competitive Landscape

10+ competitors mapped across discovery, execution, and adjacent categories.

Direct Competitors

Autostep.ai YC X25 $1.1M

Cofia.ai YC W26

Edra.ai $30.3M

More Funded Competitors

Adjacent: Desktop AI Agents

Big Tech + Incumbents

Landscape Map

Technical Approaches

Three approaches analyzed with tradeoffs. Industry converging on OS-level events + screenshot fallback.

Comparison Matrix

Approach A: Screen Recording + AI

Capture screenshots periodically → OCR/Vision extraction → LLM analysis for workflow patterns.

• Key tech: mss, OpenCV, Tesseract, Claude Vision / GPT-4o
• Insight: Screenpipe (17K+ stars) proves this works but evolved away from pure screenshots toward event-driven + accessibility tree
• Risk: macOS TCC permissions are painful. Captures everything on screen including sensitive data.

Approach B: Browser Extension

Chrome Manifest V3 extension captures URL patterns, DOM interactions, click targets.

• Key tech: Manifest V3, content scripts, service workers
• Fatal limitation: Blind to desktop apps, Slack, email clients, IDEs, terminals. Misses 40-60% of knowledge worker activity.
• Distribution risk: Google can pull your extension. Store review rejects ~35% on privacy grounds.

Approach C: OS-Level Monitoring

Track active window, accessibility tree, file events, input patterns via OS APIs.

• Key tech: pyobjc (macOS), pywinauto (Windows), watchdog, macapptree
• Insight: This is where the industry converged. Screenpipe, Microsoft Recall, and most funded players use this foundation.
• Risk: Separate implementations per OS. Two products to maintain.

Recommended: Hybrid Architecture

Layer 1 — OS-Level Events (always on)
  → App switches, window titles, file operations
  → Cheapest, lowest privacy risk, broadest coverage

Layer 2 — Accessibility Tree (on demand)
  → When repetitive pattern detected, snapshot UI elements
  → Rich structured data without screenshots

Layer 3 — Screenshot (rare fallback)
  → Only when accessibility tree unavailable
  → Encrypted, auto-purged after 24h

Layer 4 — Browser Extension (optional enrichment)
  → For web-heavy workflows, URL patterns + DOM interactions

Inference Cost Optimization

Stack Recommendation

Verdict: Python MVP is the right call. Fast iteration, rich ML ecosystem, CTO can ship quickly. Rewrite performance-critical paths to Rust later if needed.

MVP vs. Future Vision

Progressive build path from 4-week prototype to the automation OS.

MVP — "Pattern Detective" (4-6 weeks, macOS only)

1. Background daemon tracks active window (app name + title) every 2 seconds
2. Logs app switches, time-per-window, file opens/saves
3. Every 10 minutes, batches events → Claude Haiku: "What's repetitive?"
4. Stores detected patterns in SQLite
5. Menubar app: "You've done [pattern X] 12 times this week. Want to automate it?"
6. Links to suggested automation (AppleScript, Shortcuts, Zapier) — does NOT execute

Cost per user: ~$0.03/day ($0.90/month)
Success criteria: 3+ real repetitive patterns detected per user per week

V1 — "Pattern Detective + Automation Suggest" (3-4 months)

• Accessibility tree snapshots for richer context
• Screenshot fallback for apps with poor a11y
• One-click automation setup (generates AppleScript/Shortcuts/Zapier configs)
• Pattern dashboard with time-saved estimates
• Windows support (beta)
• Optional browser extension enrichment

V2 — "AutoPilot" (6-12 months)

• Automation execution (supervised → autonomous)
• Team features (shared pattern library, org-wide insights)
• Integration marketplace (Slack, Jira, Salesforce, HubSpot)
• Local model fine-tuning on user's workflow patterns
• Admin dashboard with ROI metrics ("saved X hours this month")
• Enterprise features (SSO, audit logs, data residency)

Future Vision — "The Automation OS"

Every knowledge worker has a personal AI that learns how they work, progressively automates the boring parts, and compounds institutional knowledge. The tool becomes indispensable because it gets smarter with every day of use — unlike traditional automation that's static once built.

Risk Assessment

Three biggest risks and three strategic options.

Top 3 Risks

Menu of Options

Screenpipe Ecosystem

Deep dive on the platform we'd build on top of. 17K+ stars, pipe API, data model, constraints.

Architecture

Event-driven capture (not continuous recording). Triggers on: app switches, clicks, scrolling, clipboard, typing pauses, idle fallback (~5s).

Data Model (API at localhost:3030)

Pipe System (Plugin Architecture)

A pipe = single pipe.md file in ~/.screenpipe/pipes/{name}/

---
schedule: every 30m    # cron, "every Xm/h", or "manual"
enabled: true
provider: anthropic
model: claude-sonnet
---

[Your prompt here — AI agent executes it, querying localhost:3030]

Constraints

• Global semaphore — only one pipe runs at a time
• Max 8h lookback per run
• Poll-based, not event-driven — no real-time triggers in the pipe system
• Every run burns LLM tokens (AI agent executes the pipe)

Existing Pipes

Time tracking (Toggl), daily journal (Obsidian), standup reports. No automation detection pipes exist. This is our first-mover opportunity.

WebSocket API

/ws/events — real-time event stream, outside the pipe system. Enables a companion service for real-time pattern detection.

Build Opportunity

Cofia vs Autostep vs AutoReview

Head-to-head comparison of the three earliest-stage players. Clear positioning differentiation.

Head-to-Head

Market Segmentation

Exploitable Gaps

1. Open source + privacy-first — only GDPR-viable option. Local-first, auditable, no surveillance.
2. Individual-first — user opts in to help themselves, not get monitored by their boss.
3. Existing distribution — Screenpipe's 17K+ stars, 10K+ Discord = built-in audience.
4. No surveillance optics — "your data, your machine, your automations."
5. Cost structure — can undercut enterprise SaaS dramatically.
6. No technical moat from competitors yet — both <1 year old, tiny teams.

Where They Beat Us

1. Enterprise sales — Autostep has SOC 2/HIPAA, sells to C-suite
2. Team-level aggregation — both do multi-user; AutoReview is individual-only
3. Founder pedigree — Duolingo + Stanford (Cofia) and Cognition backing (Autostep)
4. Zero-config magic — Cofia's pitch is cleaner than "install Screenpipe + install pipe"

Screenpipe Plugin MVP

Product definition for the "Safe Bet" — validate demand on Screenpipe's infrastructure before building our own.

What It Is

A Screenpipe pipe that analyzes captured screen activity, detects repetitive workflow patterns, and suggests automations. "Your personal automation consultant that watches how you work."

The Problem

Knowledge workers repeat the same workflows dozens of times per week without realizing it — copying data between apps, switching between tools, manually compiling reports. They know automation exists but don't know what to automate or how.

How It Works

Screenpipe captures your activity (already running)
        ↓
AutoReview analyzes patterns (our pipe)
        ↓
"You did [X] 14 times this week → here's how to automate it"
        ↓
One-click setup: AppleScript / Shortcut / Zapier / n8n recipe

What the User Sees

🔄 AutoReview found 3 new patterns this week:

1. Salesforce → Google Sheets copy-paste (14x/week, ~45 min)
   → Suggested: Zapier integration [Set up →]

2. Jira ticket → Slack message (23x/week, ~30 min)
   → Suggested: Jira-Slack automation [Set up →]

3. Daily report compilation from 3 tabs (5x/week, ~1 hour)
   → Suggested: n8n workflow [Set up →]

Estimated time savings: 2.25 hours/week

Target User

Screenpipe power user — already privacy-conscious, already bought into local-first, already tech-savvy enough to install a pipe. Not mass-market consumer. A power tool for the 17K+ Screenpipe community.

Persona: "Alex, senior PM at a SaaS company. Uses Screenpipe to search past meetings. Doesn't realize they spend 6 hours/week on copy-paste workflows between Jira, Slack, and Google Sheets."

Success Criteria

Ship → measure within 30 days:

1. Detection accuracy: 3+ real repetitive patterns per user per week
2. Suggestion quality: Actionable (user can actually set them up)
3. Retention: Users keep the pipe enabled after 2 weeks
4. Signal: Screenpipe Discord users talk about it / request features

Pricing

Start free/open source to validate demand and build distribution. Monetize in v2 when automation execution is added. Options later: freemium ($5/mo for suggestions), or one-time $29-49 (matches Screenpipe's model).

MVP Architecture

Two-component design optimized for Screenpipe's constraints.

Why Two Components

• Pipe system has a global semaphore (one pipe at a time) — can't do frequent polling
• Raw SQL queries are free and fast — no reason to burn LLM tokens on data aggregation
• Pipe runs infrequently with pre-digested data — fast execution, low token cost

Component 1: Pattern Detector (Python service)

Component 2: Automation Advisor (Screenpipe pipe)

Pattern Detection Logic (v1 — rule-based, no ML)

Automation Output Types

v1 does NOT execute automations. It suggests and links. Execution is v2.

Stack

Risks & Mitigations

Scope & Timeline

4 weeks to beta. ~$2-5K total cost.

In Scope (MVP)

• Pattern detection via SQL analytics (5 pattern types)
• Claude Haiku-powered automation suggestions
• Weekly report (Markdown)
• System notifications for new patterns
• macOS support (Screenpipe's primary platform)

Out of Scope (v2+)

• Automation execution (one-click deploy)
• Windows support
• Real-time detection via WebSocket
• Custom pattern definitions
• Team / shared pattern library
• Dashboard UI (beyond Markdown reports)
• Zapier API / n8n API integration

Timeline

Build Path

Compliance & Legal Risk

9 jurisdictions analyzed. Three architectural decisions neutralize most risk across all markets.

Risk Summary by Jurisdiction

Three Decisions That Neutralize Most Risk

Competitor Compliance Comparison

United States Compliance

Federal framework + California, Illinois, and New York deep dives.

Federal Framework

ECPA (18 U.S.C. §§ 2510-2522)

• Prohibits interception of communications without authorization
• Consent Exception: employees explicitly consent (signed agreement)
• Business Purpose Exception: monitoring for legitimate business reasons with notice
• Company-owned devices: employers can generally monitor all activity with notice
• Personal devices: employers CANNOT monitor personal communications
• Screen recording capturing email/chat content = interception. Metadata-only = lower risk.
• Penalties: Criminal up to $250K + 5 years. Civil: actual + punitive damages.

CFAA (18 U.S.C. § 1030)

• Personal use on own machine: no risk
• Enterprise on employer-owned: no risk if employer authorizes
• Installed without user knowledge: potential violation

FTC Act § 5

• Must accurately describe data collection in privacy policy
• Must not collect more than disclosed
• Must implement reasonable data security
• FTC aggressive on "AI washing" — don't overclaim

California High Risk

CCPA/CPRA

• Since Jan 2023: all consumer rights apply to employee data
• Screen recordings = personal information. With faces = sensitive PI (biometric)
• Must provide privacy notice at or before collection: categories, purposes, retention, sharing
• Employees can request access to and deletion of monitoring data
• 2025 amendments: expressly cover generative AI systems
• Penalties: $2,500/unintentional, $7,500/intentional violation. Private right of action for breaches.

California PC § 632 (Two-Party Consent)

Illinois High Risk

BIPA (740 ILCS 14)

• Covers "biometric identifiers" including facial geometry
• If screen recording captures faces (webcam, video calls) → potentially triggered
• Requires written informed consent BEFORE collection
• Published retention/destruction schedule required
• Private right of action — individuals can sue directly (no government needed)
• Penalties: $1,000/negligent, $5,000/intentional violation
• Metadata-only: does NOT trigger BIPA

New York Medium Risk

NY Civil Rights Law § 52-c

• All private employers in NY must provide prior written notice of electronic monitoring
• Written acknowledgment from employees required
• Notice must be posted in conspicuous place
• Penalties: $500 first, $1,000 second, $3,000 third+ offense

SHIELD Act

• Reasonable safeguards (admin, technical, physical) required for NY resident data
• Breach notification required
• Penalties: Up to $5,000/violation for safeguard failures

Latin America Compliance

Mexico, Chile, Brazil, Colombia — all modernizing data protection toward GDPR-level standards.

Mexico Medium Risk

Chile Medium (Rising)

Brazil High Risk

Colombia Medium Risk

European Union (GDPR)

The strictest regime. Continuous screen recording effectively illegal for employee monitoring.

Screen Recording Legality

Key GDPR Articles

Country-Specific Strictness

Real GDPR Fines for Employee Monitoring

Recommended Privacy Architecture

Designed for compliance across all 9 jurisdictions. Local-first, metadata-default, consent-aware.

Data Capture Tiers

Mandatory Defaults

• Local-first storage — all data on-device, no cloud transmission without explicit opt-in
• No audio capture — California PC 632 makes this impractical
• No keystroke logging — universally prohibited for general monitoring
• Face detection + blurring — kills Illinois BIPA exposure
• Communication app exclusion — exclude email, Slack, Teams, WhatsApp by default (ePrivacy compliance)
• Sensitive content filtering ON — password managers, banking, healthcare apps excluded
• Shortest retention by default — 7 days metadata, 24h screenshots

Consent Flows by Market

Retention Policies

Cloud LLM Integration (Cross-Border Transfer)

• Strip all personal identifiers before sending to LLM
• Send only abstracted patterns, never raw content or images
• Verify EU-US Data Privacy Framework certification of provider
• Execute DPA + Standard Contractual Clauses
• Conduct Transfer Impact Assessment
• Prefer EU-hosted endpoints where available
• Ensure provider does not retain/train on data

Enterprise vs Personal Use

Certification Roadmap

Design Gate: MVP Compliance

Compliance requirements specific to the Screenpipe plugin MVP. What we must build before shipping.

Risk by Jurisdiction

Data Boundaries

What Goes to Claude API

Only: App names + frequencies + durations. No raw text, no timestamps, no window titles, no clipboard, no audio.

{
  "patterns": [
    {
      "type": "app_switch_loop",
      "apps": ["Salesforce", "Google Sheets"],
      "frequency_per_week": 14,
      "avg_duration_seconds": 180,
      "confidence": 0.85
    }
  ]
}

Required Consent Flow

Build Checklist

1. Build our own consent/onboarding flow (Screenpipe provides none)
2. Text sanitization layer between Screenpipe data and Claude API
3. Anthropic DPA signed; verify data retention/training policies
4. Store patterns in our own DB with retention/deletion controls
5. Default to metadata-only — escalate to OCR text only when needed
6. No audio, no screenshots, no clipboard in MVP
7. Ship with privacy policy disclosing Claude API data flow

Design Gate: Architecture Plan

Two-process design: Pattern Detector (Python, $0) + Automation Advisor (pipe.md, Haiku).

System Diagram

Why Two Processes

• Global semaphore — Screenpipe only runs one pipe at a time. Can't poll every 15 min via pipe.
• /raw_sql is free — No reason to burn LLM tokens on data aggregation.
• Split — Pattern Detector (standalone Python, $0, polls freely) + Automation Advisor (pipe.md, runs every 4h, holds semaphore ~30 sec).

Component A: Pattern Detector

Component B: Automation Advisor

Inference Cost Model

Data Flow: Three-Stage Privacy Funnel

API Endpoints Used

AutoReview SQLite Schema

CREATE TABLE patterns (
    id              INTEGER PRIMARY KEY,
    pattern_type    TEXT NOT NULL,
    signature_hash  TEXT NOT NULL UNIQUE,
    apps            TEXT NOT NULL,        -- JSON array
    sequence        TEXT,
    frequency_week  REAL,
    avg_duration_s  REAL,
    confidence      REAL,                 -- 0.0-1.0
    first_seen      TEXT NOT NULL,
    last_seen       TEXT NOT NULL,
    status          TEXT DEFAULT 'active'
);

CREATE TABLE suggestions (
    id              INTEGER PRIMARY KEY,
    pattern_id      INTEGER REFERENCES patterns(id),
    suggestion_type TEXT NOT NULL,        -- zapier | applescript | shortcut | n8n
    difficulty      TEXT NOT NULL,        -- easy | medium | hard
    title           TEXT NOT NULL,
    description     TEXT NOT NULL,
    setup_url       TEXT,
    llm_model       TEXT NOT NULL,
    status          TEXT DEFAULT 'pending'
);

File Structure

~/.screenpipe/pipes/autoreview-advisor/
└── pipe.md                    # Automation Advisor

~/.autoreview/
├── patterns.db                # Our SQLite database
├── config.yaml                # User preferences
├── detector.py                # Pattern Detector daemon
├── reports/
│   ├── latest.md              # Most recent report
│   └── weekly_2026w10.md      # Archived reports
└── logs/
    └── detector.log

Key Decisions

1. Two-process vs single pipe: Global semaphore makes single-pipe unworkable for 15-min polling.
2. /raw_sql over /search: We need GROUP BY, window functions, time-range filtering.
3. Haiku over Sonnet: 3.7x cheaper. Structured task, quality sufficient.
4. No WebSocket in MVP: 15-min polling catches same patterns with slight delay.
5. Markdown over dashboard: Zero frontend deps. Validates core value first.

Design Gate: Scope & Wireframe

What the user sees, what we detect, and what's explicitly out of scope.

User Journey

Weekly Report (The "Dashboard")

V1 Pattern Detection

Suggestion Output Format

### Suggestion: Salesforce → Google Sheets sync

What you're doing manually:
You copied data from Salesforce and pasted it into Google Sheets
14 times this week. This took approximately 45 minutes.

How to automate it:
Zapier has a pre-built integration that syncs Salesforce records
to Google Sheets automatically.

Difficulty: EASY (no code, ~10 min setup)
Estimated time saved: 45 min/week = 39 hours/year

User Actions (per pattern)

1. Follow suggestion — click link or run generated script
2. Dismiss — add to config.yaml ignored list
3. Snooze — resurfaces after 2 weeks
4. Mark automated — enables progress tracking

All via config file edits or report links. No GUI in v1. Power-user-appropriate for Screenpipe audience.

What's NOT in V1

Mexico Compliance (LFPDPPP 2025)

Mexico's data protection law was fully replaced March 2025. Significantly easier than GDPR.

LFPDPPP 2025 vs. GDPR

Institutional Change: INAI → SABG

• INAI dissolved November 28, 2024 (constitutional reform)
• Replaced by SABG (Secretaría de Anticorrupción y Buen Gobierno) — part of the Executive Branch, not independent
• No public fines during 2024 (budget cuts, transition)
• Enforcement weakened short-term but trajectory is toward stricter compliance

Consent Requirements

Aviso de Privacidad Requirements (Art. 15-16)

• Identity and domicilio of the controller
• Categories of personal data collected
• Processing purposes (distinguish which require consent)
• ARCO rights mechanisms (Acceso, Rectificación, Cancelación, Oposición)
• How to limit use or disclosure
• Transfer details, breach notification, consent withdrawal

Cost: ~$500-1,000 USD for Mexican lawyer review.

Cross-Border Transfer to Claude API

• Mexico has no adequacy list, no SCCs, no formal assessment of US protection
• Consent is the primary (and only) transfer mechanism
• If data is dissociated: no consent needed, no restrictions at all
• Our design (app names + frequencies only) = strong dissociation argument
• Burden on controller to demonstrate dissociation is effective

Right to Disconnect (NOM-037)

What AutoReview Must Do for Mexico

1. Spanish-language Aviso de Privacidad (lawyer-reviewed)
2. Click-through consent at first run (non-sensitive data = sufficient)
3. Express consent for Claude API transfer
4. Designate DPO (mandatory for all controllers)
5. ARCO rights for AutoReview-generated data
6. Enterprise mode: auto-pause outside working hours

Mexico: Architecture Changes

Zero architecture changes. All Mexico work is localization + prompt engineering.

What Actually Changes

Mexican SaaS Ecosystem

Spanish Language Support

• Screenpipe OCR: Apple Vision supports Spanish natively. Full Unicode pipeline (UTF-8 throughout).
• Claude Haiku: 80%+ on multilingual MMLU for Spanish. Structured output quality is sufficient.
• System prompt: Responde en español mexicano. Usa 'tú'. Evita modismos de España.
• Vocab: computadora (not ordenador), celular (not móvil), aplicación (not programa)
• Labels: FÁCIL / MEDIO / DIFÍCIL, "veces esta semana", "Tiempo estimado ahorrado"

Platform Risk: macOS in Mexico

CONTPAQi and Aspel (Mexico's dominant accounting tools) are Windows-only. Windows support moves from v2 to v1.1 for Mexico market.

Infrastructure

• Mexican office internet (~90 Mbps median) — more than sufficient
• Claude API latency from Mexico: +50-150ms vs US — invisible for 4-hour background task
• Pattern Detector is 100% local — no internet needed
• Recommendation: add retry with exponential backoff on Haiku calls

Mexico: Build Plan

4-week plan with day-by-day Week 1. CTO needs ~5-6 hours/week.

What Changes from Base Plan

CTO Role vs. Claude Code

CTO Time Commitment

Week 1: Day by Day

Decisions Needed Before Coding

1. Mexico-first only, or bilingual? (Rec: Spanish only for v1)
2. Free for beta? (Rec: yes)
3. GitHub private or public? (Rec: private during beta)
4. Does CTO have 3-5 macOS users in Mexico for beta?
5. Who pays Anthropic API? (~$2/month)
6. Mexican lawyer contact for Aviso? (~$500-1K)

2-Week Stripped-Down Version

If you want to validate faster, cut to 10 days. You lose patterns 4-5, polished installer, lawyer-reviewed Aviso. You keep the core loop: detect → suggest in Spanish.

Day 1:  Screenpipe install + schema validation + scaffolding
Day 2:  App-switch + copy-paste detectors (highest value)
Day 3:  Daily ritual detector + daemon orchestrator
Day 4:  Integration test against live Screenpipe
Day 5:  pipe.md with Haiku (Mexican Spanish)
Day 6-7: Report template + notifications (Spanish)
Day 8:  Aviso de Privacidad draft + consent flow
Day 9:  Installer, launchd, README (Spanish)
Day 10: Clean install test. Ship to 2-3 testers.

Mexico: Risks & Distribution

What's easier, what's harder, and where to find users.

What's Easier (vs. US/EU)

1. Privacy law lighter than GDPR. No DPIA. No authority registration. Aviso is a document, not a system.
2. No state-level patchwork. One federal law covers all of Mexico (unlike US: CCPA + BIPA + NYC).
3. Smaller market = faster feedback. Know your first 10 users personally.
4. Zero competition in Spanish. Cofia, Autostep, Edra are all English-first, US-focused.
5. CTO network in Mexico = beta testers are a phone call away.

What's Harder

1. Screenpipe adoption in Mexico unknown. 17K stars are English-speaking. Could be 5-50 users in Mexico.
2. macOS market share lower (~12-15% vs ~28% in US).
3. Mexican SaaS tools less automation-friendly. CONTPAQi/Aspel are desktop Windows apps. No Zapier integrations.
4. Spanish quality is a trust signal. Bad machine Spanish = "this wasn't built for us."
5. Distribution is fragmented. No single Mexican HackerNews.

What Could Go Wrong

Minimum Viable Test

Distribution Channels

Cross-Platform Strategy

macOS is ~12-15% market share in Mexico. CONTPAQi/Aspel are Windows-only. What does Windows support take?

Screenpipe Windows Status (Current Issues)

Our Code Changes for Windows

Three Options

Screenpipe Dependency

How much risk are we taking by building on someone else's platform?

Pricing & Business Model

The core engine and API we depend on are MIT-licensed. Users don't need the $400 app — CLI runs for free.

Platform Risk Matrix

Community Health

Three Non-Negotiable Guardrails

Alternatives to Screenpipe

What else could we build on top of — or replace it with?

Comparison Matrix

Detailed Assessment

Python/Django Stack

Our CTO knows Python/Django. Does the architecture fit?

Architecture Fit

The pipe.md Decision

pipe.md is NOT Python — it's a Markdown file executed by Screenpipe's AI agent. Should we keep it?

Django vs Flask vs Nothing

Recommended File Structure (Pure Python, No pipe.md)

autoreview/
├── pyproject.toml
├── src/autoreview/
│   ├── main.py                 # Entry point — detector + scheduler
│   ├── config.py               # Paths, intervals, API key
│   ├── detector/
│   │   ├── runner.py           # Polls Screenpipe, orchestrates
│   │   ├── screenpipe.py       # HTTP adapter for localhost:3030
│   │   ├── algorithms/
│   │   │   ├── app_switch.py
│   │   │   ├── copy_paste.py
│   │   │   ├── daily_ritual.py
│   │   │   ├── navigation.py
│   │   │   └── form_fill.py
│   │   └── storage.py          # Write to patterns.db
│   ├── advisor/
│   │   ├── analyzer.py         # Read patterns, call Claude
│   │   └── prompts.py          # Prompt templates
│   ├── reporter/
│   │   ├── generator.py        # Jinja2 → Markdown + HTML
│   │   └── templates/
│   └── notifier.py             # Cross-platform notifications
├── tests/
└── scripts/
    └── install_launchd.py

Decision Matrix

Summary for CTO discussion. Four decisions, one big strategic fork.

Four Decisions

The Big Fork: Screenpipe Plugin vs Browser Extension

This is the real strategic question. Everything else is tactical.

Recommended Next Steps

1. CTO decides: Screenpipe plugin or browser extension?
2. If Screenpipe: Validate DB schema on live instance (blocking).
3. If extension: Prototype Chrome extension tab/form tracking (1-2 days).
4. Either way: Pure Python stack, no pipe.md, Flask for v1.1.

Sources

All claims sourced. Key references below.

Competitor Research

• Scribe $75M Series C — TechCrunch
• Mimica $26.2M Series B
• SKAN $40M Series B
• Simular $21.5M Series A — TechCrunch
• Sola AI — a16z
• Edra — 8VC portfolio
• Edra — Crunchbase
• Autostep — YC
• Autostep — PitchBook
• Cofia — YC
• Sequoia — "Services: The New Software"

Compliance Research

• CurrentWare — ECPA Compliance
• California Lawyers Association — Workplace Surveillance
• Illinois BIPA Text
• NY Senate — § 52-c
• ICLG — Mexico Data Protection 2025-2026
• FPF — Chile's New Data Protection Law
• WorkTime — Brazil Employee Monitoring Laws 2026
• EDPB Art. 29 WP Opinion 2/2017 (WP249) — Employee Monitoring
• CNIL — Employee Surveillance Guidance
• Barbulescu v. Romania (ECtHR 2017)
• H&M EUR 35.3M Fine — Hamburg DPA
• SKAN.ai — Security & Trust
• Scribe — Security
• Screenpipe — Privacy Policy

Technical Research

• Screenpipe — GitHub
• Screenpipe Architecture Docs
• Rewind.ai Teardown — Kevin Chen
• macapptree — MacPaw GitHub
• Workflow Mining — van der Aalst et al., IEEE TKDE 2004
• Claude API Pricing
• OpenAI API Pricing
• YC Request for Startups — AI agents