Home › Safety and transparency
Is Tidymint safe? Here is the evidence, and how you can check it yourself
Mac cleaners can read your whole disk, so you have the right, and the need, to understand exactly what they do and how they work. This page gathers everything Tidymint has done, is doing and will keep doing so you can use it with peace of mind: 5 promises with a way to check each one, who has checked Tidymint (on VirusTotal, 65 antivirus engines scanned it and none found a problem), and the steps every new update goes through. You don't need to be technical: Tidymint explains and walks you through each part.
Tidymint's 5 promises, and how to check them
Don't just listen to what we say. Look at what we do.
| Promise | How Tidymint does it | How you can check |
|---|---|---|
| A wrong clean can be undone | Nothing is deleted outright: everything only goes to the macOS Trash. The Undo button puts the most recent clean back where it was (unless you've already deleted it from the Trash, of course). Before emptying the Trash, Tidymint always asks you to confirm. | Clean one small item, then look in the Trash in Finder. Press Undo: everything goes back. |
| Your private data is off limits | Your Photos library, Mail, passwords (Keychain), iCloud Drive and cloud folders are never offered for cleaning. In Clean by App, messages and logins are locked: Tidymint never reads or touches them. | The list of protected folders is public in the source code (neverBase). Locked items show a lock icon in the app. |
| No data leaves your Mac | Scanning and cleaning run on your Mac and work offline. Tidymint only goes online to check for a new version (it reads a version number, at most once a day). The only data that leaves your Mac is feedback you choose to send. | Turn off Wi-Fi and run a scan. Details, and how to watch network traffic: Does Tidymint send your data anywhere? |
| No hidden admin-level process | Tidymint installs no background process with full system privileges. When you remove an app installed for every user (an App Store app, for example), macOS itself asks for your password in its own window. Tidymint never sees it. | The independent review site AreWeCleanYet lists Tidymint as runs elevated: Never. |
| Free forever, open source | No account, no ads, no paid tier. All the code is public under the MIT license. | The source code is public on GitHub. You don't need to read code yourself: people who can read it can, and anything unusual would be noticed. |
Who has checked Tidymint
These are independent places, not run by Tidymint. Click through and see for yourself.
| Where | What they do | Result |
|---|---|---|
| VirusTotal | A Google service that runs a file through more than 60 antivirus engines at once | Tidymint 0.3.7 installer: 0/65, none of the engines found anything harmful to your Mac (scanned 3 Nov 2026) |
| AreWeCleanYet | An independent site that rates disk cleaners on a set of checks | Telemetry: None. Runs elevated: Never. Source published: Yes. Release signing: marked red, which is accurate (see What Tidymint doesn't have yet) |
| awesome-mac | A curated list of Mac apps on GitHub, where maintainers review each submission | Accepted Tidymint (26 Oct 2026) |
| Software directories | AlternativeTo, Open Source Alternatives, MacNative, SaaSHub | Reviewed and listed Tidymint (26 Oct to 1 Nov 2026) |
What every new version goes through
- Every line of code is reviewed against the previous version, and every change from the old version is written down.
- You are never asked to "test" unfinished features.
- Every new feature is used on a real Mac by the person who built it, above all the safety promises: Trash, Undo, locked items.
- GitHub packages the installer itself, straight from the public source code, not on anyone's personal computer. What you download is built from the same code anyone can read, and GitHub keeps a public record of the build.
- Every installer has a "fingerprint" (a SHA-256 checksum) listed on the release page. If the file is changed even slightly, the fingerprint changes completely. Compare the fingerprint of your download with the one on the page (how-to below) to know it's the original.
- A VirusTotal scan is linked on the release page (since version 0.3.6).
- Changes are explained in plain words on the Changelog. Each release tag is locked on GitHub and can't be deleted or moved.
How to check the file you downloaded (3 steps)
- Download Tidymint from only two places: tidymint.app or the releases page on GitHub. Any other site is not ours.
- Compare the fingerprint: press Cmd + Space, type Terminal, press Return. Paste the line below and press Return:
shasum -a 256 ~/Downloads/Tidymint.zip
You'll see a 64-character string. Compare it with the SHA-256 line on the release page: if every character matches, the file hasn't been changed. - See the virus scan: open the VirusTotal link on the release page, or drop the file on virustotal.com to check it yourself.
What Tidymint doesn't have yet
- No Apple signature yet. To sign apps, a developer pays Apple 99 USD a year. Because Tidymint isn't signed yet, macOS shows a warning the first time you open it, and you click Open Anyway in System Settings. The warning means Apple hasn't verified the developer; it doesn't mean the app contains malware. Step-by-step guide: Install Tidymint. Sponsorships on GitHub Sponsors go to this first.
- Tidymint is made by one person, whose details are public on GitHub. Emailed reports get a reply within 24 hours.
- Undo has limits. It restores the most recent clean only, and only while the items are still in the Trash. Once you empty the Trash, they're gone.
Transparency log
Every step that makes Tidymint more trustworthy is recorded here, newest first.
- 3 Nov 2026: Released 0.3.7, VirusTotal scan 0/65. This version fixes an issue present since 0.3.6: the Telegram section of Clean by App could list a few of Telegram's own database files (they have no file extension) next to photos and videos. None were pre-selected and everything goes to the Trash, so it could be undone; 0.3.7 blocks them for good.
- 1 Nov 2026: VirusTotal scanned version 0.3.6: 0/66. Added a security policy, private vulnerability reporting on GitHub, and a security.txt file. SaaSHub approved Tidymint. AreWeCleanYet published a review page for Tidymint.
- 31 Oct 2026: Open Source Alternatives approved Tidymint.
- 30 Oct 2026: Released 0.3.6, the first version built by GitHub from the public source. Locked the main branch and release tags on GitHub. MacNative approved Tidymint.
- 26 Oct 2026: awesome-mac accepted Tidymint. AlternativeTo listed Tidymint.
Found a security issue? Tell us
Email hello@tidymint.app (subject "Security"), or click Report a vulnerability on the Security tab of the GitHub repository. You'll get a reply within 24 hours.
FAQ
If it's free, how does Tidymint make money?
Tidymint doesn't sell data and shows no ads. Costs are covered by the maker, plus voluntary support through GitHub Sponsors. The code is public, so if the app secretly sent anything out, anyone could see it.
My antivirus flags Tidymint. What now?
Email us with the name of the antivirus and a screenshot of the warning. You can also compare the SHA-256 and check the VirusTotal result as shown above, to confirm the file is the official one.
Why does macOS say it can't verify the developer?
Because Tidymint isn't signed by Apple yet (see What Tidymint doesn't have yet). Open it once with Open Anyway in System Settings; after that it opens normally.
Does Tidymint read the contents of my files?
Mostly it reads only names, sizes and dates. Contents are read only when finding duplicates and when checking scripts in project folders you add yourself, all on your Mac, sent nowhere.
Clean your Mac for free
Tidymint is free and open source. Everything always goes to the Trash first, so you stay in control.
Sources
- VirusTotal: scan of Tidymint.zip 0.3.7
- AreWeCleanYet: Tidymint review page
- Tidymint security policy (SECURITY.md)
- Apple: Safely open apps on your Mac (Open Anyway)
- Tidymint source code on GitHub (MIT license)
