Permissions & Privacy

Netutilus has no account of its own and collects no analytics. Everything it measures stays on your Mac, unless a tool has to ask a service to do its job. This page lists each permission and each service.

Permissions

macOS asks before an app may use some features. Netutilus asks only when a tool first needs one, never at launch.

• Local Network: talking to devices on your own network. LAN Scanner and Network Guard need it, and so does any tool pointed at a local address: Ping, Port Scan, Path Check, DNS Lookup against your router, iperf3, Uptime Monitor. Without it those tools time out or see nothing. Turn it on in System Settings › Privacy & Security › Local Network.
• Location Services: macOS hides Wi-Fi network names from apps without it. Wi-Fi Analyzer and Wi-Fi Networks ask for it on their first start, and LAN Scanner uses it to name your router. Netutilus never reads your location. Turn it on in System Settings › Privacy & Security › Location Services.
• Notifications: for Uptime Monitor’s alerts, Network Guard’s new devices, and the menu bar’s IP and VPN alerts. Asked when you turn one of them on. Change it in System Settings › Notifications.

What is sent, and where

• Most tools contact only what you enter. That covers Ping, Traceroute, MTR, Port Scan, Path Check, SSL Certificate, Uptime Monitor and iperf3. LAN Scanner and the Wi-Fi tools stay on your own network.
• Speed Test, and Internet Check’s full check, transfer test data to and from Cloudflare. CacheFly is used only if Cloudflare refuses.
• Internet Check probes Cloudflare’s 1.1.1.1 (or Google’s 8.8.8.8 if it doesn’t answer), makes one small request to Cloudflare, and times your own DNS with made-up names under apple.com, cloudflare.com and wikipedia.org. When it suspects a login page, it asks Apple’s captive.apple.com.
• Locations and providers come from ipapi.co, or ipwho.is when that fails. This covers the menu bar’s public IP, GeoIP, Visual Traceroute’s hops, and Traceroute’s provider names, which you can switch off with Look up providers. Each request carries the address being looked up.
• The menu bar’s IPv6 leak check asks Cloudflare over IPv6 which address it sees.
• Visual Traceroute’s map comes from Apple Maps.
• DNS Lookup asks your Mac’s resolver, or the server you choose: Google, Cloudflare, Quad9, OpenDNS and AdGuard over encrypted DNS. DNS Propagation asks Google, Cloudflare, AdGuard, NextDNS, RethinkDNS and DNS.SB.
• Whois asks IANA’s whois server, then the registry it names.

What stays on your Mac

Results, histories, your devices list, saved servers and settings are kept on this Mac only. Settings › Data lists everything Netutilus stores, with its size and a button to clear each part. The menu bar’s log of IP and VPN changes is never sent anywhere.

Related

• Welcome to Netutilus.