What leaves your Mac

Every connection, and why

What	Where	What is sent
Malware fingerprints When you run a malware scan or update definitions.	bazaar.abuse.ch	Nothing about you. MacTidy downloads a public list of known malware fingerprints, around 40 MB, and compares your files against it on your own machine. Your files are not uploaded to be scanned.
Licence check On activation, and periodically while subscribed.	api.lemonsqueezy.com	Your licence key and a device name, so the subscription can be tied to a machine. No file names, no scan results, no contents.
MacTidy app updates About once a day when automatic update checks are on, or when you check manually.	mactidy.app/appcast.xml	Sparkle checks the signed update feed and may download a signed update only after the update flow asks. The web server sees a normal request for the feed; no cleanup results, malware scan results or file contents are sent.
Homebrew installer Only if you ask MacTidy to install Homebrew.	raw.githubusercontent.com	Nothing. It fetches Homebrew's official install script, the same one Homebrew's own site tells you to run, and opens it in Terminal so you can see it work.
The AI features Only if you enable AI and configure a model endpoint.	Configurable endpoint	MacTidy sends the text needed for the assistant request to the endpoint you choose. Cleanup advice can include item names, paths, sizes, labels and safety guesses. Privacy analysis can include permission summaries. This stays on your Mac only when the endpoint is on your Mac; a LAN or remote endpoint receives that context. There is no MacTidy cloud model behind it.

Links that open in your browser

These are not connections MacTidy makes. They are links it can hand to your browser when you click something, and your browser behaves normally.

• VirusTotal. On a flagged file you can press "Look up on VirusTotal". That opens a page whose address contains the file's fingerprint. The fingerprint is a hash, not the file, but it does reach VirusTotal, and only because you clicked.
• Checkout and subscription management, which open our payment provider's pages.
• Apple support pages and settings panes, when a step points you at one.

What there is none of

• No analytics or product telemetry. There is no third party SDK in the app for it.
• No crash reporting service.
• No account. You do not create one, and there is nothing to log in to.
• No advertising identifiers, no fingerprinting, no tracking pixels in the app.
• No uploading of files for cleanup or malware scanning. Optional AI may send selected paths, summaries or excerpts to the endpoint you configure.

Being precise about one thing

Some tools say "everything is 100% local" and then quietly open a socket. We would rather be exact. MacTidy does use the network for the things in the table. Cleanup, storage analysis and malware comparisons stay local. Optional AI is different: it sends the submitted context to the endpoint you configure, and a custom remote endpoint means that context leaves the Mac.

Checking for yourself

You do not have to take our word for it. Point Little Snitch, LuLu or any outbound firewall at MacTidy and watch. If you see a connection that is not on the list above, tell us and we will either explain it or remove it.

The Safest security level inside MacTidy walks you through installing an outbound firewall. If you enable one, it can monitor MacTidy too. That is the correct outcome.

Privacy and permissions FAQ