Peak  ·  Help

Privacy & Security FAQ

Peak is a privacy-first product. This page explains exactly what that means, where the data lives, what (very little) leaves your Mac, and why.

TL;DR

• Message content, contacts, attachments, scan results, and reports stay on your Mac.
• Peak makes no outbound network calls at all — the Mac App Store handles updates.
• There is no account, no sign-up, no telemetry, no analytics, no crash reporting (yet — if added later, it'll be off by default and disclosed clearly).
• In the App Store build, networking and the auto-updater are compiled out entirely — there's nothing in the app that can send your data anywhere.

What does Peak read from my Mac?

From the iPhone-backup folder you select (Peak is sandboxed and can read nothing else):

• iPhone backup folder (~/Library/Application Support/MobileSync/Backup/) — Peak reads sms.db and the attachment files referenced by the threads you scan.
• *AddressBook.sqlitedb inside that backup*** — Peak reads phone numbers and email addresses to resolve them to contact names (so threads with phone +15551234567 can be labeled "Mom"). This comes from the backup itself; Peak never touches the Mac's own Contacts app, and reads no other contact field.
• Where you save reports — when you export, Peak writes the PDF/CSV to the location you choose in the save dialog.

Because Peak is a sandboxed Mac App Store app, it cannot open anything outside the folder you selected. You can verify this in the source.

What does Peak write?

Everything Peak writes goes either to the location you choose when exporting, or inside Peak's sandboxed app container (~/Library/Containers/app.peak.desktop/):

• PDFs and CSVs to the location you pick when you export
• Scan history database — a small SQLite file recording which threads you've scanned and when (so the UI can show "last scanned 2 hours ago"). It does not store message content.
• App preferences — your settings (category toggles, etc.). No message content.

What does Peak send over the network?

Nothing. Peak makes no outbound network connections at all. Updates are delivered by the Mac App Store, so Peak itself never needs to phone home — not even to check for a new version.

You can verify this with Little Snitch, Lulu, or nettop -P -l 0 -p $(pgrep -x Peak) in Terminal.

Is Peak meant to be used secretly?

No. Peak is built for a parent reviewing their own minor child's device, and we encourage being open with your kid about it. A few technical facts that follow from how Peak works:

• Peak installs nothing on the iPhone. No app, no profile, no certificate — it only reads a backup that already exists on your Mac.
• Finder backups are normal. iOS has backed up to Macs for over a decade.
• Peak must not be used to monitor another adult. Reading another person's messages without their consent can be illegal; see our Terms.

Whether and how you discuss Peak with your child is a parenting decision — but Peak is not a tool for covert surveillance.

Can other people read my Peak reports?

The PDFs are written to disk as ordinary files. If someone has access to your Mac, they can open them.

Recommendations:

• Keep your Mac password-protected and FileVault on (System Settings → Privacy & Security → FileVault).
• If you share the Mac (e.g., a family computer), put Peak reports in your home folder's private subfolder rather than ~/Public/ or a shared location.
• Don't email reports as attachments unless you're encrypting them first.

For higher-stakes storage (e.g., evidence for a legal proceeding), copy the reports to an encrypted disk image (Disk Utility → File → New → Disk Image) or an encrypted external drive.

Are my scans encrypted at rest?

If your Mac has FileVault on (the default on Apple Silicon Macs), the entire disk is encrypted at rest. Peak's outputs are inside that. When the Mac is shut down or locked, the data is unreadable without your password.

Peak does NOT add a second layer of encryption to its own outputs. The reports are plain PDFs. We chose this because (a) FileVault is already strong, (b) a second layer often confuses non-technical users (lost passwords = lost reports), and (c) you may want to share or print reports — encrypted formats make that harder.

If you want defense in depth, use the encrypted disk image approach above.

Does Peak use AI / machine learning?

The default scanner is deterministic word matching — no ML.

If you're on macOS 26 (Tahoe) or later, Peak can optionally use Apple Foundation Models to rate flagged messages in context. This is an on-device model that runs entirely inside your Mac's secure enclave / Neural Engine. The message text is processed locally; nothing is sent to Apple's servers or any cloud service.

You can disable AI rating in Settings → General → "Use AI rating when available."

Future versions may add image classification (also on-device) to flag concerning photos. That feature, when added, will be opt-in and clearly disclosed.

What about Apple Communication Safety?

iOS has a built-in feature called Communication Safety (Settings → Screen Time → Communication Safety on the kid's device) that uses on-device ML to detect nudity in incoming/outgoing photos and warn the kid. Peak does not replace or interact with Communication Safety. That feature lives entirely on the iPhone and is Apple-managed. We recommend enabling it independently if you have a younger kid.

Does Peak comply with COPPA?

Peak runs on your Mac and processes your kid's iPhone backup. The Children's Online Privacy Protection Act regulates online services that collect personal information from children under 13. Peak does not have an online service or collect anything online — therefore COPPA does not apply to Peak itself.

However: if you scan messages from a child under 13, you should think about whether your kid's contacts (some of whom may also be under 13) have a reasonable expectation that their messages might be read by your kid's parent. Most courts and ethics frameworks consider this fine for parental supervision of a minor child. Adult-to-adult message reading would have different legal implications (federal wiretap laws, state two-party consent rules).

Will Peak ever add a cloud component?

Not in v1.

If we add cloud sync later (between Peak Desktop and a hypothetical Peak Mobile companion app), it will:

• Be opt-in
• Use end-to-end encryption with keys held only by you
• Sync via your own iCloud Drive or Google Drive (not a Peak server)
• Be clearly disclosed in the next version's privacy policy
• Not change anything about how the existing on-device flow works

If we ever change this promise, you'll see it in big text in the release notes, and you'll get to choose whether to update.

What's NOT in scope for Peak

Things Peak does NOT do, will NOT do, and you should NOT expect:

• Real-time monitoring of the phone — Peak only reads backups, which are point-in-time snapshots
• WhatsApp / Snapchat / Instagram / Discord / TikTok message scanning — those apps sandbox their data inside the iOS backup so third parties can't read it
• Remote viewing of the phone from a different device
• Location tracking of the phone or kid
• Web history scanning — that's stored in Safari and not currently in Peak's scope
• Photo gallery analysis — Peak only reads message attachments, not the full Photos library
• Email scanning — out of scope
• Audio recording — Peak does not access the Mac microphone or any audio APIs

This list isn't a roadmap — it's a non-goal list. Don't ask Peak to do these things; Peak isn't that kind of product.

How can I be sure Peak doesn't send my data anywhere?

Peak is a pure-Swift native app — there's no Python interpreter, no embedded script, no sidecar process. Everything is a regular Mac binary.

In the App Store build, networking and the auto-updater are compiled out: there's no URLSession, socket, or HTTP client in the shipping app at all. On top of that, the Mac App Store sandbox blocks any network connection the app doesn't explicitly request — and Peak requests none.

Next: Changelog.