DATA CONSULTING SERVICES

QuickCast 1.7: Send Images, Sign Your Webhooks, and Full Android Parity

by Data Consulting Services
iOSAndroidWebhooksPrivacySecuritySelf-Hosting

QuickCast started as a one-button voice recorder that ships audio straight to infrastructure you control. Version 1.7 keeps that promise and widens it: you can now send images and text the same way you send audio, prove to your server that a request really came from your device, and audit every delivery attempt after the fact. And for the first time, the iOS and Android apps are feature-for-feature identical — including a backup format that moves your whole setup between platforms.

Here’s what’s new, and — in QuickCast tradition — exactly how it behaves on the wire.

Send images (with the privacy work done for you)

The capture bar now has three modes: Audio, Text, and Image. Pick up to 10 photos and they go to your webhooks the same way audio does — as a multipart/form-data POST, one request per photo per webhook, under the field name you configure.

Two details matter more than the feature itself:

  • EXIF location is stripped, always. Photos are downscaled and re-encoded on-device before upload, which drops all embedded metadata — including the GPS coordinates your camera quietly wrote into the file. Your endpoint gets pixels, not your home address. (If you want location attached, that’s a separate, explicit, per-webhook opt-in — see metadata below.)
  • The upload animation is honest. While a photo sends, a scan effect (grayscale-to-color or frost sweep — your pick in Settings) reveals the image in step with the actual delivery state. It completes when the server responds, not on a timer. If the send fails, the reveal doesn’t finish. No theater.

Review before send

By default QuickCast still does what it always did: capture, then deliver immediately. But if you flip on Review Before Send, every new capture — audio, text, or image — is held in History instead. It sits there, marked Held, with the webhooks it was aimed at snapshotted at capture time, until you tap Send Now.

This is for the moments where speed isn’t the point: client notes you want to hear once before they land in a shared channel, photos you want to double-check, dictation you might redo. Nothing leaves the device until you say so — which has always been the guarantee; now there’s a workflow for it.

Signed requests: proof it came from you

If your webhook endpoint is reachable from the internet, anyone who discovers the URL can POST to it. From 1.7, QuickCast can close that hole: set an optional signing secret on a webhook, and every request to it carries two extra headers:

X-QuickCast-Signature: sha256=<hex HMAC-SHA256 over "timestamp.body">
X-QuickCast-Timestamp: <unix seconds>

Your server recomputes the HMAC with the shared secret and rejects anything that doesn’t match (or is too old — the timestamp lets you refuse replays). Verification is a few lines in any language; here’s Python:

import hmac, hashlib

def verify(secret: str, timestamp: str, body: bytes, signature: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), timestamp.encode() + b"." + body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

The secret never leaves your device except as a signature, and the scheme is identical on iOS and Android — one verifier covers both.

A delivery log you can actually audit

Every send attempt is now recorded per recording, per webhook: queued, held, attempt started, delivered with HTTP status, or failed with the error. Open any item in History and read the timeline; export the whole log as CSV from Settings if you want it in a spreadsheet or piped into your own tooling.

If you self-host your automation, you know why this matters: when a flow doesn’t fire, the question is always “did the phone send it, or did my server drop it?” Now the phone answers.

Opt-in metadata — off by default, per webhook

Some automations genuinely want context: which network the capture came from, battery level, or where it happened. QuickCast 1.7 can attach a small JSON object with network type, battery level/state, and/or location to uploads.

The defaults are the point:

  • Every field is off by default, and configured per webhook — your home automation endpoint can get location while your work endpoint gets nothing.
  • Location asks for the system permission only when you enable it, and a capture never waits on GPS: if no fix arrives in time, the field is simply omitted.
  • The metadata goes only to that webhook, inside the same request. It is never sent to us — there is still no QuickCast backend.

Your setup is now portable — across platforms

Settings and webhook configurations can be exported to a JSON file and imported on another device. When exporting webhooks you choose explicitly whether secrets (headers, signing secrets) are included, and the app warns you when they are.

The part we’re most pleased with: the backup format is identical on iOS and Android. Export on your iPhone, import on a Pixel, and your webhooks, field names, retry policies, and signing configuration come along. Combined with the shared signing scheme and identical metadata payloads, the two apps are now interchangeable front-ends to the same infrastructure.

Quality-of-life, quickly

  • Text is first-class. Text sends now appear in History with their content visible, support multiple webhooks with per-target tracking, and work with Review Before Send.
  • Capture profiles. Save your audio settings and webhook selection as a named preset and switch with one tap — “meeting notes to n8n” and “quick memos to Slack” become one gesture each.
  • Audio cleanup. Optionally trim leading/trailing silence and normalize volume before upload (WAV recordings).
  • Encryption at rest. Recordings are unreadable while your device is locked — iOS Data Protection on iPhone, file-based encryption on Android.

Android grows up

QuickCast for Android launched as a capable port; 1.7 makes it an equal. Everything above — images with EXIF stripping, review-before-send, HMAC signing, the delivery log, opt-in metadata, cross-platform backup, capture profiles, audio cleanup — ships on both platforms simultaneously, with the same wire formats throughout.

The 1.7 update is rolling out on the App Store and Google Play now. As always: no account, no cloud middleman, no tracking — your captures go only to the webhooks you configure. If you’re evaluating what that means in practice, the privacy deep-dive has the byte-level details, updated for 1.7.