Legal

Privacy

Version: 1.4 Effective: 26 July 2026

Applies to: Portwhistle for macOS 0.1.0 (build 33) and the website at portwhistle.com. Published by: the operator of Portwhistle, an independent developer based in India. Contact: support@portwhistle.com.

The short version

Portwhistle runs entirely on your Mac. There is no Portwhistle server, no account, no sign-in, and no user identifier of any kind.

Portwhistle makes two kinds of network connection of its own, both optional and neither carrying anything about you. One is the licence check: if you paste in a licence key, the app contacts our licensing provider, Lemon Squeezy, to activate it and re-check it about once a week, sending only the key and a name for your Mac that you can see. The other is the update check: when you ask for updates, or switch on automatic checks, the app fetches a small signed update descriptor from portwhistle.com. Updates are free for everyone. Both leave your connections, rules, and history untouched, and there is no telemetry, no analytics, no crash reporting, and no account.

Portwhistle does record things about your network activity, a 30-day connection history, and a diagnostics log, but all of it is written to your own disk and none of it is transmitted anywhere. You can read all of it, and you can erase all of it from inside the application: the diagnostics log and the connection history are both deleted from Settings › Data management. The two sections worth reading closely are What is stored and The diagnostics export, because those are the places where real data about you exists.

Buying a licence is optional and happens on the website, not in the app. Lemon Squeezy handles the card and the tax as the seller of record; the app never sees a card, only the licence key you paste in.

1. What Portwhistle can see

Be clear about this before you install it.

Portwhistle installs a system extension that runs as root. macOS hands that extension every new outbound connection your Mac makes, from every application, including ones you did not install and have never thought about. For each connection it is given the process that opened it, that process's code-signing identity, the destination hostname and IP address, the port and protocol, and running byte counts.

That is not a side effect. That is the product. An application firewall cannot tell you what your apps are contacting, or stop them, without being placed in that position. If you are not comfortable granting that access, do not install Portwhistle, that is a reasonable decision, and the software does not work without it.

Seeing is not the same as collecting, and neither is the same as transmitting. Three separate limits apply:

  • Portwhistle cannot read the contents of your connections. The extension implements only the callbacks that decide whether a connection is allowed. It never asks macOS for the data flowing through a connection, so the operating system never hands it any. There is no code path in this version that can read a message, a page, a file, or a password in transit.
  • It does not decrypt anything. Portwhistle does not install a certificate authority, holds no private key, and does not intercept TLS.
  • It does not read your DNS answers. DNS passes through untouched.

Portwhistle sees who your apps talk to. Never what they say.

2. What is stored, where, and for how long

Everything below lives on your Mac. Nothing below is sent anywhere.

Almost all of it is in one directory:

/Library/Application Support/Portwhistle/

Connection history, history.db

An SQLite database written by the extension. For each connection it records the process name, code-signing identifier, process ID, hostname, IP address, port, protocol, direction, bytes in and out, first and last seen timestamps, and connection state.

This is the most sensitive thing Portwhistle holds. It is a rolling record of every hostname and IP address that every application on your Mac connected to. It is browsing history, arrived at from a different direction.

  • Retention: 30 days, or 256 MB, whichever limit is reached first. Older records are removed automatically as new ones are written.
  • You can view and search it on the Connection history screen.
  • You can delete it from Settings › Data management. Filtering needs to be on when you do, and the app confirms what was removed.

Live connection snapshot, flows.json

A snapshot of currently active connections, rewritten by the extension roughly every two seconds so the interface can display them. It holds the same kinds of fields as the history database: process name, signing identity, hostname, IP, port, protocol, byte counts, state. It is overwritten continuously rather than accumulating, but the most recent copy stays on disk after you quit.

Your rules, rules.json

The policy you created: which applications and hosts you allowed or blocked, ports, and your default posture. This reveals what you chose to block, which can itself be telling.

Diagnostics log

Four files in the same directory, diagnostics-app.log, diagnostics-extension.log, and one rolled generation of each, capped at roughly 6 MB in total. See section 4; it is important enough to have its own.

Preferences

A small number of non-personal settings in the standard macOS preferences file ~/Library/Preferences/com.portwhistle.Portwhistle.plist: whether you completed onboarding, when Silent Mode began observing, your chosen diagnostics detail level, and the record of your acceptance of these documents described in section 9. No identifiers, no content.

That is the complete list

No other caches, no keychain items, no crash-report store, nothing hidden elsewhere. (When you download an update, Sparkle writes it to a temporary location and removes it once the update is installed.)

3. What leaves your Mac

Your network activity: nothing. Two optional calls of the app's own: a licence check and an update check.

Portwhistle has no analytics library, no crash reporter, and no blocklist downloader. The world map's country lookups run against a database file bundled inside the application; no lookup is sent anywhere. The catalog that supplies application names and descriptions ships inside the application too, and is never refreshed over the network.

The app makes two kinds of connection of its own. The first is the licence check: if you enter a licence key, the app sends that key and a device name to Lemon Squeezy to activate it, and re-validates roughly once a week. If that check cannot reach the network it fails open, so your licence keeps working offline and a failed check never revokes it; and if you never enter a licence key, this call never happens. The second is the update check: Portwhistle uses the Sparkle framework to fetch a small signed descriptor of the latest version from portwhistle.com, and only when you ask for updates or switch on automatic checks (off by default). Updates are free for everyone. Neither call carries anything about your connections, rules, or history.

Everything else leaves your Mac only when you move it: when you export your rules, or export the diagnostics log, and then choose to send that file to someone.

This section names every connection the software makes. If a future version ever contacts anything more, this section will name it before that version ships, will say exactly what is sent, and will explain how to turn it off.

4. The diagnostics export

Portwhistle keeps a local diagnostics log so that when something misbehaves there is a record of it. You can read it in the app, export it, or purge it.

What is in it. Mostly counts: how many connections were seen in an interval, how many applications, how many were blocked, byte totals. Plus rule changes you made, and Portwhistle's own errors.

The part that matters: when Portwhistle blocks a connection, it writes a line naming the application and the destination, for example, Blocked Chrome to ads.example.com:443. Connections that were allowed are never named individually; they are only counted. So the log reveals which applications you blocked from reaching which hosts. That is not your full browsing history, but it is adjacent to it, and for some people it is sensitive.

The log does not contain your username, your home directory, file paths, URLs, or the contents of any connection.

Nothing is ever transmitted automatically. There is no uploader in the application. An export happens only when you press Export and choose where to save it; the result is an ordinary file on your disk, belonging to you.

Read the export before you send it to anyone, including us. It is plain text. Open it, look at what it names, and delete any line you would rather not share; a partial log is still useful. If you are reporting a bug, please send the log by email rather than attaching it to a public issue tracker, a public attachment publishes your blocked-destination list to anyone who reads that page.

Purge deletes it. The Purge button removes the log and confirms it is gone.

5. Third parties

Three, and only three, and none of them receives anything about your network activity.

Lemon Squeezy. Licences are sold and verified through Lemon Squeezy, our seller of record. If you buy a licence, checkout happens on Lemon Squeezy's own pages, and afterwards the app contacts Lemon Squeezy's licence API to activate your key and re-check it about once a week, sending only the key and a device name. Lemon Squeezy sees what you enter at checkout and the licence key your Mac later presents; it handles the payment and the tax, and keeps its data under its own privacy policy. If you never buy a licence, your Mac never contacts it.

Apple. macOS verifies the application and mediates the approval of its system extension. That is the operating system's own behaviour, and any contact it makes with Apple is Apple's, not Portwhistle's.

DB-IP. The world map uses the DB-IP IP-to-Country Lite database, licensed under CC BY 4.0. It is downloaded once when the application is built, on the developer's machine, and ships inside the app as a read-only file. DB-IP never sees you and receives no request from your Mac.

There is nothing else. No analytics vendor, no crash-reporting service, no content delivery network, and no advertising.

6. The website

portwhistle.com loads no third-party resources. No cookies, no analytics, no trackers, no external fonts, no embedded scripts, no content delivery network. The page is self-contained; the only external addresses on it are links you may choose to click.

As with any website, the company hosting it keeps ordinary server logs, including visitor IP addresses, for the requests it serves. The host is Vercel, and those logs are governed by that provider's terms. The application itself is downloaded from this same site, so its host sees that download as it would any other request; there is no separate download service and no third-party mirror.

7. Your control

  • View, the Connection history screen shows the connection database, the Diagnostics view (under Settings) shows the log, the Rules screen shows your policy. Everything Portwhistle stores is either inspectable in the interface or is a plain file you can open yourself.

  • Export, rules and the diagnostics log can be exported to a file you choose. Nothing is uploaded.

  • Delete, both the connection history and the diagnostics log can be erased from Settings › Data management. The diagnostics log is deleted directly; the connection history is erased by the root extension at the application's request (the filter must be running), because the extension owns that database. Each reports back what was actually removed.

  • Uninstall, there is no uninstaller in this version, and the order matters, because only the application can deactivate its own system extension:

    1. Open Portwhistle and turn filtering off.
    2. Quit Portwhistle.
    3. Delete /Applications/Portwhistle.app.
    4. To remove your data as well, delete /Library/Application Support/Portwhistle/ (requires administrator rights).

    Do not skip step 1: only the application can switch off its own filter.

8. Children

Portwhistle is a system administration tool for macOS and is not directed at children. No age information is collected, because no information is collected.

9. Changes to this policy

This policy carries a version number and an effective date at the top. If what the software does changes, this document changes with it, in the same release.

When either this policy or the Terms of Use changes, Portwhistle asks you to read and accept the new version the next time you open the application. Your acceptance is recorded on this Mac only, in your own preferences file. It records the version of each document you accepted, the version and build of the application that asked, the two acknowledgements you ticked, and the time, and nothing else. It contains no identifier for you, and it is not sent anywhere. If you decline, Portwhistle quits and writes nothing.

10. Contact

support@portwhistle.com

For a security-relevant defect, please write privately rather than opening a public issue, and allow time for a fix before disclosing.