Privacy Policy

Last updated: October 14, 2026

Tidy My Mac ("the app") is made by Yuix Networks Inc. ("we", "us"), which is the controller of the personal data described here. Your files stay on your Mac unless you leave deep malware analysis on, which sends files to us for analysis. This page describes exactly what the app reads, what it sends and to whom, and what it never touches.

The short version

• Deep malware analysis sends your files to us. By default the app sends files from your home folder, including documents and photos, to our servers for AI malware analysis after a Smart Scan. You can turn it off at any time in Settings › Malware Analysis, which stops sending before the next file. See section 8.
• Apart from that, your files, their contents, and the results of every scan stay on your Mac. Junk detection, large-file scanning, startup-item analysis, background-service enumeration, performance monitoring, and antivirus scanning all run locally on your device. Scam detection runs locally too, except on Macs where Apple Intelligence is off, or when you choose Enhanced Check: then the message you paste is sent to us for analysis, as described below.
• There is no user account, no sign-in, no telemetry, no analytics, and no crash reporting in the app.
• To keep the antivirus and your apps up to date, and to download Web Protection's list of blocked sites while it is on, the app sends a small amount of technical data to our servers and to the servers of the providers listed below. Each request, what it contains, and how long it is kept is described in Data sent to our servers and our providers.
• To start the free trial you give us your email address on this site, and we email you the download link. We use it for your trial and subscription only, as described in Your email address and the free trial.
• We do not sell this data, use it for advertising, build profiles from it, or combine it with anything else about you.

Not sandboxed: the Full Disk Access prompt

Tidy My Mac is a normal, unsandboxed macOS application. On first launch macOS asks you to grant it Full Disk Access, and the app cannot enumerate or measure the whole disk without that grant.

Concretely, the app reads file names, sizes, locations, and modification dates across the disk so that Large Files, Junk Cleaner, Startup Items, and Background Services can report on things outside your own home folder. Full Disk Access also lets the app read the system configuration used to describe installed background services and login items.

You can revoke the grant at any time in System Settings → Privacy & Security → Full Disk Access. Revoking it does not stop the app from running; it limits how much of the disk it can enumerate. Nothing the app reads with this grant is transmitted, except the files deep malware analysis sends while it is on (section 8).

What the app reads

• Files. File names, sizes, paths, and modification dates, to find large files and junk.
• File contents during antivirus scans. When you run an Antivirus scan, ClamAV reads the bytes of the files being scanned in order to match them against malware signatures. That matching happens on your Mac.
• The unified system log. The app reads the local system log to build its sudo-activity panel, which shows recent sudo invocations recorded by macOS. This is a read of a log already present on your machine.
• Process, CPU, and memory information. The Performance module reads current process statistics to show what is loading your machine.
• Login items, launch agents, and background services. Read from the places macOS itself stores them, to list what starts at boot or keeps running in the background.
• Privacy permissions. The Permissions module reads the list of privacy permissions (Full Disk Access, camera, microphone, screen recording, and similar) granted to your applications, so you can review them.
• Installed apps. The Uninstaller and Updates sections read the name, bundle identifier, version, and update-feed address of the apps in your Applications folders.

None of the above (file names, scan results, logs, or the list of your apps) is uploaded, except the minimum the Updates section needs to look up newer versions. File contents are uploaded only by deep malware analysis, while it is on. Both are described next.

Data sent to our servers and our providers

The app connects to the internet for the eight purposes below only: keeping your Mac up to date and secure, checking your trial or subscription, and, while you leave it on, deep malware analysis. Every connection is encrypted (HTTPS) and sets no cookies. Only the subscription check (section 7) carries an identifier for your Mac; the others carry no account, device, or user identifier.

1. Keeping Tidy My Mac up to date: our server

• Where: https://tidymymac.com/update/appcast.xml, operated by us.
• When: automatically about once a day, and whenever you choose Check for Updates….
• What is sent: your IP address and the request's standard headers, including the app's name and version.
• What comes back: a signed list of releases. A new build is downloaded only from that list and is signature-verified before it is installed.
• Retention: our web server logs the IP address, time, requested address, and user agent of each request, for security and to keep the service running. These logs are deleted after 10 days.

2. Keeping the antivirus up to date: ClamAV's update servers

• Where: https://database.clamav.net, the public update service of the open-source ClamAV project (operated by Cisco Talos).
• When: before a scan when the last check is more than 12 hours old, when you choose Update Virus Database, and once a day while the app runs if scheduled updates are on.
• What is sent: your IP address, a user agent stating the ClamAV engine version and that it runs on macOS, and the date of the copy already on your Mac, so that unchanged files are not downloaded again.
• What is never sent: no file from your Mac and no scan result. Signature databases are downloads only.
• Requests to this service are subject to its operator's own privacy practices.

3. Keeping your apps up to date

The Updates section checks your apps for updates when you press Check for Updates, when you run a Smart Scan, and, if you turn it on under Settings › Scheduled Scans, once a week (off by default). Each check makes the following requests:

• Apps that publish an update feed (most apps that update themselves): the app fetches the feed address that the installed app itself declares, from that app's developer. It is the same request the app's own updater already makes. The developer receives your IP address and a user agent naming Tidy My Mac and its version, and so can tell that one of its apps is installed.
• Mac App Store apps: their bundle identifiers (for example com.example.app) and your region code are sent to Apple's public App Store lookup service at itunes.apple.com, which answers with the current version. These requests are subject to Apple's privacy policy.
• Apps installed with Homebrew: answered from Homebrew's catalog already on your Mac; the check itself sends nothing. If you press Update on one, the app runs Homebrew's own brew upgrade, which connects to Homebrew's servers as it always does.

The list of your apps is never sent to us. App updates are never downloaded or installed by Tidy My Mac itself: it opens the App Store, the app, or Homebrew, which install the update as they normally would.

4. Spotting apps with known security holes: our server

• Where: https://tidymymac.com/security/vulnerable-apps.json, operated by us.
• When: at most once a day, when the app checks your security settings or your apps' updates.
• What is sent: your IP address and the request's standard headers, including the app's name and version. Nothing about your apps.
• What comes back: a signed list of apps with published security fixes and the versions that fix them, compiled from each developer's own security advisories. Your Mac compares it with the apps you have installed; the result never leaves your Mac.
• Retention: the same 10-day web server logs as above.

5. Checking a message for scams: our server and MiniMax

• Where: https://tidymymac.com/api/scam-check/, operated by us, which passes the message to MiniMax's language-model API (api.minimax.io) for analysis.
• When: only when you click Analyze in the Scam Detector on a Mac where Apple Intelligence is off or unavailable, or when you click Enhanced Check. With Apple Intelligence on, Analyze runs entirely on your Mac and nothing is sent.
• What is sent: the text you pasted, your IP address, and a random identifier the app creates once per installation. The identifier is not linked to you, your Mac's hardware or any account; it only lets us limit how many checks each installation can run.
• What is never sent: anything you did not paste into the Scam Detector.
• Retention: we do not store or log the message. For each check we keep your IP address, the installation identifier and the time for at most two days, to enforce usage limits. MiniMax processes the message to produce the analysis; it is subject to MiniMax's own privacy practices.

6. Blocking ad, tracker, scam and malware sites: our server

• Where: https://tidymymac.com/security/blocklists/, operated by us.
• When: only while Web Protection is on, and only for the categories you turned on: once when a category is first turned on, then daily or weekly as set under Settings › Scheduled Scans (daily unless you change it), and when you choose Update Lists Now.
• What is sent: your IP address, a user agent naming Tidy My Mac and its version, and a tag identifying the copy already on your Mac, so that an unchanged list is not downloaded again.
• What comes back: a signed list of blocked sites per category. Your Mac checks the signature before using it.
• What is never sent: the sites you visit or anything else about your Mac. The lists are downloads only.
• Retention: the same 10-day web server logs as above.

7. Your trial and subscription: our server

• Where: https://www.tidymymac.com/api/license/, operated by us.
• When: when the app starts, every few hours while it runs, and when you switch back to it.
• What is sent: a device identifier, the app's version, your Mac's name (as set in System Settings › General › Sharing, for example "Alex's MacBook Pro"), your IP address and the request's standard headers. The device identifier is a one-way hash of your Mac's hardware identifier, so it stays the same when you reinstall the app (one free trial per Mac) but does not reveal the hardware identifier itself.
• What comes back: a signed answer saying whether this Mac is in its free trial or has a subscription, and until when. The app keeps it, so it also works offline.
• What we keep: the device identifier, the Mac's name (shown in your account so you can tell which Mac your subscription unlocks), when we first saw it (the start of your trial), when we last saw it and the app version. If you subscribe, it is linked to your subscription so that the subscription unlocks this Mac.

8. Deep malware analysis: our server

• Where: https://www.tidymymac.com, operated by us. The suspicious files are stored in our own storage.
• When: only while Send files for deep malware analysis is on. That is the deep malware scan setting in Settings › Malware Analysis: it is on by default, and turning it off there stops sending before the next file. While it is on, files are sent after a Smart Scan, only while your Mac is on power, and each file only once.
• What we do with it: we analyze the files, including with AI models, to find malware that signatures do not catch yet, and use what we find to improve the app's protection.
• What we keep: the file contents, stored under a hash of their bytes, for as long as we need them for malware research. Your IP address is kept for two days to limit how much one connection can send. To have files you sent deleted, write to us at the address at the end of this page.

There is no other network traffic. In particular there are no analytics or crash-reporting endpoints: when something goes wrong, it is not reported anywhere, and the details stay on your Mac.

Scam Detector

The Scam Detector inspects message text for phishing and scam patterns and tells you what it found. With Apple Intelligence on, Analyze is local to your device and no message content is transmitted. With it off, or when you choose Enhanced Check, the message you paste is checked by our server as described in section 5 above; the app's own rule-based checks still run on your Mac either way.

Web Protection

Web Protection blocks ad, tracker, scam and malware sites by checking each DNS lookup on your Mac against the lists described in section 6 above. A lookup for a listed site is answered on your Mac with "not found"; every other lookup goes, unchanged, to the DNS server your network already uses, exactly as it would without Web Protection. The sites you visit are never sent to us or to anyone else. The list of recently blocked sites the app shows is kept in memory on your Mac only and is cleared when it restarts.

Antivirus scanning

Tidy My Mac uses the open-source ClamAV engine. Scans run locally against signature databases held on your Mac and refreshed as described above. Scanning itself never uploads a file; files are sent only by deep malware analysis while it is on (section 8). No security tool can detect every threat, so keep macOS itself up to date as well.

Your email address and the free trial

• What we collect: the email address you enter on tidymymac.com/trial/, when you asked, whether and when you opened the download link, and how many times it was opened.
• What we use it for: sending you the download link and, later, messages about your trial and your subscription. We don't send newsletters or marketing, and we don't share the address with anyone except the email provider that delivers our mail (Zoho Mail).
• Your account: opening the download link also makes the address a site account (see Your account), so you can sign in later to download the app again or manage a subscription. The link works for 24 hours and also signs you in.
• Sending limits: to stop the form being used to flood someone's inbox, for each link we send we keep the address, your IP address and the time for at most two days.
• Retention: we keep your address while your trial or subscription is relevant. Email info@tidymymac.com from that address to have it deleted.
• The trial address is never linked to anything the app does on your Mac. (A subscription's address is linked to the Mac it unlocks; see Payments.)

Website visit statistics

This website (not the app) counts visits with Umami, a privacy-focused analytics tool that we host ourselves. It records the page visited, the referring site, and the browser, operating system, device type and country derived from the request, plus clicks on the free-trial buttons and reaching the trial's confirmation and download pages, each with the page the visit started on (remembered only in that browser tab). It sets no cookies, stores no IP addresses, and does not track you across sites. The data is not shared with anyone.

Payments

The 7-day trial asks for no payment details. Subscriptions are bought on this site, not in the app: our order process is run by our online reseller Paddle.com, which is the merchant of record for every order. You enter your payment details on Paddle's checkout, and they are never seen or stored by us or by the app. Paddle handles the payment, sales tax and VAT, receipts, refunds and payment support under its own privacy policy, and you can also manage the subscription in Paddle's customer portal. To manage your subscription we keep the email address you subscribed with, the subscription's status and dates, Paddle's identifiers for you and the subscription, and which Mac it unlocks (the device identifier in section 7 above). See also Your account below.

Your account

• How you sign in: with no password. Either we email you a sign-in link, or you continue with Google. With Google, Google tells us your email address and a Google account identifier; we don't receive your password, name, contacts or anything else, and Google's own privacy policy applies to that sign-in.
• What we keep: your email address, when you first and last signed in, and, if you used Google, the Google account identifier, so the next Google sign-in finds the same account. Each emailed link is counted against the same sending limits as the trial form (address, IP address and time, kept two days).
• What it's for: showing you your subscription, letting you cancel it or move it to another Mac, and the download. A browser cookie keeps you signed in for up to 12 hours; it is set only after you sign in.
• Deleting it: email info@tidymymac.com from that address.

Children's privacy

Tidy My Mac is a general-audience utility. It does not knowingly collect personal information from children. The app sends only the technical data described above and the files deep malware analysis sends while it is on, and the website collects only the email address you give it for the trial and the anonymous visit statistics described above.

Changes to this policy

If this policy ever changes, we'll update the date at the top of this page and, for material changes, note them in the app's release notes.

Contact

Yuix Networks Inc. is responsible for your personal data under this policy. Questions about it, or requests to see, correct or delete your data (your email address, account, subscription record or the server logs described above), can be sent to our privacy contact at info@tidymymac.com.