Nexus Clean privacy statement

Version 1.0. Last updated: October 2026.

Nexus Clean works entirely on your Mac. Nothing about your files, your apps or your Mac is sent anywhere.

Nexus Clean is made by Luminark Labs (luminarklabs.com). Questions about privacy: support@luminarklabs.com.

What Nexus Clean doesn't do

• No account or sign-in.
• No analytics, usage statistics, tracking or advertising.
• No crash reports sent anywhere.
• No connection to the internet in the background.
• No uploading of file names, paths, sizes or scan results.

The three connections, all only when you ask

• Check for Updates… (Nexus Clean's own) reads one small file from the Nexus Clean website, update.json, which says which version is newest.
• App updates › Check for Updates… fetches the update feed of each app that declares one (from that app's vendor) and sends the bundle identifiers of your App Store apps to Apple's public lookup (itunes.apple.com/lookup). A confirmation says so before anything connects. Requests carry only the label "NexusClean" and the bundle identifier; nothing about your files is sent and nothing is stored.
• Test network quality (in the menu bar) runs Apple's own networkQuality tool, which connects to Apple's servers to measure your connection. Nexus Clean sends nothing of its own.

"What is this file?" uses Apple's on-device model (Foundation Models) and never connects; it sees the file's name, kind, size, location and dates, never its contents. iCloud downloads uses macOS's own iCloud eviction and download; Nexus Clean itself connects to nothing.

Nothing else connects. Notifications (the Check-up reminder, menu-bar alerts, the trashed-app prompt) are local and are shown only after macOS asks you once.

What is read, and only read

• Privacy reads each browser's own data files (history, cookies, autofill and session databases) through the system's SQLite library in a read-only mode that creates no lock or journal files, and only when you scan. Nothing from them is stored, shown beyond counts, or sent anywhere. Saved passwords are counted, never read or removed.
• App permissions reads your own account's privacy permissions list the same way (never written). Reset runs Apple's tccutil for the app and permission you choose.
• Mail attachments reads the system's accounts list to tell IMAP and Exchange accounts from POP ones, and Mail's attachment folders; never message contents.
• Photos library reads thumbnails from Photos to compare pictures (never the originals' files, never photos only in iCloud). Deleting is done by Photos itself.
• Trash bins reads the Trash folders to list what they hold.
• Security check verifies signatures with macOS's own code-signing checks, on your Mac. With the optional revocation setting on (off by default), macOS may contact Apple's certificate service to check a developer certificate; nothing about your files is sent.

• It sends only the request for that file. The request carries the fixed label "NexusClean" and nothing about your Mac, its version or your files.
• As with any web request, the server can see your IP address and the time.
• No cookies are used and nothing is stored.
• If a newer version exists, the download page opens in your browser only when you click to open it.

What stays on your Mac

These files never leave your Mac unless you export them yourself, for example by saving the log as a CSV file.

Permissions

• Full Disk Access is optional. If you give it, Nexus Clean uses it only to read protected folders while scanning.
• "Last opened" dates for files and apps are read from your Mac's own Spotlight index, on your Mac.
• Startup items: Nexus Clean turns your own items on and off with macOS's built-in tool.
• "Quit and continue" asks an app to quit normally. It never force-quits.