Installory's Mac App Store privacy label is Data Not Collected. The app is read-only, has no network code of its own, and has no tracking, analytics, ads or accounts. The website's support form is covered separately at the end.
Last updated 11 October 2026, for Installory 1.6.0.
The Installory app does not send personal data, package inventory, package names, install locations, AI tool settings, AI Setup findings, Install History, generated scripts, settings or scan results to the developer or to any server.
Installory contains no networking code of its own. Package descriptions are bundled with the app, and everything it shows is read from files on your Mac. Nothing is uploaded, synced, sold or shared.
The only thing in the app that may contact a server is Apple's own App Store rating prompt. Installory may ask macOS to show it after a scan you started, at most once per app version, never in sample-data mode, and only once you've used the app on a few different days. That prompt is provided by macOS and covered by Apple's privacy policy; Installory sends nothing through it.
Installory is sandboxed. It can read files only inside folders you grant through the macOS folder picker, and that access is read-only. During setup it asks for your home folder; Homebrew outside your home folder and other folders, such as a projects folder, are separate, optional grants. You can try the app with sample data without granting any folder. Inside the folders you grant, Installory reads:
SKILL.md), AI command-line tools, and VS Code and Cursor extension manifests.~/.claude.json (only its MCP server settings are kept; sign-in, account, history and everything else in that file is discarded as soon as it is read), ~/.claude/settings.json, ~/Library/Application Support/Claude/claude_desktop_config.json, ~/.cursor/mcp.json, ~/Library/Application Support/Code/User/mcp.json, ~/.codex/config.toml, and ~/.config/opencode/opencode.json or opencode.jsonc. In project folders: .mcp.json, .cursor/mcp.json, .vscode/mcp.json, opencode.json or opencode.jsonc, .claude/settings.json and .claude/settings.local.json.~/.claude/CLAUDE.md, ~/.codex/AGENTS.md, ~/.config/opencode/AGENTS.md and ~/.gemini/GEMINI.md. In project folders: CLAUDE.md, CLAUDE.local.md, .claude/CLAUDE.md, AGENTS.md, GEMINI.md, Cursor rules (.cursor/rules/ and .cursorrules), .github/copilot-instructions.md and .windsurfrules./opt/homebrew/bin, /usr/local/bin, ~/.local/bin, ~/.cargo/bin, ~/.bun/bin, ~/.volta/bin and ~/.nvm. It doesn't open or run the program.~/Documents when you grant your home folder), Installory lists file and folder names and modification dates, looking for project markers such as .git, package.json or a Python .venv. For a folder that looks like a project, it adds up file sizes and reads the AI settings and instruction files listed above.~/.zsh_history, ~/.bash_history, ~/.local/share/fish/fish_history) and AI agent session records (~/.claude/projects/, ~/.codex/sessions/, ~/.local/share/opencode/opencode.db).Apart from the files above, Installory doesn't read file contents. It doesn't read your documents, photos, mail, browser data, or passwords and keychain. The macOS home-folder permission itself is broad, so this is a promise about what Installory's code reads, which you can check in the source code, not a limit macOS enforces. Access is kept as read-only security-scoped bookmarks so later scans can use the same folders.
If AI tool settings contain something that looks like an API key, token or password, Installory masks it as soon as the file is read, keeping at most the first four characters (shorter values are hidden completely). AI Setup shows only the key's name, the file it was found in, and that masked preview. The full value is never stored, exported, put in a copied prompt or sent anywhere.
Install History is off by default. If you turn it on in Settings → Privacy (or during setup) and grant read access to your home folder, Installory looks for install commands in the shell history and session records listed above and compares them with package timestamps to show which tool you, Claude Code, Codex or opencode installed. Records are redacted before they are stored (common credentials are removed, home-folder paths are shortened, and long text is capped), and they stay on your Mac. Results are best-effort evidence, not certainty.
You can turn Install History off at any time, and Installory then offers to clear the stored history. You can also revoke home-folder access with Revoke Access in the same settings.
“Ask Your AI Assistant” and “Copy My Setup for My AI Assistant” only place text on your clipboard for you to paste where you choose. Installory does not contact any AI service. Paths in your home folder are shortened to ~/…, and secret values are never included.
Installory stores its package inventory database, scan history, snapshots, your package notes, pins and hidden items, folder-access bookmarks, settings, and (only if enabled) redacted Install History inside its sandbox container on your Mac. AI Setup results are kept in memory only and are not saved. This data is used only to provide the app's features.
Settings → Privacy → Show Installory Data Folder reveals where the database and snapshots live. To clear Install History, turn it off in Settings → Privacy and choose Clear History. To remove all of Installory's local data, quit the app, delete it, and delete its container folder ~/Library/Containers/app.installory.mac; on macOS, moving an app to the Trash does not always remove its container.
Installory never installs, removes or changes software, never edits your AI tools' settings, and never runs commands. When you ask for cleanup, it generates a script for you to review and run yourself in Terminal.
When you choose an export or save action, Installory writes only to the location you select in the macOS save dialog. Exported inventories, reports and generated scripts remain on your Mac unless you choose to share them.
This website counts page visits with Umami, an open-source analytics tool self-hosted by the developer. It sets no cookies, does not track you across sites, and records only the page, referrer, browser, device type and approximate country; your IP address is not stored. The site has no advertising and loads nothing from other companies' servers. If you submit the support form, your name, email address and message are sent to Netlify, the form processor and website host, and delivered to the developer so the request can be answered. The data is not sold or used for advertising. Form submissions and related support correspondence may be retained for up to 12 months, then deleted unless an active issue or legal obligation requires longer. You can ask for earlier deletion by emailing will.ricchiuti@gmail.com.
For privacy or support questions, email will.ricchiuti@gmail.com or open an issue at github.com/william-ricchiuti/Installory.