Graded on your computer, by your computer.
Every scan that covers your everyday folders — Documents, Downloads, and Desktop, exactly what the default scan selects on Mac or PC — earns a Privacy & Storage Report Card: a letter grade computed on your device. The score never leaves your device, so we can’t see it and neither can anyone else. Owning sensitive files costs you nothing; leaving them in a high-traffic spot like Downloads or your Desktop is the only thing we flag. An A+ is reachable without paying a cent.
And because a grade you can’t audit is just a scare tactic, the full scoring math is on this page.
What a shared card looks like
Sharing is optional, off by default, and preceded by a consent preview of the exact pixels. This is a specimen — built from the real card’s design, not taken from anyone’s Mac.
Specimen, not a screenshot. The numbers are the “tidy, well-placed Mac” worked example from the scoring model below (zero exposed files, 1 GB reclaimable, 40% full → 99 = A+, on the free tier).
The scoring math, in full
Two sub-scores tell two honest, separate stories: Privacy (is anything sensitive sitting somewhere it shouldn’t?) and Storage (how much disk is going to waste?). Everything below runs on your device, on numbers your device already computed.
Source of every figure on this page (data-source="score-model"): the shipped v1.4 scoring module, whose formulas are reproduced here symbol-for-symbol and whose worked examples are pinned — digit-for-digit — in the automated tests. If this page and the app ever disagree, the app’s tests catch it; tell us if you catch it first.
What counts as “exposed” — the anti-fear-mongering line
A sensitive file counts as exposed only when it sits in a high-traffic place: Downloads, Desktop, Public, Shared, a Screenshots folder, or a cloud-sync root (iCloud Drive, Dropbox, OneDrive, Google Drive, Box). A tax return filed in an organized ~/Documents subfolder costs zero points — owning private files is not a problem to be scored.
E = sensitive findings in a high-traffic location, excluding files
inside development projects that YOU have confirmed belong there
(unconfirmed in-project files still count — see below)
Ep = photographed documents (IDs, paperwork) in a high-traffic location,
same rule
Edup = exposed findings that also have a byte-identical duplicate copy
(reserved signal — every current release scores it as 0)The total count of sensitive files you simply own is used for wording only. It is never an input to any formula on this page.
Files inside development projects: your call, not ours (v1.4). Vaulith refuses to relocate anything inside a version-controlled project — moving it would break the project — so a sensitive file in a high-traffic spot inside one can’t be fixed by the move the score would otherwise ask for. But the file is still sensitive, and we don’t get to wave that away. So it keeps counting as exposed until you confirm it belongs there (“they belong here”, revocable anytime) — the same accepted-risk pattern security scanners use. A confirmed file is counted and shown but not penalized; an unconfirmed one is penalized with the confirm action as its one-click remedy. The verdict that a file is inside a project comes from the same engine check that refuses the move, and if that check can’t run, the strict reading applies: the file counts as exposed, never the lenient way around. Your confirmations never leave your device.
Privacy sub-score P
monPen = 42 · min(1, ln(1 + (E + Ep)) / ln(1 + 50))
P = round(100 − monPen − min(15, 5·Edup)) clamped to 0–100The exposure penalty is a saturating curve, capped at 42 — so the score can name a real problem without ever painting a working computer as a catastrophe — and it keeps discriminating all the way to 50 exposed files: every single file you move out of a high-traffic spot pays back points. (Model v1.1 charged a flat 7 points per file and hit the cap at just six — moving a 1,900-file folder out of exposure could pay nothing. Fixed in v1.2.) Zero exposure means P = 100, always.
The curve, hand-computed and pinned as a test table:
| exposed files | 0 | 1 | 3 | 10 | 25 | 50 | 1,915 |
|---|---|---|---|---|---|---|---|
| monPen | 0 | 7.40 | 14.81 | 25.61 | 34.80 | 42 | 42 |
Storage sub-score H
Scoring inputs are quantized first, so everyday free-space jitter can’t move any term. The card’s displayed figures keep the raw values — only the math reads the rounded ones.
usedFracQ = round(usedFrac · 100) / 100 disk fullness, steps of 0.01
usedQ = usedFracQ · totalBytes
RQ = round(R / 0.5 GiB) · 0.5 GiB reclaimable bytes, 0.5 GiB bucketsdupPen = 12 · min(1, ln(1 + dup) / ln(1 + 500))
fullnessScale = clamp(usedFracQ / 0.60, 0.25, 1)
denom = max(usedQ, usedBytes, 1)
reclaimRaw = min(45, 130 · RQ / denom) · fullnessScale
reclaim = min(reclaimRaw, min(45, 130 · RQ / (0.60 · totalBytes)))
fullPen = usedFracQ ≥ 0.80 ? min(20, (usedFracQ − 0.80) / 0.15 · 20) : 0
H = clamp(round(100 − reclaim − dupPen − fullPen), 0, 100)- Duplicates are a hygiene signal, not a size signal. Duplicate bytes already live inside the reclaimable term, so the count curve is capped at 12 and keeps discriminating up to 500 duplicates — their size is never charged twice. And
dupcounts only duplicates Vaulith actually offers to clean (v1.4): copies inside development projects — build artifacts, usually — are shown for information and never charged, because a penalty whose only remedy the product refuses isn’t a score, it’s a trap. - A near-empty disk is opportunity, not urgency.
fullnessScaleshrinks the reclaim penalty on a mostly-empty drive; a disk past 60% full keeps the whole penalty. - The junk-share semantic, capped (v1.2).
reclaimmeasures junk as a share of what’s on the disk, so deleting your own files (used space down, junk unchanged) raises the share — v1.2 caps the term at its 60%-denominator value, so freeing your own space can never raise any penalty, and the raw-used floor indenomstops a nearly-empty large volume from collapsing the denominator. One honest caveat remains: past 60% full, adding data with the same junk shrinks the share, so hoarding can nudge H up a point — we document it rather than distort the semantic. - Fullness only bites past 80%.
fullPenramps from 0 to 20 between 80% and 95% full. - No disk snapshot? Storage falls back to a coarse ladder over absolute reclaimable bytes — H = clamp(round(ladder(RQ) − dupPen), 0, 100), so the duplicate-hygiene penalty still applies — and the card labels itself an estimate.
The duplicate-penalty curve, hand-computed and pinned as a test table:
| duplicates | 0 | 10 | 50 | 200 | 500 | 2,000 |
|---|---|---|---|---|---|---|
| dupPen | 0 | 4.63 | 7.59 | 10.24 | 12 | 12 |
The composite and the letter
Score = round(0.55·P + 0.45·H) computed in integer arithmetic,
so .5 boundaries round deterministicallyThe free fix comes first
When files are exposed, the card’s first suggestion is always the one that costs nothing: move them somewhere organized. The promised grade is the model’s own recompute with exposure zeroed — never copywriter arithmetic.
freeFix = the same model, re-run with the exposed findings removed
→ P returns to 100, Storage is untouched
→ freeFixScore = round(0.55·100 + 0.45·H)The Pro projection — future-tensed, by rule
Vaulith Pro will add file monitoring in a future release; nothing is watched in any current release, and the card says so on its face. Until that ships, the app may show a conditional projection — “what this Mac would grade with its exposed files under monitoring — monitored, not deleted”:
relief = monPen · 0.85 + min(15, 5·Edup) · 1.0
proP = clamp(round(P + relief), 0, 100)
proScore = round(0.55·proP + 0.45·H)Three rules keep it honest, each pinned as a unit test: the projection appears only when exposure exists and the letter would actually improve; it retires only the exposure penalty and never touches Storage — Pro doesn’t reclaim space, and cleaning stays free; and the 0.85 factor means a watched file is lower risk, not zero — so the free fix above always projects an equal-or-better grade than the paid line. Your own hand beats our subscription, by construction.
Stability — jitter holds, earned progress always shows
The displayed score changes only when a fresh compute differs by 3 or more points, and a re-scan that finds the exact same exposure story — with nothing but sub-band drift in storage — holds its letter. The pinned test: ±2 GB of free-space churn between two otherwise identical scans cannot flap the grade — or the Pro projection.
The hold has strict escape hatches (v1.2), each pinned: a letter-band crossing is never held, not even for one scan; the hold requires the same storage inputs (the same 0.5 GiB reclaimable bucket and the same duplicate count — so cleaning or deduping anything always shows your fresh number, and small wins can never be silently swallowed scan after scan); and an estimate-labeled card never holds against a real disk snapshot or vice versa. A genuinely new exposed file, or a real 3-point shift like a disk filling up, always shows fresh.
A worked example, end to end
| The Mac | 3 sensitive files in Downloads · 12 GB reclaimable · 250 of 500 GB used · 40 duplicates |
| Privacy | monPen = 42·ln(4)/ln(51) = 14.81 → P = round(85.19) = 85 |
| Storage | reclaim = 5.12 · dupPen = 7.17 → H = round(87.71) = 88 |
| Grade | round(0.55·85 + 0.45·88) = 86 = B |
| Free fix | move the 3 files out of Downloads → round(55 + 0.45·88) = 95 = A — free |
| Pro projection | 94 = A — shown below the free fix, and it never beats it |
The guardrails are the feature
Cleaner apps have trained everyone to expect scare counters and grades that only money can fix. This card inverts each trick structurally — and each inversion is pinned as a unit test, so a future maintainer who drifts breaks the build, not your trust.
Owning files never lowers the grade.
Only location does. A thousand well-filed tax returns score identically to none; the total sensitive count is not an input to any formula.
Pinned as a unit testA+ is reachable free.
Move files, dedupe, clean — every point comes back by your own hand. There is no “buy to fix the number.”
Pinned as a unit testA limited scan withholds the letter.
Truncated, permission-blocked, or narrowed scans show their numbers as “partial” and no grade — a permission problem is never dressed up as a confident A or F, and a partial card can’t be shared.
Pinned as a unit testScores are never uploaded.
The card and its history live in a local-only store. The optional signed-in sync carries counts and byte totals — no grade, no score, and nothing derived from sensitive files.
Pinned as a unit testThe free fix always renders above the paid line.
Wherever a Pro projection appears, the do-it-yourself exit is shown first — the screen order itself is under test. Paying is never the only visible way out.
Pinned as a unit testThese are ledger claims like any other — each has a disproving test you can run yourself.
What a shared card can — and can’t — contain
The export is built by a strict allowlist, so a shared image structurally cannot leak what it never receives.
| Ever on a shared card | Never on a shared card |
|---|---|
| Letter grade and score · the on-device badge · reclaimable space, rounded · month-only date · the Vaulith wordmark and this page’s address. A second, separate opt-in can add one umbrella phrase (“a few sensitive files found and protected”) — nothing more specific exists in the export path. | File names, paths, or folders · sensitive categories (legal, medical, financial, identity) · exact sensitive counts · the word “exposed” or any location · device name, disk sizes, or exact scan date. |
Before anything is saved, a consent preview shows the exact pixels plus an included / never-included list, and the PNG is written locally with no hidden metadata. Nothing is posted anywhere by the app.
Get your own letter
Download Vaulith free, run the default scan, and see your grade — computed on your device, checkable against the math on this page. No account, no card.
Download for macOS & Windows — FreeSkeptical? Good — that’s the audience this page was written for. Watch the app’s network traffic while it grades: verify it yourself.