MacPeek RemoteMacPeek is private by design
MacPeek does not send process, port, display, network or other system information to MacPeek or any analytics service. MacPeek asks GitHub once a day whether a new release exists (you can turn that off), and a few checks you start yourself use the network. This page lists each one.
- No account. Nothing to sign in to.
- No telemetry or analytics in the app.
- No cloud service required or used: no update pings, no crash reporting.
- One background check, and it is optional. About once a day MacPeek asks GitHub whether a newer release exists (Settings → Check for updates automatically; it is on by default and can be switched off). It sends a normal web request, with no account and no information about your Mac beyond what any web request includes, and downloaded updates are verified with a signature before they are installed. Everything else is a check you start yourself: NetPeek pings your router and DNS servers, DNSPeek looks up a name you type, and UpdatePeek asks Apple's update servers about macOS updates and the npm registry about your global packages. Each runs only when you press the button.
- Local operation. Data is held in memory to draw the screen and is not written to disk. The only thing stored is your preferences (which utilities are on, refresh interval, toggles) in macOS user defaults.
- Open source. Verify it yourself.
What each utility reads
Utilities marked Coming soon are not in the current release; this is what they are planned to read, and the list will be re-checked against the code before it ships.
| Utility | Reads (locally) | Access needed |
|---|---|---|
| PortPeek | Listening sockets and the processes that own them, for your user account (via lsof) | None to view. You can terminate only processes your user owns. |
| DisplayPeek | Display properties from macOS (via system_profiler), only while DisplayPeek is open | None. |
| USBPeek | USB devices from the I/O registry (ioreg) and Thunderbolt port status (system_profiler), only while USBPeek is open | None. |
| NetPeek | Network configuration (route, scutil, networksetup) and Wi-Fi details (system_profiler) while NetPeek is open; pings to your router and DNS servers only when you press Run checks | None. macOS hides the Wi-Fi network name from apps without Location access, and MacPeek does not request it. |
| BatteryPeek (coming soon) | Battery and power-source information from macOS power services | None. |
| SleepPeek | Power-management assertions and settings (pmset); the sleep/wake log only when you ask for it | None. |
| MemoryPeek | System memory statistics and memory pressure (host_statistics64 and sysctl), only while MemoryPeek is open; memory in use once when the launcher opens; The memory footprint of processes your user can inspect (libproc), only while MemoryPeek is open | None. Other users’ processes, including some macOS services, are not listed. |
| CPUPeek | Per-core CPU load (host_processor_info), the load average and macOS’s thermal state, only while CPUPeek is open; two quick readings when the launcher opens; CPU time of processes your user can inspect (libproc), only while CPUPeek is open | None. Other users’ processes, including some macOS services, are not listed. |
| FileLockPeek | Open files of processes owned by your user (via lsof), only for the path you choose, only when you scan | None to scan. Other users’ processes are not listed, and you can terminate only processes your user owns. |
| ProcessPeek | The process list (ps); a process’s command line and listening ports only when you open it | None to inspect. Some details are unavailable for other users’ processes, and you can terminate only processes your user owns. |
| DiskPeek | Capacity and free space of local drives (the mount table and Foundation volume information), only while DiskPeek is open; the startup disk once when the launcher opens; Per-process disk I/O counters (libproc) for processes your user can inspect, only while DiskPeek is open | None. Other users’ processes are not shown. |
| EnvPeek | MacPeek’s own environment and, where macOS permits, the environment of one process whose PID you enter | None. Values are shown on screen only and never logged. |
| DNSPeek | The system resolver configuration (scutil --dns); DNS lookups only when you press Run lookup | None. |
| SoundPeek | Audio device properties from Core Audio (names, connection, formats, volume and mute); device changes while SoundPeek is open | None. SoundPeek never opens an audio stream, so macOS never asks for Microphone access. |
| UpdatePeek | The macOS version and build; macOS's own Software Update record; `softwareupdate --list` only when you press Check now, which asks Apple's update servers; `brew outdated` (read-only, no brew update) only when you press Check; `npm outdated -g` only when you press Check, which asks the npm registry; `npm install -g <package>@latest` only for the one package you press Update on and confirm | None. macOS and Homebrew updates are never installed from MacPeek, and npm is never run with elevated rights. |
The utilities that touch the network. NetPeek sends three pings to your router and to up to three of your DNS servers when you press Run checks. DNSPeek resolves the name you type, and asks each of your DNS servers for it, when you press Run lookup. Your DNS servers are often outside your home network (a public resolver or your ISP), so those requests do leave it. They carry no information about your Mac beyond what any lookup or ping contains, nothing is stored, and nothing runs when you do not ask.
UpdatePeek. When you open UpdatePeek it reads macOS's own Software Update record on your Mac, which makes no request. Three actions use the network, each only when you press its button. Check now runs softwareupdate --list, which asks Apple's update servers what is available for this Mac. Check under npm runs npm outdated -g, and npm asks its registry (npmjs.org unless your own npm settings say otherwise), which sees the names of your globally installed packages, as it does whenever you run that command yourself. Update on an npm package runs npm install -g for that one package, after you confirm, and downloads it from the registry. Check under Homebrew runs the read-only brew outdated command, without brew update and with Homebrew's analytics switched off, which makes no request. MacPeek makes no request of its own, never installs macOS or Homebrew updates, never runs npm with administrator rights (if npm lacks permission it only shows you a command to copy), and runs nothing when you do not ask.
MacPeek never asks for administrator rights and never bypasses macOS security controls.
MacPeek Remote
MacPeek Remote is a separate, paid console that is not released yet. Everything above stays true for MacPeek: the Macs you look after never sign in to anything. This section describes what the MacPeek Remote service will collect when it launches, and is a draft until then. The controller is [Legal business name], [Registered business address, India] ([support email]).
| What | Why | Kept |
|---|---|---|
| Your email address, the sign-in methods you add (passkeys, Apple, Google) and your name if Apple or Google share it | To sign you in and send sign-in codes and account emails | Until you delete your account |
| Signed-in devices and sessions, with their IP address and browser or app version | Security: showing you where you are signed in, ending sessions, limiting abuse | While the session lasts; at most 30 days after it ends |
| Workspace names, members and roles | To run your account and, later, teams | Until you delete them or your account |
| Each paired Mac's public key fingerprint, when it was last online, and how many Macs you have | To route connections to your Macs and to count them for your plan | Until the Mac is removed |
| Relay metadata: which Mac a console connects to, IP addresses, times and amounts of data | To run the relay and keep it from being abused | Up to 30 days |
| Your synced data: Mac names and settings, tags, groups, alert rules, preferences and up to 30 days of history | End-to-end encrypted on your devices before upload. We store it but cannot read it | Until you delete it or your account, and at most 90 days after a subscription ends |
| Your subscription: plan, number of Macs, status and Paddle's customer and subscription IDs | To give you what you paid for | As long as tax and accounting law requires |
What we never get. What your Macs send to your consoles (processes, ports, network, disk and the rest) travels end-to-end encrypted, through the relay or directly on your network, and cannot be read by us. The keys that unlock your synced data stay on your devices and in your passkeys.
Who else is involved. Paddle (paddle.com) is our reseller and Merchant of Record: it collects your payment details, billing address and tax information when you buy, underits own privacy policy, and tells us only what we list above. Cloudflare hosts the service and its database. Resend sends sign-in and account emails. Apple and Google are involved only if you choose to sign in with them. We do not sell personal data or use it for advertising, and the service has no analytics or tracking.
Your choices. You can see and change your account details in the console, export your data, and delete your account, which removes your data from our systems within 30 days (Paddle keeps purchase records as the law requires). To exercise any other right you have under data protection law, including in India, the EU, the UK and California, email [support email]. Data is processed in the countries where Cloudflare and our other providers operate, with the safeguards they offer for international transfers.
This website
The site is static and sets no cookies. The only thing it stores in your browser is your light/dark theme choice, locally.
Analytics and hosting. This website (not the MacPeek app, which has no analytics) runs no analytics scripts and sets no cookies. It is hosted on Cloudflare, which, like any web host, handles each request to deliver the page and may keep ordinary server logs and aggregate traffic statistics. No account or personal profile is involved.