Does your Mac cleaner upload anything? Here’s how to check

A disk cleaner reads everything you own — every folder, every file name, sometimes every photo. So the question “what does it send back?” deserves a better answer than a marketing page. Here is a vendor-neutral method for checking any cleaner yourself, with free tools, in about ten minutes. At the end, we run it on our own product and show you the expected result.

Last updated: August 14, 2026 · ~7 min read · Full disclosure: we make Vaulith, a cleaner for Mac and Windows. The method below works on us too. Please use it that way.

First, calibrate: what “collecting data” actually means

Not all traffic is a betrayal. When you watch a cleaner on the network, you will see up to three kinds of activity, and they deserve different reactions:

• Housekeeping traffic. Update checks, license validation, crash reports. Small, brief, and normal for almost any modern app.
• Analytics and telemetry. Events about how you use the app — what you clicked, how often you scan. Many utilities collect this and disclose it in their privacy policies. Disclosure is not a scandal. But you may not want it, and you deserve to see it happening rather than infer it.
• The thing everyone actually fears. Your file names, paths, or contents leaving your machine. This is the question that matters most for an app whose job is reading your whole disk — and it is the one this method answers most decisively.

Step 1 — Read the privacy policy like an engineer

Before watching the wire, spend three minutes on the vendor’s own words. Open the privacy policy and use Find (Cmd-F) for these terms: analytics, telemetry, third part, advertising, identifier, retention.

A good policy is specific: it names what leaves your device, why, and who else sees it. A vague policy says things like “we may collect usage information to improve our services” — which can mean nearly anything. Vagueness is not proof of bad behavior. It just means the policy cannot answer your question, so the network will have to.

Step 2 — Watch the sent bytes (nothing to install)

macOS already ships the instrument. Open Activity Monitor (Applications → Utilities), switch to the Network tab, and find the cleaner in the process list. Note its Sent Bytes. Now run the biggest scan the app offers and watch that number while gigabytes of your disk are read.

The logic is simple arithmetic. Scanning is reading; it should produce almost no sending. If sent bytes stay in the kilobyte range while the scan chews through your whole drive, nothing bulk is leaving. If sent bytes climb with the size of what is being scanned, stop and ask why.

Prefer the Terminal? This one-liner lists every open network connection belonging to an app, refreshing every two seconds until you press Ctrl-C. Every part is readable: while true repeats the check, date stamps each pass, lsof -a -i -c AppName lists that app’s network connections, and sleep 2 waits between passes. Swap AppName for the process name of the cleaner you are testing:

Command — macOS, works on any app

Run it during a scan and read what appears. Connections to the vendor’s domains at launch are housekeeping. A connection to localhost or 127.0.0.1 is the app talking to something on your own machine — that traffic never leaves your computer at all. Steady chatter to domains you cannot place is worth looking up, one hostname at a time.

Step 3 — The deeper views: LuLu, Little Snitch, Wireshark

The built-in tools show how much. Two classes of free-to-try tools add to whom and when:

• A per-app firewall — LuLu (free) or Little Snitch (its demo mode is enough) — shows every outbound connection the cleaner attempts, live, with the destination hostname. This is the clearest single view for this job: start a scan and watch whether the connection list grows.
• Wireshark captures the raw traffic itself. The payloads will be TLS-encrypted, and that is fine — encryption hides content, but it cannot hide who the app talks to or how much it sends. Open Statistics → Conversations after a scan and sort by bytes sent from your machine. You cannot hide gigabytes of uploads inside kilobytes of traffic. That sort-by-bytes view catches bulk exfiltration every time.

If you want to go deeper — set up each tool step by step and watch any app on your Mac, not just cleaners — we wrote a full walkthrough: how to watch what any Mac app sends over the network.

How to read what you find

• Expected and fine: brief connections to the vendor’s own domains or its infrastructure provider at launch — updates, licensing. Small and short-lived.
• Worth a raised eyebrow: analytics or advertising domains the privacy policy never mentioned, or chatty traffic on every click. Not theft — but now you know something the marketing page did not say.
• A genuine red flag: sent volume that scales with how much disk was scanned. There is no innocent reading of that for a cleaner.

And one honest limit: this method cannot see inside encrypted payloads. A few kilobytes could be an anonymous version ping or a summary of your scan — the wire cannot tell you which. For that last stretch, you need the vendor to publish exactly what its traffic contains, in a form specific enough to be caught lying. Which brings us to the part where we take our own medicine.

We ran it on ours. Here is what you should see

Run the method above on Vaulith and this is the published expected result, straight from our verify-it-yourself page. Signed out, a scan talks only to the local AI runtime on your own machine — loopback traffic to 127.0.0.1:11434 that never reaches the network — plus one version check with GitHub Releases at launch. Signing in adds a license check and a scan summary: counts, sizes, timestamps, and a device identifier — a few kilobytes. Never, in any state: your files, file names, paths, thumbnails, or contents.

That page lists the complete expected-traffic table, hostnames included, so you can diff what you capture against what we promise. It is deliberately specific — specific enough to be falsified. And to make lying expensive, there is a standing public invitation: a reproducible packet capture of any shipped build (v1.0.54 or later) transmitting file names, paths, thumbnails, or contents, terms on the security page. The wider context — every connection the app can make and why — lives on how your privacy works.

Keep going

• Are Mac cleaners safe? An honest answer — the six-point checklist for judging any cleaner, including ours.
• The fake “free up disk space” Terminal scam — the January 2026 campaign that made this category’s trust problem urgent.
• Vaulith vs CleanMyMac — how the two approaches to privacy and cleanup compare, with sources.

Frequently asked questions

Does CleanMyMac collect data?

We are not going to characterize a competitor’s data practices for them — that would be exactly the kind of claim you should not take from a rival. MacPaw publishes a privacy policy; read it with Step 1, then check the behavior with Steps 2 and 3. The method is the answer, whoever the vendor is.

Could an app hide its uploads from these tools?

Ordinary applications cannot hide from a packet capture — Wireshark sees whatever crosses the network interface, no matter what the app does internally. Deliberately evasive malware with deep system access is a different problem with different tools. For a signed, notarized consumer app, the checks on this page are decisive for the question that matters: is anything big leaving?

How often should I re-check?

After major updates, or whenever a vendor changes hands or changes its privacy policy. Behavior can change with any release. That is why dated, published expected-traffic lists matter more than one-time reviews — including ours, which carries its last-updated date for exactly this reason.