Don’t take our word for it

Six checks anyone can run in a few minutes. You need Terminal and Activity Monitor, both already on your Mac.

A new app from a developer you haven’t heard of should have to earn your trust. These checks let you confirm the claims on this site yourself.

1. Is it from a registered developer, and has Apple scanned it?

Pocketry is signed with an Apple Developer ID and notarized, which means Apple’s automated scan has checked it. Open Terminal and run:

spctl --assess --type execute -vv /Applications/Pocketry.app

You should see “accepted” and “source=Notarized Developer ID”. To see the name on the signing certificate:

codesign -dvv /Applications/Pocketry.app

Look for the line starting “Authority=Developer ID Application”.

2. Is your download the same file we published?

The checksum of the current release (version 1.5.0) is:

d64b9ccb8d31a4c1cee5de9aae19ef59fd99ab2e6f4ded9eae474dfcdee73ef6

It changes with every release, and this page is updated each time. Compare it with your copy:

shasum -a 256 ~/Downloads/Pocketry.dmg

If the two long strings match, you have the exact file we released.

3. Does it talk to the internet while you use it?

Pocketry makes no network connections while you copy, search or paste. The one thing it does on its own is check for updates, and you can turn that off in Settings (Privacy > Network, which also shows when it last checked). A check connects to pocketry.app for a few seconds, about once a day (and at launch, if a day has passed since the last check). To see for yourself, with Pocketry running:

lsof -i -a -p $(pgrep -x Pocketry)

An empty list means no open internet connections. This holds while you search by meaning too: Find by meaning runs a small language model stored inside the app, on your Mac, and uses no network connection. The model file is Contents/Resources/search-model.pminilm inside the app, and its licence is in Settings > About > Open-source notices. During an update check you may see one short connection to pocketry.app (it is served through Cloudflare), a few kilobytes in total. A free tool such as LuLu or Little Snitch will show the same thing as pop-ups.

What an update check sends: the app’s name and version number (in the standard “user agent” line every web request carries), plus the usual details of any web request, such as your IP address. It does not send what you copied, your settings, or a profile of your Mac.

4. Does it work with the network off?

Turn Wi-Fi off, then use Pocketry: copy things, search, paste, screenshot to text. Everything except the update check works without a connection. Turn Wi-Fi back on when you’re done.

5. What does it ask permission for, and why?

Accessibility: to paste into other apps, to expand snippets as you type, and for “Type it out”, which sends an entry as key presses. For snippets it keeps the last few characters you typed in memory to spot a keyword, and clears them when you click elsewhere. It doesn’t save or send them.
Screen Recording: used for screenshot to text, and it sees just the area you drag. The image is deleted straight away and the text is kept.
Keychain: to store the key that encrypts your history, on your Mac.

Accessibility and Screen Recording are optional, and you can take them away in System Settings at any time.

6. What’s inside it?

Safe Paste masks text on your Mac with pattern matching; it uses no network connection.

The app has one outside component: Sparkle, the update framework many Mac apps use. There are no analytics or advertising tools in the app. The website has no third-party analytics, advertising tools or cookies; it keeps anonymous daily totals (page visits, Download clicks, demo plays) that contain nothing about you. Pocketry is not sandboxed (it needs Accessibility to paste for you), so these checks, and not a sandbox, are the proof.

Found something odd?

Email support@pocketry.app. For a security problem, put “Security” in the subject. We read every message.