Safety and privacy

Utilities touch your files. Here is how ours behave.

Utilities that handle your files get close to things you care about. CozyMacApps is built by a security researcher, and these are the rules every app follows.

What we never do

No archive uploads for licensing. The licence service does not need your archive contents.
Clear email use. A free personal licence requires a verified email. Essential licence emails and optional news are separate.
No uploads. Your files are read on your Mac and stay there.
No scare tactics. No fake warnings, no countdowns, no "your Mac is at risk".

Licensing and automation

CozyZip contacts its licence service for activation and checks, and its update service for updates. Archive processing remains local. Read what information the licence service uses.

The command-line tool and local MCP server run with the invoking user's filesystem permissions. Inspection-only MCP restricts available tools; it is not a directory sandbox. A project configuration does not isolate files to that project. Enable write tools deliberately and review the intended destination and risk findings.

What we always do

Show before acting. You see what will be extracted or removed, with a plain explanation, before anything happens.
Ask for narrow access. Apps request the folders they need and explain why when macOS asks for permission.
Prefer reversible actions. Where something is removed, it goes to the Trash rather than being deleted outright.
Describe ourselves accurately. None of our apps is an antivirus, and none claims to be.

App by app

CozyZip

Processes archives locally. Licence activation, checks and updates use online services.
The Terminal tool and local MCP server use the invoking user's filesystem permissions; they are not directory sandboxes.
Never extracts path traversal entries or symlinks. This cannot be switched off.
Flags scripts, executables and misleading extensions before you extract.
Extracts to a staging area first, then moves files into place.
Passes archive passwords to its helper tools privately, never on the command line where other processes could read them.

This website

The site is static and sets no advertising cookies. Licence registration and purchases use separate services. The CozyZip page also loads a TryMacApps badge. See our privacy information for email, hosting and third-party requests.

Report a security issue

If you find a vulnerability in one of our apps, email support@cozymacapps.com. Please include steps to reproduce. We read every report.