Your Mac. Your data.

The short version

Nuro Optimizer does not collect, transmit, or store any of your data anywhere outside your Mac. There is no telemetry, no analytics SDK, no crash reporter, no license server, and no account system.

There are exactly three places where the app itself talks to the network, plus one optional on-device feature that does not, and they are all listed below. Two of the three network features only run if you press a button to run them.

• Auto-updater (Sparkle). Fetches https://optimizer.getsentium.com/appcast.xml — a public, unauthenticated XML file that lists available versions. The request sends no information about you or your machine beyond the standard User-Agent header Sparkle uses; the response is verified against a bundled EdDSA public key before any update is installed. You can disable this check entirely in Nuro Optimizer › Settings › Updates › Automatically check for updates.
• Speed Test (opt-in). In the Network tab, if you press Run Speed Test, the app makes timed HTTP requests to Cloudflare's public speed-test endpoints at speed.cloudflare.com to measure download, upload, ping, and jitter. Like any website you visit, Cloudflare's servers will see your public IP address — the one your internet provider assigns to your home or network. The first time you try to run the test, the app shows a one-time consent banner explaining this. Nothing about the test is sent to Nuro, and the test never runs automatically.
• DNS Benchmark (opt-in). In the Network tab, if you press Run DNS Benchmark, the app sends a single small DNS query (resolving the well-known hostname one.one.one.one) to each of four public DNS resolvers — Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9), and OpenDNS (208.67.222.222) — plus your system resolver, to compare their response times. Same one-time consent banner as above. Nothing is sent to Nuro, and the benchmark never runs automatically.
• On-device explanations (optional). On Apple silicon Macs running macOS 26 or later with Apple Intelligence on, Nuro can ask the Mac’s own on-device model to rephrase Nuro’s findings in plain language. This uses Apple’s Foundation Models framework on the device. Nuro makes no network request for it, sends nothing to Mount Xion Technologies, never includes the text in exported reports, and you can turn it off in Nuro Optimizer › Settings › Intelligence.

The other Network tab features — Wi-Fi Inspector, Network Interfaces, and VPN status — make zero external calls. They read state your Mac already knows about itself.

What the app reads on your Mac

To diagnose performance issues, the app reads system information that macOS already exposes to user-space tools — the same data you can see in Activity Monitor, System Settings, or Disk Utility. Specifically:

• Hardware specs, OS version, uptime, load averages
• Memory and swap statistics
• Disk capacity, S.M.A.R.T. status, APFS metadata
• Battery health (laptops) and thermal state
• Top processes by memory and CPU usage (names + PIDs only)
• Launch agents and daemons configured to run at startup
• Cache directory sizes (file content is never read during diagnostics). The Exposed Secrets scanner — which you trigger manually and is primarily aimed at developers — reads specific known file locations (shell config files, .env files, shell history, SSH key headers) to detect cleartext credential patterns. It reads only those locations, never arbitrary documents or media. No content is ever transmitted off-device; the only output is the file path and credential type shown to you.
• Security posture (Security › Security Posture, or macoptimize --posture). Runs these read-only system tools, all available to an ordinary user account: fdesetup status (FileVault), csrutil status (System Integrity Protection), spctl --status (Gatekeeper), socketfilterfw (application firewall), mount (sealed system volume), launchctl print and print-disabled, pgrep and cupsctl (which sharing services are on), pmset -g custom (Wake for Network Access), sysadminctl -screenLock status (lock screen), pwpolicy -getaccountpolicies (password policy), dscl (whether the root account is enabled), profiles status -type enrollment (whether the Mac is managed), tmutil destinationinfo (Time Machine), xprotect status (malware scanner), and sysctl, sw_vers, hostname and id (model, chip, macOS version, host name, user name). It reads the Software Update, App Store, Time Machine, login window, Internet Sharing, Analytics, Apple Advertising, Bluetooth, media-sharing and screen saver preferences, the XProtect files under /Library/Apple, the pending-update list Software Update already keeps on disk, and each installed app’s version from its own Info.plist. It also runs the Exposed Secrets scan above. App versions are compared with a catalog built into this version of Nuro and dated in the report; the check makes no network request. The technical report, and the JSON snapshot (printed by macoptimize --posture --json or saved in an export folder), contain this Mac’s host name, your user name and the paths of any files the secrets scan flagged; the executive summary contains none of them. Reports are written only to a folder you choose. The posture score is not a compliance certification.

This information stays on your machine. It is never uploaded anywhere.

Full Disk Access

macOS requires Full Disk Access for several of the analyzers above (notably scanning launch items in /Library/LaunchDaemons and reading SMC keys for thermal data). Full Disk Access lets the app read protected paths on your behalf — it does not give the app permission to send anything off-device. You can revoke it any time in System Settings → Privacy & Security → Full Disk Access.

Where data is stored locally

The app keeps a few small files in your home directory under ~/.macoptimize/:

• Benchmark snapshots — JSON files capturing system state before and after optimization runs, so you can see what changed.
• Action log — a plain-text record of which caches were cleaned and which startup items were toggled, and the folder of any posture report you export, so changes can be undone.

These files never leave your Mac. You can delete them at any time. ./reset-install.sh in the source tree wipes everything the app has touched.

Reversibility

Cache cleaning moves files to the Trash rather than permanently deleting them, so anything we shouldn't have touched can be recovered. Startup item changes are recorded transactionally and can be reverted from within the app.

The website

This site (optimizer.getsentium.com) is a static page hosted on Cloudflare Pages. It does not set cookies or run analytics scripts. Cloudflare may collect basic server-side request logs as part of operating their hosting infrastructure — that is outside our control and outside the app itself.

Distribution and updates

The app is signed with an Apple Developer ID and notarized by Apple before every release. Apple validates the binary; macOS staples the notarization ticket to the app bundle so Gatekeeper can verify it offline. Update notifications are delivered by Sparkle, which fetches the appcast XML described above from our own Cloudflare Pages site. We use no third-party update servers, license servers, or telemetry endpoints, and we do not subscribe to any analytics or attribution services.

Changes

If this policy ever changes, the new version will appear here with an updated date. The "no telemetry, no accounts" promise is a core product principle and is not going to change.

Contact

Questions or concerns: Sentium1@icloud.com.