What Dustloft sends

Privacy · 3 min read · Updated September 2026

The entire message

Not a summary of it. This is the whole request body, sent when the total in it changes and once a day even when it has not:

POST https://dustloft.com/api/ping

{ "id": "9f2c1e7a-4b35-4f01-9a6e-2d8c7b1e5a44",
  "cleaned": 41203847610,
  "version": "1.0.27" }

• id — a random UUID that this copy of the app generated for itself. It is not derived from your hardware, your network, your account, your username or anything else about you, and it is created only at the moment something is actually going to be sent. Its only job is to stop one Mac being counted as a hundred.
• cleaned — the running total of bytes Dustloft has removed on this Mac, counting items sent to the Trash as well as those deleted outright, each one once. A total, not a list: which files, where they were and what they were called are not part of it.
• version — the build you are running, so it is possible to tell whether an update actually reached people.

What is not in it

No name. No email address. No account, because there are no accounts. No file names, no paths, no directory listing, no disk size, no serial number, no hardware identifier, no location, no advertising identifier, and nothing that could be joined against any of those elsewhere.

The operations log — the record of everything Dustloft has removed, with full paths — is written to ~/Library/Logs/Dustloft/operations.log on your own machine. It is plain text, you can read or delete it with anything, and no part of it is ever uploaded.

Your IP address

Any request over the internet necessarily carries one. It is used to rate limit, and only that, so that a single machine cannot flood the counter.

Precisely what happens to it: the address is hashed with a salt, and that hash becomes a counter which expires sixty seconds later. The address itself is never written down. Neither the address nor the hash is attached to a report, stored beside one, or written to a log. Unless a fixed salt is configured, the salt is random per server process and is never persisted — so those sixty-second counters cannot be matched up across processes, or after a restart, by us or by anyone who obtained the database.

What that does not claim: within one server process and one sixty-second window, two requests from the same address do land on the same counter. That is what rate limiting is. It is bounded to a minute, holds no address, and touches nothing that is kept.

Where the numbers go

Into two totals, and a daily count for a chart. They are public at dustloft.com/stats. There is no endpoint, there or anywhere, that returns a single install's row; the per-install value exists only so that a report which arrives twice is not counted twice.

Switching it off

The first thing Dustloft shows on a new install is a card with the message above — with your real numbers in it — and a Turn it off button. The switch stays in the Overview footer afterwards, so the decision is never one that card made for good. Turning it off stops it permanently: there is no final report on the way out.

To disable it before the app is ever launched, so that nothing is sent even once:

launchctl setenv DUSTLOFT_NO_METRICS 1

When that is set, the app never generates an identifier at all.

What happens when you are offline

Nothing waits on us. Scanning, measuring and cleaning are entirely local and never touch the network, so Dustloft works exactly the same on a plane as it does at a desk. A report that cannot be sent fails quietly and holds nothing up.

Because the figure is a running total rather than a stream of events, nothing is queued or stored up either — whatever one attempt could not send, the next one carries, because it is the same single number. The app notices when the network comes back and reports then, so being offline delays a count rather than losing one.

This website is a separate thing

Everything above is about the app. This site is not the app, and it would be sleight of hand to describe one and let you assume the other.

dustloft.com loads Microsoft Clarity, which records how pages are used — clicks, scrolling, and session replays — and which sets cookies and processes your IP address on Microsoft's side. It runs on the pages of this site, this one included — the single exception is /stats, which loads no analytics at all. What it collects is governed by Microsoft's privacy statement, not by anything on this page.

That is ordinary website analytics and it is worth saying plainly rather than burying: the app's promises above do not extend to this website, and the website's analytics do not extend to the app. Installing Dustloft does not opt you into Clarity; visiting this page does not send anything to the app's counter. Browser-level tracking protection, or any content blocker, stops Clarity here without affecting the app at all.

The other network request

On launch, Dustloft asks the GitHub Releases API whether a newer version exists. That request goes to GitHub, not to us, and carries nothing but the request itself.

Do not take any of this on trust

The client is one file — Sources/Dustloft/Metrics.swift — and the payload is pinned by a test that fails if a fourth field is ever added. The server is two short files in the same repository. If this page and the code ever disagree, the code is what runs.