Netlink Privacy Policy

1. How we read Apple's privacy disclosure requirements

Apple requires developers to accurately disclose, in App Store Connect, the data actually collected, used, and transmitted by the app and any third-party services, and to keep the privacy policy, the App Privacy label, and the app's behavior consistent. Accordingly, this document explains what information Netlink, as a local tool, processes on your device, which third-party services it may reach during inspection, and how to interpret results under restricted or weak network conditions.

2. What this app never does

• Apart from support emails you choose to send us (see Section 13), we do not collect, receive, store, or analyze your personal information.
• No account registration or sign-in is required.
• We do not upload your inspection results to any developer-operated server.
• We do not sell user data.
• We do not use data for advertising, ad attribution, or cross-app tracking.
• We do not request or read Location (Core Location) permission, nor direct users to grant it in System Settings › Privacy & Security › Location Services.
• We do not read Contacts, Photos, Camera, Microphone, Calendar, Bluetooth, or other system privacy data.
• We do not read preferences of other apps such as Safari; related items only prompt you to check manually.

3. Information processed on your device

To complete a network environment inspection, Netlink reads, computes, and displays the following information locally on your Mac. It is used by the app on-device only; we do not collect or upload it:

• Network information: local LAN IP, DNS servers, IPv6 availability, system proxy configuration (HTTP/HTTPS/SOCKS/PAC status and targets), network interface type, and network change events.
• Public exit information: public IP, country or region, city, ISP, organization, time zone, proxy/VPN/datacenter flags, and IP consistency results from the two routes.
• Reputation check results: the outcome of matching against the VPN, data-center and Tor exit lists (all from the offline lists bundled with the app), and lookup error messages.
• DNS chain probe results: the A-record address obtained by resolving the fixed domain www.apple.com through your system DNS, the conclusion drawn on your Mac from it (whether it falls in 198.18.0.0/15, meaning local proxy takeover, or in a private or other special address range), the system DNS server that was queried and the check time, plus the PTR hostname obtained by a reverse lookup of your public exit IP (shown on the reputation page). These results stay on your Mac.
• Path and destination samples: reachability and handshake time (TCP + TLS) of the 6 built-in destination sites, gateway round-trip and DNS resolve-time samples, the exit IP taken across several samples (used to judge whether the exit is stable), and the captive-portal verdict. These results are stored on your Mac together with the inspection snapshot and are never uploaded.
• System environment: system time, time zone, language and region, IPv6 hints.
• Hardware overview: CPU model, memory size, GPU name, display vendor/model/serial info, device serial number, network interface MAC addresses.
• Network profiles: an on-device fingerprint computed from your LAN subnet hint, interface type, and DNS list (no Wi-Fi name/SSID, no Location) used to recognize "the same network environment" and record first/last seen times.
• Custom skin image: a background image you explicitly pick in Settings is downscaled and stored in the app's local data folder, used only to draw the window background and never uploaded; you can remove it in Settings at any time.
• Network event timeline: local records of factual changes -- public IP, LAN, DNS, and time-zone mismatch events.
• Connection diagnosis results: connection timing breakdown (DNS/TCP/TLS/TTFB), direct-vs-system-proxy comparison, speed test and multi-location probe results -- produced and shown only when you actively run those checks.
• Tools page results: the input and results of the DNS record lookup, TCP ping, port check, HTTP headers and redirect chain, ASN and registration info, proxy PAC test, certificate check (except the domains you add to the certificate monitor and their latest results, see Section 4), outage check and IPv6 dual-stack tools are produced only when you run them and are kept in memory for the current run (they survive switching pages, and disappear when you quit the app) -- never written to disk and never uploaded. The hosts file viewer only reads and displays the contents of your local /etc/hosts and does not go online. The utilities (subnet / CIDR calculator, QR code, URL / Punycode, timestamp, MAC address parser) all compute on your Mac without going online; the Wi-Fi name and password you type into the QR code tool are used in memory only to draw the pattern and are not written to the app's data.
• Comparison summary: to support "Compare two inspections", each smart inspection stores a small summary alongside the score history (network access type, number of system DNS servers, (in older records) the country of the DNS resolver, gateway round-trip time, system proxy types, and how many common sites were reachable out of the total). It contains no IP addresses and no DNS server addresses, and stays on your Mac.
• Live traffic: while the menu bar Status Panel is open, the app reads the cumulative bytes sent and received on your current primary network interface once per second (the network interface statistics provided by the system), and derives upload / download rates from the difference between two readings and the interval measured with the system uptime, shown only in the panel. Reading stops as soon as the panel closes. The same readings are taken during a speed test to drive the gauge live; computed on your Mac only, never stored or uploaded, and no network request is made for them.
• App settings: menu bar preferences, notification preferences, menu bar click behavior, floating widget options (style, animated character and its name, animation level) and alert-rule switches, etc.

The hardware and system information above is used only to show your current device environment in the app UI and is stored locally. Hardware identifiers -- including the device serial number, network interface MAC addresses, and display serial info -- never leave your device, are never sent to any third-party service, and are never used for user identification, device fingerprinting, or tracking of any kind. The device serial number and MAC addresses are shown masked in the app by default until you choose to reveal them; report exports and diagnostics exports never include the device serial number, MAC addresses, or display serial info.

Data bundled with the app: the country and operator (AS name) of a public IP, VPN / data-center / Tor exit flags, the location of each hop in a path trace, and the time zones that belong to an exit country all come from data files installed with the app and are looked up on your Mac, with no network request and without sending your IP to any service. The data comes from DB-IP (the DB-IP Lite databases, licensed CC BY 4.0), the X4BNet VPN and data-center lists (MIT license, expanded with public-domain iptoasn data), supplementary data-center and VPN ASN tables maintained by the developer (based on public registrations at the regional internet registries, bundled with the app), the Tor exit list published by the Tor Project (CC0, IPv4 only) and data published by IANA (the time zone mapping is public domain, the RDAP bootstrap tables are CC0); credits and the full license text are under Settings › About. These lists are updated with app versions and may lag behind; not being listed does not mean there is no risk. On macOS 26 and later, city-level location data is delivered as an Apple-hosted asset pack that the system downloads in the background; while it downloads or when it is unavailable, the Public IP page shows "City data downloading / unavailable", and on macOS 14 / 15 locations stop at country level.

4. Information stored on your device

Netlink stores necessary app state locally so the most recent inspection can be restored on next launch:

• The latest inspection snapshot, including public, network, system, hardware, and score results.
• IP history, score history, the network event timeline, and network profiles.
• User preferences, stored via macOS UserDefaults or the app's Application Support directory, including the list of sites you add on the Connectivity page and your confirmation for "Probe my exit IP" in multi-location probing.
• The last verdicts and change history of scheduled AI service probing (at most the latest 100 entries).
• Certificate monitor (Pro): the list of domains you add (up to 20) and the latest check result for each (issuer name, certificate expiry time, check time). Certificate expiry reminders (including the domain name) are also written to the network event timeline.
• Speed test history (Pro): the time, tier, download / upload speed, latency, network access type, exit network number (ASN) and the line baseline speed at that time of each speed test, without IP addresses.
• Line baseline records (kept in both Free and Pro): each time a speed test produces a download speed, the app records the time, exit network number (ASN), download speed, test method and tier. They stay only on your Mac for the last 30 days (at most 500 records) and are used to compare against this line's usual level; they contain no IP address or operator name, are not uploaded and are not part of iCloud sync.
• Desktop widget "dashboard" tier (Pro): see the desktop widget snapshot item below.
• API keys you enter yourself (OpenAI, Anthropic and Google Gemini in the AI service check; no key is used for xAI): stored in the Keychain on this Mac, not synced to iCloud, and never written to app settings, inspection history, exported reports or feedback (diagnostics record only whether a key is configured). A key is sent only to the service it belongs to (see Section 5), never to the developer. You can delete a key in the app at any time: the AI service keys on the AI check page; "Reset All Settings" clears these keys as well, while "Clear inspection traces" does not. After you delete the app, Keychain items may remain; to remove them completely, delete the keys in the app first, or delete them manually in Keychain Access. Earlier versions let you enter a proxycheck.io key; that feature has been removed, and on launch after the update the app tries to delete the one proxycheck.io key it had previously written to the Keychain (only the item written by this app, nothing belonging to other apps); if deletion fails (for example the Keychain is locked), delete it manually in Keychain Access.
• Usage records of the free runs for each diagnostic and network tool (mostly "one free run per day", and "3 free runs in total" for the two-inspection comparison; today's use count, cumulative use count, and the time of the most recent record; "IPv6 dual stack" (record name freeRun.ipv6DualStack) and the "exit and config self-check" (freeRun.exitSelfCheck) are each recorded separately: an IPv6 dual-stack run counts once when it reaches a conclusion (both stacks consistent, exits differ, or no IPv6), and does not count when the probe fails, is inconclusive or is stopped; a self-check counts once when it obtains the UDP exit, and does not count when DNS resolution fails, there is no response, it fails otherwise or it is cancelled), plus a time-calibration record used to prevent these records from being tampered with.
• In-app purchase unlock state, and the free-trial start time (only for users who started a trial before version 2.0.0; new installs no longer record it): the purchase itself is handled by Apple's StoreKit; the app only records the state locally and never uploads it.
• Desktop widget snapshot: so that the "Netlink Status" desktop widget can show your latest inspection, the app keeps a compact snapshot on your Mac in an App Group shared container that it shares with the widget, containing the security score and grade, a one-line verdict, the exit country or region, the network access type (such as Wi-Fi or wired), up to 3 status tags (route consistency, reputation, and whether a proxy / VPN was detected), the last inspection time, and the interface language. The snapshot contains no IP addresses, nor any city, ISP, or hardware identifiers; the widget only reads this snapshot, and never goes online or writes any file itself. The widget's "Inspect" button is run by the system inside the main Netlink app, so the widget itself still never goes online. If you have purchased Pro and use the "Netlink Dashboard" widget, the snapshot also holds a dashboard section: score trend points from the last 30 days (at most one per 12 hours), the difference between the latest score and the previous one, the gateway round-trip time, the type and time of the latest network event, and a Pro entitlement marker signed by the main app; it likewise contains no IP addresses.

This data lives on your Mac (with iCloud sync on, the score history, IP history and environment profiles also have a copy in your own iCloud private database). Uninstalling the app or manually clearing its data may remove these local records. You can also use "Clear Inspection Traces" in Settings › Privacy at any time to delete the inspection snapshot, IP history, score history, event timeline, environment profiles, the change history of scheduled AI service probing, per-stage timing statistics for the last 10 inspections, the desktop widget snapshot, the speed test history, the line baseline records and the certificate check results, and to clear the Pro probe results of the current session and the in-memory caches (the certificate monitor's domain list, app settings and purchase state are unaffected). When iCloud sync (Pro) is on, you can also tick "Also delete data in iCloud" to delete the score history, IP history and environment profiles in iCloud as well; records already synced on your other Macs are cleared too, and ones not yet uploaded are kept.

iCloud sync (optional, Pro, off by default): it is enabled only if you have purchased Pro and turn it on yourself in Settings › Privacy › iCloud Sync. When on, the score history and IP history (including inspection time, exit IP, IP version, country / city, carrier, proxy / VPN flags, deduction codes and an inspection summary: network access type, DNS server count, gateway latency, system proxy types, reachable-site count) and environment profiles (LAN segment, network access type, DNS servers, latest exit IP, exit country and score, first / last inspection time and count) are stored in your own iCloud private database and synced between Macs signed in to the same Apple Account; the content of each record is encrypted on your device by Apple's CloudKit before upload, so the developer cannot access it. Record names do not contain plain-text IP addresses. Each record carries a random install identifier (no device name or hardware information) so that the app can tell which Mac it came from. Sync uses your own iCloud storage. Settings, the desktop widget snapshot and purchase state are not part of this sync. Turning sync off does not delete the records already in iCloud; you can tick "Also delete data in iCloud" when you use "Clear Inspection Traces" to delete them (records already synced on your other Macs are cleared too, and ones not yet uploaded are kept), or delete this app's iCloud data under System Settings › your name at the top of the sidebar › iCloud › Manage. When Netlink finds that its cloud data has been deleted, it turns sync off automatically and your records on this Mac are unaffected.

The free-run usage records for each diagnostic and network tool, the time-calibration record used to help prevent those records from being tampered with, the cached purchase-unlock state (local only, never uploaded; used to show the purchased state sooner at launch), and the signing key used to verify them, are additionally stored in the local macOS Keychain; after uninstalling the app, these Keychain entries may still remain; to have the Keychain entries removed, contact support@netlink.jeman.net.

Since version 2.2.0, the counts and dates in the free-run usage records above are also kept in your own iCloud key-value store, so that they stay consistent across reinstalls and multiple Macs; the developer cannot access them. This copy is not removed by uninstalling the app or by "Clear Inspection Traces", and the developer cannot delete it on your behalf.

The desktop widget snapshot is stored in the shared container ~/Library/Group Containers/L59DPZ37AM.com.netlink.app/; "Clear Inspection Traces" deletes it as well, and the widget returns to its "No inspection yet" state. macOS may keep this shared container and the app's data folder after you move the app to the Trash; to remove them completely, quit Netlink, choose Go › Go to Folder in Finder, open ~/Library/Group Containers/ and ~/Library/Containers/, and delete the L59DPZ37AM.com.netlink.app folder in the former and Netlink's folders in the latter (actually named com.netlink.app and, for the widget, com.netlink.app.widget; Finder may show them by the app's name, such as "Netlink" or "网连").

Report export (PDF / Markdown / JSON / CSV / share-card PNG) is generated entirely on your device, and you choose the save location in the system save panel. Exporting makes no network requests, and exported content is never uploaded to the developer or any third party.

"Export Diagnostics" in Settings is likewise generated entirely on your device: it contains the app version, macOS version, a summary of your current settings, and a redacted copy of the last inspection (IP addresses partially masked), saved as a text file to a location you choose. It is written only when you explicitly export it and is never uploaded. Diagnostics exports also include per-stage timing statistics for the last 10 inspections (no IP addresses included), stored locally and cleared together when you use "Clear Inspection Traces".

5. Third-party network services

Netlink itself collects nothing and sends nothing to developer servers. Some inspection features require your device to contact third-party services directly to determine the public exit, IP geolocation, proxy/VPN flags, risk, and connectivity. When these services are contacted, your public IP address and ordinary request metadata are received by the respective third party -- this is inherent to performing a live lookup. Except for the cases listed under "Automatic network activity" at the end of this section, the requests below happen only when you start a check yourself.

Third parties that receive data

In accordance with Article 23 of the Personal Information Protection Law of the People's Republic of China, we tell you, for each recipient, its name, contact details, purpose of processing, method of processing and the types of personal information, and we obtain your separate consent before you first use any online inspection (see Section 10, "Consent and withdrawal"). Netlink has no servers of its own; your device sends the data directly to these third parties and the developer neither handles nor receives it. How a third party treats the requests it receives is governed by its own privacy policy and terms. The date after each privacy contact is when we last opened its official page to check it.

• Cloudflare, Inc. (www.cloudflare.com)
  Privacy contact: privacyquestions@cloudflare.com (checked 2026-10-02)
  Purpose: to determine the public exit, captive portals, resolution consistency and exit consistency, to confirm which region your exit is in when you use the AI check's key mode, and for connectivity handshake checks.
  Handling: sent directly from your device; the 1.1.1.1 connectivity check is a TCP + TLS handshake only.
  Personal information: your public IP (source IP); the domain you enter in domain diagnosis and the DNS record tool (encrypted DNS); exit IP and port (STUN); the host name accessed.
  When sent: full inspection, background polling and re-inspection after a network change, and when you use the matching tool. Specifically: public exit lookup, captive-portal detection (plain HTTP), exit-stability sampling, IPv6 dual stack, "Direct vs proxy", the exit-network confirmation during the upload phase of a bandwidth speed test (sent in both Free and Pro, a request to one.one.one.one, plus one retry without the IPv4 restriction when there is no IPv4 path), and, when you have saved an OpenAI, Anthropic or Gemini API key on the AI Check page, the exit-region check made once at the start of each run-all test. These all request /cdn-cgi/trace on one.one.one.one and 1.1.1.1 (including its IPv6 address); encrypted DNS uses cloudflare-dns.com; the exit and configuration self-check sends a UDP request to stun.cloudflare.com.
• Google LLC (Google Public DNS, ai.google.dev)
  Privacy contact: support.google.com/policies?p=privpol_privts (checked 2026-10-02)
  Purpose: encrypted DNS resolution, connectivity checks and the AI service availability check.
  Handling: sent directly from your device; connectivity and AI service checks are a TCP + TLS handshake only by default; an official call carrying your key is sent only if you enter a Gemini key and the exit found at the start of the run is inside its published supported regions.
  Personal information: the domain you enter (dns.google); your source IP; the host names accessed (www.google.com, gemini.google.com, generativelanguage.googleapis.com); the Gemini API key you enter yourself (only after you enter it).
  When sent: full inspection, when you use domain diagnosis and the DNS record tool, when you use the Connectivity and AI pages, scheduled AI probing and the recheck after an exit change (handshake only), and round 1 of a run-all test after you enter a key (and only if the exit is inside the supported regions).
• RIPE NCC (www.ripe.net)
  Privacy contact: ncc@ripe.net (checked 2026-10-02)
  Purpose: to show registration details of an IP or AS number.
  Handling: sent directly from your device to its RDAP service (rdap.db.ripe.net).
  Personal information: your source IP; the IP or AS number you enter, when managed by RIPE NCC.
  When sent: only when you tap look up in the ASN and registration tool.
• Globalping (globalping.io, api.globalping.io, developed by the jsDelivr team)
  Privacy contact: legal@globalping.io (section 12 "Contact Us" of its privacy policy, checked 2026-10-03)
  Purpose: to probe the target you specify from multiple locations.
  Handling: sent directly from your device; measurement data is public.
  Personal information: your source IP; the probe target you enter in multi-location probing, path trace, global DNS / HTTP and the outage check.
  When sent: only when you start one of these probes.
• OpenAI (openai.com, api.openai.com, chatgpt.com)
  Privacy contact: dsar@openai.com (its privacy policy, checked 2026-10-03)
  Purpose: the AI service availability check and connectivity checks.
  Handling: sent directly from your device; by default a TCP + TLS handshake only, with no HTTP / API request; only if you have entered an OpenAI API key and the exit found at the start of the run is inside its published supported regions is one "list models" request, carrying your key, sent to its official endpoint in round 1 of a run-all test.
  Personal information: your source IP; the host name accessed (SNI); the API key you enter yourself (only after you enter it).
  When sent: full inspection, scheduled AI probing and the recheck after an exit change (handshake only, never reads a key), and when you use the Connectivity and AI pages.
• Anthropic (www.anthropic.com, api.anthropic.com; Anthropic PBC outside Europe)
  Privacy contact: privacy@anthropic.com (checked 2026-10-02)
  Purpose: the AI service availability check.
  Handling: same as OpenAI: handshake only by default; one "list models" request carrying your key is sent in round 1 of a run-all test only if you entered a key and the exit found at the start of the run is inside its published supported regions.
  Personal information: your source IP; the host name accessed (SNI); the API key you enter yourself (only after you enter it).
  When sent: when you run a check yourself on the AI Check page, after you turn on scheduled probing there, and after you turn on the recheck after an exit change in Settings › Alerts (the last two handshake only); a smart inspection does not contact them.
• SpaceXAI LLC (xAI) (x.ai, api.x.ai)
  Privacy contact: x.ai/privacy-portal (section 12 of its privacy policy, checked 2026-10-03)
  Purpose: the AI service availability check.
  Handling: a TCP + TLS handshake only, with no HTTP / API request (xAI does not publish a list of supported API regions, so the app does not use an xAI key).
  Personal information: your source IP; the host name accessed (SNI).
  When sent: when you run a check yourself on the AI Check page, after you turn on scheduled probing there, and after you turn on the recheck after an exit change in Settings › Alerts (the last two handshake only); a smart inspection does not contact them.
• GitHub, Inc. (github.com; GitHub B.V. in Europe)
  Privacy contact: privacy@github.com (written as privacy[at]github[dot]com on its official page; checked 2026-10-02)
  Purpose: a built-in site for connectivity checks.
  Handling: sent directly from your device; a TCP + TLS handshake only, with no HTTP request.
  Personal information: your source IP; the host name accessed.
  When sent: full inspection, and when you use the Connectivity page.
• Wikimedia Foundation (www.wikipedia.org)
  Privacy contact: privacy@wikimedia.org (checked 2026-10-02)
  Purpose: a built-in site for connectivity checks.
  Handling: sent directly from your device; a TCP + TLS handshake only, with no HTTP request.
  Personal information: your source IP; the host name accessed.
  When sent: full inspection, and when you use the Connectivity page.
• Apple Inc. (www.apple.com)
  Privacy contact: apple.com/legal/privacy/contact (checked 2026-10-02)
  Purpose: the bandwidth speed test; and, once you turn on iCloud sync, syncing history and profiles between your devices.
  Handling: the speed test runs macOS's built-in networkQuality tool, and your device sends test traffic directly to Apple's speed-test servers; iCloud sync stores records in your own private iCloud database, which the developer does not handle.
  Personal information: your source IP (speed test); synced history records and profiles (only after you turn on iCloud sync, see Section 4).
  When sent: when you tap the speed test; after you turn on iCloud sync (a separate explanation and your consent come first). In-app purchase, the city-level location data asset pack download, free-run records (including their iCloud key-value sync) and the iCloud account-status check are handled by Apple's system services under Apple's privacy policy and are outside the consent above.

In addition, for the targets you enter or add (custom sites on the Connectivity page, domain diagnosis, the connection timing breakdown, TCP ping, port check, HTTP headers, etc.), Netlink sends requests to those targets themselves at your command; your system DNS server and operator also see the DNS queries your system sends. Details follow in the entries below.

• Public exit lookup (Cloudflare): used to get and corroborate your public exit IP. Netlink sends one HTTPS request to each of Cloudflare's two routes (/cdn-cgi/trace on one.one.one.one and on 1.1.1.1) and compares the two; the requests are plain HTTPS GETs containing no personal data, and Cloudflare sees your public IP. The country, operator and VPN / data-center flags of a public IP are no longer looked up online; they come from data bundled with the app (see "Data bundled with the app" below). The "IPv6 dual stack" check also queries the exit once each through 1.1.1.1, 2606:4700:4700::1111 and one.one.one.one, compared by country or region only and not counted in the security score; "Direct vs proxy" sends one request to the same interface on 1.1.1.1 directly and one through your system proxy, to compare the two exits. During the upload phase of a bandwidth speed test, Netlink also sends one request to /cdn-cgi/trace on one.one.one.one, only to confirm which network (autonomous system number, ASN, taken from the data bundled with the app) this test exited through, for the "line level" comparison on the speed test page; this request also contains no personal data, and Cloudflare sees your public IP. The app also reads the server time in these responses to correct how the local clock is used for the free-use limits, without sending any extra request. In key mode, the AI check also asks the same interface once at the start of a run which country your exit is in; see "AI service availability check endpoints" below.
• Connectivity targets: 6 built-in popular websites and online services (chatgpt.com, gemini.google.com, www.google.com, github.com, www.wikipedia.org and Cloudflare's 1.1.1.1). Netlink makes only a TCP + TLS handshake to these sites and sends no HTTP request, so "reachable" only means the connection layer works and the latency is the total time to establish the connection; the other side sees the host name and your source IP. Besides the Connectivity page, where you start the check yourself, the "destinations" stage of every full smart inspection also handshakes these sites one by one (3-second timeout per site). During the handshake the system validates the certificate in its default way, which may make the system contact OCSP / CRL servers published by the certificate authority; Netlink itself sends no such requests.
• Sites you add yourself on the Connectivity page: only when you start a check on that page, a HEAD request is sent to the address you entered (one "Check all" tests each site in 3 consecutive rounds); a full smart inspection does not contact these sites. The site list is stored only in the app settings on your Mac.
• AI service availability check endpoints: OpenAI, Anthropic, Google (Gemini) and xAI (names and domains in the per-provider list above). By default the app makes only a TCP + TLS handshake, sends no HTTP / API request and uses no API key, and judges on your Mac from the handshake result whether it is "handshake OK", "certificate not trusted" or unreachable. xAI does not publish a list of supported API regions, so the app does not use an xAI key and only handshakes with it. Only if you have entered an API key for OpenAI, Anthropic or Google (Gemini) on the "AI check" page does a run-all test first ask Cloudflare which country your exit is in (one request each to /cdn-cgi/trace on one.one.one.one, 1.1.1.1 and 2606:4700:4700::1111, once per run, and only when a key for one of these three providers is saved); only if that exit is inside the provider's published supported regions is one "list models" request, carrying your key, sent to that provider's official endpoint in round 1 of the run-all test, and the status code and the public error-code features in the response body are used on your Mac to judge "key rejected" or "region restricted"; if the exit is outside those regions or cannot be confirmed, no key request is sent and only the handshake runs; the request does not follow redirects. Scheduled automatic probing only ever handshakes and never reads a key. Contacted only when you start a check or turn on scheduled probing.
• Bandwidth speed test: runs macOS's built-in networkQuality tool, and the test traffic goes to Apple's speed-test servers; Netlink sends data to no other speed-test service; during the upload phase there is a separate exit-network confirmation request to Cloudflare (usually one; one more when there is no IPv4 path), see "Public exit lookup (Cloudflare)" in this section. There are two tiers, "Quick" (about 20 seconds) and "Full" (about 45 to 60 seconds). Both measure download first and then upload, and they generate real download / upload traffic whose volume depends on your connection speed and can reach several hundred MB to several GB on a fast network; these requests reach Apple's servers, and how Apple handles them is governed by its own policies.
• Multi-location probing, global DNS / HTTP, path trace and outage check (the Globalping volunteer probe network, api.globalping.io): the probe target you enter (a domain, IP or URL) is first sent to Globalping and is then executed by third-party volunteer probe nodes in several regions: multi-location probing runs ping (16 packets per probe) or traceroute from up to 15 nodes -- 3 in each of five regions: Europe, North America, Asia, Oceania and South America; global DNS queries A records only, and global HTTP sends HEAD requests only and downloads no body (the full URL you enter, including its path and query string, is sent to these nodes, so please do not put tokens or other sensitive query parameters in the URL you test); path trace (mtr) sends 3 packets per hop, and the location shown for each hop's router address (the country, plus the city when city data is available) comes from data bundled with the app and is no longer looked up anywhere; when the first five local steps of the outage check cannot find the cause, it also sends the URL you enter (a HEAD request) to Globalping. Under Globalping's terms of use, measurement data is public -- the probe target you submit and the results measured may be seen by others, so do not put credentials or sensitive information into a probe target. If you choose to probe your own public IP, that IP is sent to Globalping and these third-party volunteer nodes -- the app shows a one-time confirmation before you first use that option. According to its public API documentation, measurements are typically kept for up to about six months; anything else is governed by Globalping's own policies. Requests to it carry the app name, version and website in the User-Agent header (Netlink/version (+https://netlink.jeman.net)). These requests use a non-persistent session.
• Public encrypted DNS services (domain diagnosis, DNS record tool): two providers, Cloudflare (cloudflare-dns.com) and Google Public DNS (dns.google). What is sent is the domain you enter, used to compare resolution across resolvers and against the result of your system DNS. One domain diagnosis lasts about 45-75 seconds at random, with several rounds of repeated queries to compare results: every round queries these two providers and fetches the target's TLS certificate chain again (with a 3-6 second pause between rounds).
• DNS record lookup (Tools page): the domain you enter and the record types you pick (A / AAAA / CNAME / MX / NS / TXT) are sent through the resolver you choose: with "System DNS", over plain UDP port 53 to the first entry of your system DNS list (not through the system's encrypted DNS profile); with a public encrypted DNS service (Cloudflare or Google), over HTTPS to that service (see the per-provider list in this section). Each record type is queried once. The requests use a non-persistent session, so the query does not land in the system's on-disk URL cache.
• TCP ping and port check (Tools page): at your command, the app connects directly from your Mac (not through the system proxy) to the host and ports you enter, only timing the TCP handshake or checking whether a port is reachable; the connection is closed immediately and no application data is sent. A port check covers at most 16 ports. If the target is an address on your local network, the system's Local Network permission prompt appears.
• HTTP headers and redirect chain, and proxy PAC test (Tools page): the HTTP tool visits the URL you enter with the scheme you give (plain http is allowed) and, like a browser, follows your system proxy settings: when a proxy is on, the request goes out through the proxy server you configured; with an automatic proxy configuration (PAC), the app reads the configuration file from the PAC address you set (up to 1 MB). The proxy PAC test evaluates that script on your Mac only, to show which proxy would be used for the URLs you enter; those URLs are not sent anywhere, and if the script calls functions such as dnsResolve(), they are run by the system's own PAC engine and may cause a DNS lookup of the host name being tested.
• ASN and registration info (Tools page):
  • The AS name, country and network range of the IP or AS number you look up come from data bundled with the app and need no network request; the tool no longer looks up domains.
  • Which regional internet registry manages a number is decided on your Mac from the IANA bootstrap table bundled with the app, which is not refreshed online. Only an IP or AS number managed by RIPE NCC is sent, when you tap look up, to RIPE NCC's RDAP service (rdap.db.ripe.net) to read its registration details; for numbers managed by other registries the app shows only the offline result and names the registry, sends no request to it, and offers no link.
  • The request uses a non-persistent session, so the queried object and response do not land in the system's on-disk URL cache; each response is capped at 1 MB and a whole lookup at about 20 seconds.
• Certificate check and certificate monitor: when you tap "Check all", or when you turn on scheduled certificate checks (Pro, off by default; once a day after 9:00 local time while the app is running), the app sends one HEAD request to the domains you added yourself (https://<domain>/), reads only the certificate chain from the handshake, does not follow redirects, and uses a non-persistent session; reminders are raised 30 / 14 / 7 days before expiry and on expiry, and also when a domain's certificate could not be fetched in 3 scheduled checks in a row. The domain list and results stay on your Mac only (see Section 4). The "Certificate details" of domain diagnosis likewise reads the certificate from the handshake on your Mac (issuer, validity, SANs, chain, number of embedded SCTs) and no longer sends your domain to any certificate transparency log lookup service. During the handshake the system validates the certificate in its default way, which may make the system contact the OCSP / CRL / AIA servers published by the certificate authority; apart from this system validation, Netlink connects only to the target domain you entered.
• Exit and configuration self-check (Tools page): the app goes online only when you tap "Start check": it sends one STUN Binding request (resent up to 3 times if a packet is lost) to Cloudflare's STUN server (stun.cloudflare.com, UDP port 3478); Cloudflare sees your exit IP and port, which Netlink compares with the exit seen over HTTP; the local configuration review (system proxy, DNS, IPv6, etc.) makes no network request. This check opens no third-party leak-test website, and its result does not mean there is no leak.
• Internal targets in domain diagnosis are not sent out: if you enter a private, loopback, link-local or carrier-grade NAT (100.64.0.0/10) IP address, or a domain ending in .local, .lan, .internal, .home, .corp, .intranet, .test, .invalid or .localhost, that target is not sent to the public encrypted DNS services above and only the target itself gets the port and certificate checks. Other internal naming outside this list (for example .home.arpa or an internal suffix you define yourself) is still treated as a public domain.
• Captive-portal detection (Cloudflare): Netlink sends one fixed plain-HTTP request to Cloudflare's 1.1.1.1 (http://1.1.1.1/cdn-cgi/trace, containing no personal data) and judges from the response whether the current network has a captive login portal; the request does not follow redirects. This request is plain HTTP, so network equipment on the path can see it. When a portal is suspected, the app only prompts you to finish signing in in the system's login window or your browser, and can re-check automatically a little later; it does not open a browser for you and no longer requests Apple's captive-network probe page.
• Resolve-time sampling: during the "local" stage of a full inspection the app queries one fixed, well-known public domain name (www.apple.com) up to 5 times through its own DNS client over plain UDP port 53, to the first DNS server configured on your system, solely to measure how fast your system resolver answers (bypassing the local cache); only this fixed domain name is sent, no personal data. These are plain DNS packets sent directly by the app and do not go through any encrypted DNS (DoH / DoT) profile configured on your system.
• Reverse DNS (PTR) lookup: during the "reputation" stage of a full inspection, your public exit IP is reversed into an in-addr.arpa / ip6.arpa query name and sent through the system resolver (getnameinfo) to the DNS server configured on your system, to look up that IP's PTR hostname as a reputation signal (for example, whether the exit belongs to a hosting provider or a consumer ISP line). The query name itself contains your public exit IP and is therefore visible to whichever DNS server resolves it (your carrier, or a third-party DNS you configured yourself); the result (the hostname) is only shown and stored on your Mac and is never uploaded.

Automatic network activity: besides checks you start yourself, while Netlink is running it goes online automatically in the following cases, using only the services listed above:

• After you have agreed to where your data goes and run at least one inspection, and while the menu bar icon or the desktop floating widget is on (the menu bar icon is on by default), the app queries the current public IP only through Cloudflare's domain route (one.one.one.one) at the "public IP polling interval" (default 5 minutes; 1 / 5 / 15 / 30 minutes selectable); if the IP has not changed that is all, and only when the IP changes does the app fetch the public info in full (the two Cloudflare routes; location, operator and list flags come from data bundled with the app). When the domain route fails, or only a degraded result is obtained, the app keeps the known IP and sends no "exit changed" notification. Polling pauses automatically when both are off and no Netlink desktop widget is placed on the desktop.
• After you have agreed to where your data goes and run at least one inspection, and while "Re-inspect on Network Change" is on (the default), the app automatically fetches the public exit info again from Cloudflare's two routes after a network or DNS configuration change (including the first time it reads the network state after each launch).
• When "Inspect at Launch" is on (off by default), a full smart inspection runs once, the first time the main window opens after each launch.
• When scheduled AI probing is on (Pro, off by default), every 30 minutes the app makes a TCP + TLS handshake to each of OpenAI, Anthropic, Google (Gemini) and xAI; scheduled probing only handshakes, sends no HTTP / API request and never reads the API keys you entered.
• When the AI service recheck after an exit change is on (Pro, off by default), once the public exit has changed and settled, the app makes one round of TCP + TLS handshakes to the same four providers; it likewise only handshakes and never reads your API keys, and rapid repeated changes are combined rather than each starting a recheck.
• When scheduled certificate checks are on (Pro, off by default), once a day after 9:00 local time while the app is running, the app sends one certificate check request to each domain you added (see "Certificate check and certificate monitor" above); it runs within about half an hour of the due time, and retries half an hour later if no certificate could be fetched at all (usually because you are offline).
• On macOS 26 and later, after launch the app reads city-level location data in the background; if the data is not ready yet, the system downloads the asset pack hosted by Apple for the app, and retries at the next launch if that fails. macOS 14 / 15 skip this step.

See Section 10 for how to turn these off.

In addition, the connection timing breakdown and domain diagnosis (port reachability, TLS certificate chain) send network requests, at your command, directly to the URL or domain you enter; the target server therefore receives an ordinary network request from your device. Please use these features only against targets you are entitled to test.

With a system proxy on: requests that Netlink sends over HTTP / HTTPS -- including "HTTP headers and redirect chain", "IPv6 dual stack" and "Certificate check" on the Tools page, ASN and registration lookups, multi-location probing, and the outage check's requests to the target URL -- follow your system proxy settings as a browser would, so the proxy server sees those requests; TCP ping, the port check, the exit self-check's STUN (UDP) request, reading the PAC configuration file, and the plain DNS queries made with "System DNS" do not go through a proxy and are sent directly from your Mac.

These services are operated by their respective providers. We do not receive or store your personal information from them; how they handle access logs, IP addresses, and request metadata is governed by their own privacy policies and terms.

External entry points: Netlink supports netlink:// links, Shortcuts (read latest result, start an inspection, open a page, diagnose a domain), the system Services menu, the Share menu and the Control Center control (macOS 26 or later). These entry points accept only a fixed whitelist of actions and parameters; the ones that diagnose a domain only fill the domain into the "Domain deep diagnosis" page and never start it automatically -- whether to start is up to you. "Netlink" in the Share menu is a system extension: it only extracts a domain from the URL or text you share and hands that domain to the main Netlink app through a netlink:// link; the extension itself has no network entitlement, does not go online or upload anything, and does not read or write the free-run counts or purchase state. A full inspection triggered from Shortcuts or an external link only opens the window, without re-running, if the last inspection from any source was too recent, and is limited to a number of times a day; the desktop widget's Inspect button and the Control Center control are tapped by you, and never start a second run while one is in progress.

6. Reachability under restricted or weak networks

Some third-party services and connectivity targets may be unreachable in certain regions due to local policy, routing, carrier behavior, or the services' own restrictions. Unreachable does not necessarily mean your local network is broken.

When a public or risk lookup fails, Netlink shows the failure reason. If a previous successful result exists on disk, the app may display it clearly labeled as the last successful result; it should not be read as a fresh successful inspection.

7. Purposes

Netlink processes the information above on-device only to:

• Show your current network and public exit environment.
• Identify possible proxy, VPN, Tor, datacenter, or DNS/IPv6 issues.
• Compute the local network environment score.
• Keep local history so you can review network changes.
• Drive the menu bar status, the menu bar Status Panel, desktop widgets, notifications, and app UI per your settings.

8. Data sharing

We do not collect, upload, or share your local inspection records. Provided you have agreed to where your data goes (see Section 10), when the app contacts third-party services, those services receive your public IP address and request metadata as part of the network request; the third parties that receive data are listed one by one in Section 5. The ASN and registration lookup on the Tools page sends only the IP or AS number you enter, and only when it is managed by RIPE NCC, to RIPE NCC; global DNS / HTTP, path trace and the outage check send the domain or URL you enter to the Globalping volunteer probe network, whose measurement data is public; an API key you enter yourself is sent only to the service it belongs to. All of these are queries you start or turn on yourself. Beyond that, Netlink never submits your hardware overview, history, or app settings to any third party.

9. Data security

Netlink runs inside the system sandbox with outbound-only network permission (no inbound listening). A full inspection measures how quickly your router (default gateway) and the DNS server configured on your local network respond, to check your local network connection; this triggers the system's Local Network permission prompt, which you can simply allow; when you enter an address on your local network in a tool (TCP ping, port check, HTTP headers and redirect chain, etc.) or in domain diagnosis, the app likewise connects only to the address you entered, which can also trigger this prompt. The public data endpoints the app contacts itself all use HTTPS, except that the exit self-check sends one unencrypted STUN (UDP) request to Cloudflare and captive-portal detection sends one fixed plain-HTTP request to Cloudflare's 1.1.1.1 (see Section 5; it contains no personal data); addresses you enter yourself (custom sites on the Connectivity page, the connection timing breakdown) are accessed with the scheme you give, defaulting to HTTPS when none is given. The DNS chain probe sends queries for the fixed name www.apple.com (one A and one AAAA query) over plain UDP port 53 to the DNS server configured on your system, as the DNS protocol itself does, plus up to 5 resolve-time-sampling queries, up to about 7 per full inspection; this part sends only fixed domain names, no personal data, but it does not go through the system's encrypted DNS profile. The reputation stage additionally issues one reverse DNS (PTR) lookup through the system resolver -- its query name is your public exit IP reversed, and therefore contains that IP -- likewise via the DNS server configured on your system, with the result used only on your Mac. The port reachability check in domain diagnosis makes TCP connection attempts to ports 80, 443, 22, 21, 25, and 8080 of the host you specify (once per round, in the first 3 rounds of a diagnosis only), solely to determine whether a port is reachable -- the connection is closed immediately after it is established, no application data is sent, and nothing personally identifiable is transmitted. Note that any internet request may be logged by the target service with access time, IP address, User-Agent, and other basic request information.

10. Your controls

• Online inspection requires your consent to where your data goes; without it only local information is shown (see "Consent and withdrawal" below). You can also choose not to run inspections: the speed test, multi-location probing, domain diagnosis, the connection timing breakdown and every network tool on the Tools page go online only when you actively start them (scheduled certificate checks have to be turned on by you). A full smart inspection reaches the public exit, destination and DNS probe services listed in Section 5 -- its "destinations" stage makes a TCP + TLS handshake to each built-in site and sends no HTTP request -- so turning off "Inspect at Launch" in Settings and not starting one manually avoids those requests.
• You can turn off the automatic requests listed under "Automatic network activity" in Section 5: turning off both "Show Icon in Menu Bar" and "Show Desktop Floating Widget" in Settings › Menu Bar, with no Netlink desktop widget added, pauses public IP polling; turning off "Re-inspect on Network Change" in Settings › General stops public info from being fetched after network changes; and leave scheduled AI probing and scheduled certificate checks off. With all of these off and no checks started manually, the services listed in Section 5 are not contacted.
• You can adjust menu bar, notification, floating widget, and alert-rule preferences in the app's settings.
• You can delete any API key you entered at any time (see Section 4); without a key, Netlink sends no key-bearing request to any AI service provider.
• You can use "Clear Inspection Traces" in Settings › Privacy, or clear local history by removing app data or uninstalling the app.
• Using "Probe my exit IP" in multi-location probing requires your explicit confirmation before first use.
• You can manage notifications, login items, and network-related permissions in macOS System Settings.

Consent and withdrawal

On first launch, the "Data Sharing" step of onboarding lists the third parties in Section 5 one by one; on the first launch after updating to this version, a consent dialog opened in the main window does. It shows the name, privacy contact, purpose, method of processing and types of personal information, and you choose "Agree and Continue" or "Don't Agree" separately; until you agree, Netlink does not contact these third parties (in-app purchase, the Apple-hosted asset pack download, and the iCloud key-value sync of the free-run counter and iCloud account-status check are handled by Apple's system services and are not covered).

• If you choose "Don't Agree": Netlink runs in local-only mode and you can still use Local Network, System Environment, History, the hosts viewer and the five offline utilities; features that need the network show a placeholder card, and you can change to agree at any time from that card or in Settings. We do not disable features that work locally because you did not agree.
• Review and withdraw at any time: in Settings › Privacy › Data Sharing you can see the list again and withdraw your consent whenever you like; after withdrawal Netlink no longer contacts these third parties, and a full inspection that is in progress is cancelled. Withdrawal does not affect processing already carried out on the basis of your consent; results you have saved can be deleted with "Clear Inspection Traces"; if iCloud sync is on, you can still tick "Also delete data in iCloud" when clearing (it only deletes records in your own private iCloud database and uploads nothing), or delete it in System Settings › your name › iCloud › Manage.
• Asked again when the list changes: when a recipient is added, or a recipient's purpose, method of processing, types of personal information or timing is extended, we ask for your consent again; edits to a name, contact detail or wording do not.
• iCloud sync is explained separately: before you turn on iCloud sync (Pro), the content and destination of the sync are explained again and your consent is requested; while it is off, no history or profiles are written to iCloud (the free-run counter in iCloud key-value storage, described in Section 4, is separate).
• An API key you enter yourself is sent only to the service it belongs to; without a key no key-bearing request is sent.

11. Children's privacy

Netlink is not designed for children and contains no social, advertising, account, or profiling features. We do not knowingly collect personal information from children.

12. Changes to this policy

If Netlink later adds accounts, developer-operated servers, ads, analytics SDKs or new third-party services, or widens what iCloud sync covers, we will update this policy and the App Privacy information in App Store Connect accordingly. (Report export shipped in version 1.5.0; its privacy practice is described in Section 4 -- generated entirely on-device, never uploaded.)

13. Contact

Operator: the Netlink developer.

If you have questions about this policy or how data is handled, email support@netlink.jeman.net or visit the support page.

Support emails you choose to send us (including your email address and the message content) are used only to answer and troubleshoot that request and for no other purpose. The in-app "Send Feedback" panel lets you optionally attach diagnostic info and a screenshot of the current main window: diagnostic info includes the app version and build number, macOS version, interface language, the time / score / grade / deduction codes of your last inspection, error codes, access type (Wi-Fi / wired, etc.), which system proxy types are on, IPv6 availability, and whether you're on the free or Pro tier -- it never includes an IP address, DNS server address, proxy address, or hardware identifier. The screenshot (optional, unchecked by default) captures the current main window; if the window is showing your public IP or similar info at that moment, the screenshot may include it -- whether to attach it is entirely your choice. None of this is actually sent until you click Send in your own mail app.

This document describes the privacy practices of the current version of Netlink and is not legal advice.