Relief processes file metadata and, only for explicit duplicate analysis, local file contents. It does not upload file names, paths, metadata, hashes, file contents, scan snapshots, cleanup rules, history, diagnostics, or preferences.

Completed scan metadata is stored in an embedded, query-only SQLite snapshot under the user's Application Support directory. Relief builds each database in a temporary file and atomically publishes it after completion; no database server, socket, remote connection, or shared service is involved. Saved snapshots are historical input only and never authorize a cleanup mutation without live filesystem revalidation.

The only intended network path is the signed Sparkle update feed.

Interactive access begins with a native open panel. Relief persists security-scoped bookmarks for user-selected scan roots and scheduled-rule roots so those explicit grants survive relaunches. Bookmark data stays in local Application Support and is never treated as authority outside its selected root.

Full Disk Access is optional for ordinary selected-folder scans and required for complete startup-volume coverage of TCC-protected data. It is managed exclusively by macOS; Relief cannot grant or toggle it. Because macOS exposes no direct status API, Relief reports readiness from a non-invasive protected-directory readability probe and links to the exact Full Disk Access pane in System Settings. Security-scoped bookmarks do not bypass TCC.

The app is intentionally not sandboxed because a disk inventory utility must enumerate user-approved volumes and macOS-protected locations when the user separately grants Full Disk Access. Relief has no root helper or privilege-escalation path.

Relief never permanently deletes files and never empties Trash. Cleanup is restricted by selected roots, protected-path denial, regular-file checks, current metadata validation, and run caps. Review-only rules are the default.

Relief does not need an application credential for ordinary use. Release credentials belong in Keychain or CI secrets and must never enter the repository or logs.

Report a security issue privately to the repository owner. Do not include sensitive file paths, scan snapshots, credentials, or private file contents in a public issue.