Pkg Signing Check privacy policy

Effective 12 October 2026.

Pkg Signing Check collects no data. It has no account, no analytics, no advertising, no tracking, no crash reporting of its own and no server of its own. Nothing you check is sent to the developer.

What the app reads, and where

• Packages, folders and lists you choose. The app reads only the .pkg files, folders, Munki repositories and Jamf CSV files that you drop onto its window or pick in an Open dialog. It reads them on your Mac, only to extract the certificates embedded in the packages. They are never uploaded anywhere.
• Download addresses you give it. This is the app's only network access. When you paste a list of package addresses (or a Jamf CSV contains a download address), the app connects from your Mac directly to that server and asks for the start of each file (an HTTP Range request for about 64 KB). That server sees an ordinary request from your Mac's internet address with the user agent PkgSigningCheck/ followed by the version number. The connection uses a private (ephemeral) session, so nothing from it is kept on disk. The developer receives nothing.
• The optional trust check asks macOS to evaluate each certificate chain using only the certificates already on your Mac. It is set not to go online for revocation or missing certificates.
• Settings (your Team IDs and the trust-check option) are stored in the app's own preferences on your Mac and never leave it.
• Exports (CSV, Markdown, PDF) are written only to the place you choose in the Save dialog.
• Links in the Help window (Apple's notice and other sources) open in your web browser, under that website's own privacy policy.

The app makes no other connections: no update checks, no licence checks and no usage reporting.

Purchases

Purchases are processed by Apple under Apple's privacy policy. The developer receives only Apple's aggregated sales and download reports, and no names or contact details of buyers. If you opt in to sharing crash reports and usage data with developers in macOS settings, Apple may pass anonymised crash reports to the developer; you control that in System Settings.

Email

If you email apps@evanhunter.xyz, your message and address are used only to answer you, and are not shared or added to any list.

This website

The free browser checker on this site reads packages in your browser and never uploads them; the pages are not allowed to make network requests (connect-src 'none'). Page visits are counted with GoatCounter: the page address, the referring page, the screen size and the browser's standard request details are sent to GoatCounter, without cookies. The checker also counts which verdict it showed (for example “old CA”), never file names or contents.

Changes and contact

If this policy changes, this page will show the new effective date. Questions: apps@evanhunter.xyz. The app is sold by Evan Hunter (sole trader), Australia.