Your files go to the Trash, never straight to deletion
Every cleanup, uninstall and Move to Trash in Peekaboo moves items to the macOS Trash. The app never erases a file itself. Each move is recorded on the Activity page (⇧⌘Y), where you can put it back while the Trash still holds it; ⌥⌘Z puts back the last cleanup. Items only an administrator may move go to the Trash too, after one password prompt.
A few things can’t go to the Trash at all: Xcode simulators and runtimes, apps installed with Homebrew, tools from package managers like npm, older local Time Machine snapshots. Removing those is permanent, so it is off until you turn on Allow permanent removal in Settings › Cleanup. The check sits in front of the removal itself, not only the button. Even with it on, every removal asks you first and says it can’t be undone, and each one is written to the Activity page with what was run and whether it succeeded.
Files that live only in iCloud are never downloaded to be scanned.
Processing stays on your Mac
Peekaboo builds its library from the Spotlight index that macOS already keeps. Text in screenshots, photos and PDFs is read with Apple’s Vision framework, duplicates are matched by SHA-256 fingerprints and look-alike photos by Vision, all on your Mac. The Assistant uses Apple’s on-device model (Apple Intelligence, macOS 26 or later), so its questions don’t leave the Mac either.
No file, file name, path, search, thumbnail or recognised text is ever sent anywhere. The full list of what stays on the Mac is in the privacy policy.
Secret files are never previewed or read
Files that usually hold keys, tokens or passwords are shown with a lock and only their metadata. Peekaboo makes no thumbnail or Quick Look preview of them, never reads their text, and never hands them, or anything in your Library folder, to a Shortcut. That covers:
- Everything in your SSH and GPG key folders (public keys excepted) and the AWS credentials folder
- Environment files (.env and its variants; .env.example templates excepted)
- Credential files such as .netrc, .npmrc, .pypirc, .git-credentials, credentials.json and token files
- Certificates and key stores: .pem, .key, .p12, .pfx, .p8, .jks, .keystore
- Password databases and keychains: .kdbx, .keychain, .keychain-db
- Infrastructure secrets: Terraform state and variable files, VPN profiles, Kubernetes and Docker configs
The list errs on the side of caution: a file that only looks like a secret is treated as one.
What goes over the network
These are all the requests the app makes. None carries your files. What each one sends, word for word, and how to stop it is in the privacy policy.
Update check
A plain request for the list of releases, naming the app and its version. No install ID and no system profile.
At launch and about once a day, and whenever you choose Check for Updates…. An update is checked against our signature before it installs.
License settings
Nothing about you or your Mac: it fetches a signed file with the trial length, products and prices.
At launch and every 6 hours.
License activation and checks
Your license key, and a name for this Mac made of its model (like “Mac15,3”) and a short code derived from its hardware. Never your Mac’s name. A check sends the key and the activation’s ID.
When you activate, every 6 hours while a license is active, and when you choose Deactivate This Mac. Never during the trial.
Move to This Mac
Your license key and the same short hardware code. The purchase email gets a notice that the license moved, in case it wasn’t you.
Only when you click Move to This Mac.
Anonymous usage counts
A random install ID (not derived from your hardware); app, build and macOS versions; Mac model, language and region setting; library size in bands (like “10–100 GB”); whether Full Disk Access is on; look, layout and menu bar choices; trial or licensed; Low Power Mode and heat level; how many cleanup rules, pinned folders and saved searches you have; the app’s memory use; which optional settings are on; fixed feature names with how often each was used; onboarding and license steps; and a star rating, if you give one.
Once a day, plus an onboarding or license step when it happens.
Problem reports and feedback
Your message, a reply address if you give one, app and macOS versions, Mac model and language (Send Feedback lets you leave those out), any feature the app switched off after a crash, and the crash report if you leave it attached, with your home folder’s path taken out.
Only when you press Send in Report a Problem or Send Feedback. If sending fails, the app offers an email instead.
Settings sync
Your Peekaboo preferences, including saved searches. No files.
Only after you turn it on, on each Mac.
Anonymous usage counts are on by default and stop completely with one switch in Settings › General. Requests that carry your license key or a message you wrote use a private connection with no cookies, no saved credentials and no cache on disk. Problem reports leave the Mac only when you press Send, and your home folder’s path is taken out of any crash report first.
Your license key
The license key is kept in the macOS Keychain, not in a preferences file other apps can read. It is sent only to activate or check the license with Dodo Payments, the store that sells it, and when you choose Move to This Mac. You don’t need an account.
Permissions
Peekaboo is sold outside the Mac App Store and isn’t sandboxed: a file browser has to see your whole home folder and move items to the Trash and back, which the App Sandbox allows only for folders you pick one at a time. macOS still asks you before it may open Desktop, Documents, Downloads, network and removable volumes, or (for photo search) your Photos library, which it only reads. Full Disk Access is optional: without it, Peekaboo works with the folders you allowed; with it, the library includes every folder. You can withdraw any of these in System Settings › Privacy & Security. See Full Disk Access, explained.
Signed builds and signed updates
- Every build is signed with the developer’s Apple Developer ID, built with the hardened runtime, and notarized by Apple, with the notarization ticket stapled to both the app and the disk image.
- Updates come through Sparkle. Each update is signed with an EdDSA (Ed25519) key held by the developer; the app carries the matching public key and refuses an update whose signature doesn’t match.
- Each release on GitHub also publishes a SHA-256 checksum next to the disk image, so you can check a download byte for byte: shasum -a 256 -c Peekaboo-*.dmg.sha256 prints “OK”.
Reporting a vulnerability or a safety problem
If Peekaboo ever moved, offered or touched something it shouldn’t have, or you found a security problem, please tell us privately first. Email support@getpeekaboo.app with “Security” or “Safety” in the subject, and include:
- What Peekaboo offered or did, and the paths involved (you can redact your user name).
- Your Peekaboo version (Settings › About) and macOS version.
- Whether the item is still in the Trash, and whether the Activity page lists it.
You’ll get a reply within three working days. Please don’t open a public issue for a security problem until a fix has shipped. Every confirmed safety problem is written up internally (what happened, who was affected, what changed) and gets a test so it can’t come back.