NadhifEffective date: 31 October 2026 Controller: Alhamou (hamou.de) ("Alhamou", "we", "us")
This policy explains what the Nadhif Mac application and command line tool ("Nadhif") do with data. In short: Nadhif collects no personal data, has no account, no telemetry, no analytics and no crash reporting, and sends nothing about you to Alhamou. Everything it finds stays on your Mac. The only network traffic is the checks and scans you start, sent to the targets you choose and to the public services listed below.
1. What we collect
Nothing. Nadhif has no user accounts, no sign-in, no tracking identifiers, no advertising, no usage statistics, no analytics, no crash or error reporting and no "phone home" of any kind. Alhamou does not run a server that Nadhif talks to, and does not receive your files, file names, paths, scan results, reports, server details, website details, IP address or any information about your Mac.
2. What stays on your Mac
Nadhif reads your Mac to do its work: file and folder sizes in your home folder, installed apps and packages, and macOS security settings. All of it is processed on your Mac. What Nadhif keeps, it keeps locally:
| Data | Where |
|---|---|
| Settings (language, appearance, retention, thresholds, protected folders) | macOS user defaults for Nadhif |
| Files you cleaned, with a list of where each came from | ~/Library/Application Support/Nadhif/Quarantine/, removed after the retention period (7 days by default) |
| Activity log | ~/Library/Application Support/Nadhif/Logs/ |
| Servers you added and their recent audits | ~/Library/Application Support/Nadhif/ |
| Websites you added and their recent scans | ~/Library/Application Support/Nadhif/ |
The This Mac report is kept in memory only. Nadhif never asks for or stores passwords, never copies SSH keys, and uses the SSH configuration and keys already on your Mac. A report leaves your Mac only if you export or share it yourself.
To delete everything Nadhif has stored, empty Recently Cleaned in the app, quit Nadhif, and delete the folder ~/Library/Application Support/Nadhif and the app itself.
3. Network traffic
Nadhif is a cleaner and a security scanner, so some features must use the network. Each request below happens only because you use the feature, and none of them goes to Alhamou.
Scans you start, to the targets you choose
- Servers: when you audit a server you added (by pressing Audit, or on a schedule you set for it), Nadhif connects to it over SSH, using your own SSH setup, and runs read-only commands. It may also open an HTTPS connection to names served by that server to check the certificate visitors see.
- Websites: when you scan a website you added (by pressing Scan, or on a schedule you set for it), Nadhif sends requests to that site and its subdomains. A scan starts only after you confirm that you own the site and prove it with a DNS TXT record. Active tests, which you must turn on separately, submit forms and upload one test file to the verified site only.
- DNS lookups for the domains you scan and for the domain verification record, through your Mac's normal resolver, including a lookup in Spamhaus's public domain blocklist. When your Mac's resolver does not answer (some home routers never answer TXT lookups), Nadhif asks the public resolvers 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google) instead, which see the names looked up.
Online checks (Settings › Online checks; on by default, can be turned off)
| Service | What is sent | Why |
|---|---|---|
| api.osv.dev | Names and versions of packages and JavaScript libraries (on your Mac, on your servers, or found on your website) | Known vulnerabilities |
| registry.npmjs.org | Names of global npm, pnpm and bun packages | Newer versions |
| Update feeds declared by your apps (Sparkle, https only) | A normal request for the feed | Newer versions of those apps |
| www.cisa.gov | A download of CISA's public list, at most once a day | Actively exploited vulnerabilities |
| crt.sh, api.certspotter.com | The domain name of a website you scan | Subdomains from Certificate Transparency |
| web.archive.org | The domain name of a website you scan | Old addresses of the site |
Only package names, versions and domain names are sent. No file contents, file names, paths or personal data are sent. Like any internet request, these services can see your IP address and the time of the request; they are run by third parties under their own privacy policies, and Alhamou has no access to what they log.
When you ask Nadhif to update or remove a package, it runs that package manager (for example Homebrew or npm) on your Mac, which may contact its own servers as it always does.
4. Permissions
Nadhif asks for Full Disk Access so it can see caches, logs and the Trash. It uses that access only on your Mac, for the scans you start, and never sends what it sees anywhere. Nadhif never asks for an administrator password and does not install background processes or privileged helpers. Scheduled scans run only while Nadhif is open; you can let it open at login for them. When you quit it, nothing keeps running.
5. The Nadhif website
The Nadhif website uses no cookies, no analytics and no tracking. It stores your light or dark mode choice in your browser only. To display the page, your browser loads fonts from Google Fonts and fetches the latest version number from GitHub; those providers receive your IP address and browser details as part of the request, under their own privacy policies.
6. Children
Nadhif is not directed at children and collects no data from anyone, including children.
7. Your rights
Because Alhamou does not collect or receive personal data through Nadhif, we hold no data about you to access, correct, export or delete. All data Nadhif creates is on your Mac and under your control (see Section 2). If you contact us, we use your message only to answer it. Depending on where you live, you may have rights under data protection law (for example the GDPR), including the right to complain to a supervisory authority.
8. Changes
If Nadhif ever changes what it sends or stores, we will update this policy before or with that release and change the effective date above.
9. Contact
Alhamou — hamou.de