Counts vs. content: why the distinction decides your exposure

Is capturing keystroke content legal?

Not always. Capturing content can trigger wiretap statutes, heightened, content-specific consent requirements, and rules around data never meant to be collected, like a password or health disclosure. Counting avoids the content-specific triggers, not consent obligations generally.

Requirements vary by location. This is not legal advice. See the notice and consent checklist.

Why do antivirus tools flag keyloggers?

Because capturing typed content uses hooks, the same technique credential-stealing malware uses, so antivirus flags it. Counting input events skips key identity and avoids that pattern, the difference between deploying cleanly and needing an allowlist exception from every antivirus vendor.

What do you lose without content capture?

Very little. Monitoring questions are almost entirely about time and attention, not content.

Only the last row needs content, turning an operations tool into an investigation for counsel and HR.

Will employees accept keystroke monitoring?

More easily when the boundary is verifiable: counted input, no recorded content, visible in Task Manager, is a line you can put in writing. See how SnitchOS activity monitoring works.

What are the limits of counting instead of recording?

Counting isn't the same as privacy-safe: screenshots, window titles, and addresses can still reveal a lot. Cadence is set per tenant (30–3600 seconds); retention is fixed by the platform. See screenshot monitoring without creating a liability.