Unfiled
What Unfiled stores
Everything below lives on your Mac, in your user account, inside ~/Library/Application Support/Unfiled.
| What | Where | Leaves the Mac? |
|---|---|---|
| Tab contents and titles | Local SQLite database | Never |
| Tab order, active tab, caret and scroll position | Local SQLite database | Never |
| Pins, groups and their collapsed state | Local SQLite database | Never |
| Revision snapshots | Local SQLite database | Never |
| Custom action definitions | Local preferences | Never |
| Appearance, font size, editor settings | Local preferences | Never |
| Paths of files you opened or saved | Local preferences, so a tab can find its file again | Never |
The database is an ordinary file
It is covered by Time Machine and any other backup you already run, and you can copy it to another Mac. It is protected by macOS file permissions and by FileVault if you have that enabled; Unfiled does not add a second layer of encryption on top.
What is never recorded, anywhere
Unfiled writes diagnostic entries for its own operations — which action ran, whether it succeeded, and what category of error occurred if it did not. Those entries are constrained by design so that the following can never appear in them:
- The contents of a tab, in whole or in part
- Selected text, or the text an action was applied to
- JSON, XML, YAML, CSV or log content
- URLs, query strings or their parameters
- JWT headers, payloads, claims or signatures
- Base64 input or output
- File paths and file contents
- Search queries and replacement strings
This is not a redaction pass applied after the fact. The logging layer accepts identifiers and categories, not free text, so there is no route by which your content could reach it.
Everything is processed locally
Every tool in Unfiled runs in-process on your Mac. There is no server-side component to any of them, and none of them is a wrapper around a web service.
JWTs in particular
A token you paste is split and decoded in memory on your machine. It is not sent anywhere to be inspected, and its signature is never verified — doing so would require the signing key, which Unfiled does not have and will never ask you for.
Network access
Unfiled ships sandboxed, and reaches the network for exactly one thing: activating and checking a Pro license. Nothing else in the application can open a connection.
- Your content is never part of it. A license request carries your license key, an identifier this app generated for this installation, and your Mac's model — "MacBook Pro", not its name. It cannot carry anything else: the code refuses any other field before the request is built.
- The identifier is a random value Unfiled made up. It is not your Mac's serial number, hardware ID, MAC address, user name or host name, and it identifies this copy of Unfiled rather than you.
- That request goes to the license service and nowhere else. The address is fixed in the app; it is not something a request can choose.
- No analytics or crash-reporting service is embedded.
- No fonts, stylesheets or scripts are fetched at runtime — the interface is native.
- Opening a URL you clicked hands it to your default browser; Unfiled does not fetch it.
- Everything except license activation works exactly the same with the network turned off, and an activated copy keeps working offline.
Your control
- Export anything, any time. Every tab is plain text; ⌘S writes it wherever you like, in any tier.
- Delete a tab and its content and revision snapshots are removed from the database.
- Delete everything by removing ~/Library/Application Support/Unfiled. Nothing about you survives elsewhere, because nothing about you exists elsewhere.
- Turn revision history off in Settings if you would rather no older versions were kept at all.
This website
Different surface, same principle. This site is static HTML and CSS served from a CDN. It sets no cookies, embeds no third-party scripts, loads no third-party fonts, and runs no analytics or advertising code.
The host that serves these pages keeps ordinary, short-lived request logs — IP address, timestamp, requested path, user agent — as any web server does. We do not build profiles from them and they are not joined to anything else.
Questions
If something here is unclear, or you think you have found behaviour that contradicts it, we would genuinely like to know: privacy@unfiled.app. Unfiled's source is on GitHub if you would rather check than take our word for it.