Privacy

Readings, scans, sizes, paths and the items you pick stay on your Mac. The app has no account and collects no analytics.

It goes online to check for updates and, in a build that sells a license, for the license requests below. It reads the update feed on tinysift.app and, when you install an update, downloads it from GitHub. It sends no system profile; like any web request, these requests show your IP address and the app’s version to the servers that answer them.

Full Disk Access lets scans read protected folders, and Finder Automation lets the app move items to the Trash through Finder. What either one reveals stays on your Mac.

Report a Problem in the Help menu and Send Feedback in the sidebar open a new issue on GitHub in your browser. The app fills in its version, your Mac’s model, chip, macOS version, memory and startup disk size and free space, whether Full Disk Access and Finder Automation are allowed, and your plan; never a path, file name or app name. GitHub receives these details when the page opens, under its privacy statement, and the issue becomes public only if you submit it.

To list agent sessions, TinySift reads which Claude Code and Codex processes run on your Mac, their CPU and memory, and the folder each one runs in. It opens no file in that folder.

For Codex’s limits, it reads the end of the newest session log in ~/.codex/sessions and decodes only the line that holds them. Conversation lines are skipped, never decoded or kept.

For Claude Code’s limits, it changes nothing until you click Show Claude limits. It then adds a small step to the status line command in ~/.claude/settings.json and keeps a copy of that file as it was. The step saves four numbers in TinySift’s own folder, the 5-hour and weekly use and when each resets, and runs your own status line after it. Turn off restores your status line and deletes the saved numbers.

None of this leaves your Mac.

The 14-day trial is counted on your Mac, in its Keychain, and nothing about it is sent. A build that sells a license identifies your Mac to tinysift.app by a Mac ID: a salted SHA-256 hash of the hardware UUID, which cannot be turned back into the UUID.

Without a license key, the app sends the Mac ID to tinysift.app when it opens and receives a signed answer naming its plan. The site writes nothing for that request.

When you enter a license key, the app sends the key and the Mac ID to tinysift.app, and then the key, the Mac ID and the activation ID it receives, when the app opens and then at most once a day while it stays open. The site passes the key and the Mac ID to Polar, which keeps the Mac ID as the label of that activation, and signs the answer for your Mac. Polar’s reply includes the buyer’s email, name and country; the site neither stores nor logs it, and the app never receives it. The app sends no path, size, scan result or use count.

Polar is the merchant of record. Buying opens Polar’s checkout in your browser, where Polar takes the payment and keeps the order records under its privacy policy. They are visible to us in Polar’s dashboard.

tinysift.app counts visits with Vercel Web Analytics, which sets no cookies and stores no IP address. Each page view records the page (with any ?ref= tag in its address), the site that linked to it, an approximate location (country, region and city), and the browser, operating system and device type. A visit is recognised by a hash of the request that Vercel discards after 24 hours.

Vercel hosts the site and processes each request to serve it, as its privacy policy describes. The site has no accounts, forms or newsletter.

The Download button links to the release on GitHub, so GitHub’s privacy statement covers the download itself.

When this page changes, the date at the top changes with it. Ask about it in the issue tracker on GitHub.