What Dustloft refuses to do

Safety · 6 min read · Updated September 2026

Most cleaning tools are judged on how much they free. That number is the easiest thing to optimise and the reason the category has a bad reputation — the fastest way to a large figure is to delete something that mattered.

Dustloft is built the other way round. What follows is the complete set of things it will not do, all of them enforced in code rather than left to a setting.

The three tiers

Every item found is classified before it is ever shown to you, and the classification drives how much friction stands between it and deletion.

Tier	Definition	How it is handled
Regenerable	Rebuilds itself the next time it is needed	Eligible for one-click cleaning
Needs admin	Safe to remove, but macOS will ask for your password	Batched into a single administrator prompt
Permanent	Nothing rebuilds it	Never bulk-selected. Each item confirmed on its own, then moved to the Trash rather than deleted

Quick clean touches the first tier only. It will never include something needing your judgement, which is what makes it safe to press without reading.

Locations it will never delete

These paths are refused at the point of execution. Even if an item somehow reached a clean list, the deletion is rejected:

Location	Why
~/Dropbox	A local delete propagates to every device and to anyone sharing the folder
~/Library/Mobile Documents (iCloud Drive)	Same — removing a synced file removes it everywhere
~/Library/CloudStorage (OneDrive, Google Drive, Box)	Same, for every other sync provider
Any .git directory	History has no rebuild path. Only git gc is ever offered
Docker named volumes	Databases and application state live here, not disposable layers

Rules that go further than the list

Docker is pruned, never wiped. The command is docker system prune -a, which removes unused images and stopped containers. The --volumes flag is never passed under any circumstance.

Git repositories are repacked, never removed. The only action offered is git gc. Before that, every repository is checked against its remote with git ls-remote, and one whose history exists nowhere else is flagged in red as only copy — nothing pushed.

MySQL data is advisory only. Binary logs are reported with the correct command to purge them through the server, and Dustloft will not run it. Purging outside the server risks desynchronising binlog.index, and your databases are never touched.

Project scans stay inside project roots. Dependency and build-output scans only ever run inside directories you have configured, never across your home folder or the whole disk.

Published packages are not build output. A dist or build folder inside node_modules, .venv, site-packages or vendor is skipped, because it is the library itself rather than something a rebuild recreates.

The active runtime is never offered. Node version cleanup excludes whichever version is currently in use.

Every path is validated before anything happens to it. Deletions are refused if the path is not absolute, contains a .. traversal segment, is the filesystem root, or falls inside a protected system tree — /System, /usr, /bin, /sbin, /etc, /var, /private, /Library/Extensions and /Library/Frameworks among them.

A redirected parent folder cannot smuggle a delete somewhere protected. If ~/Library/Caches were a symlink into Dropbox, a plain name check would pass while the delete resolved through the link into synced data. The parent directory is canonicalised and the refusal list is re-checked against the resolved path. The re-check can only take permission away, never grant it.

Elevated removals are held to a higher bar. Anything run under an administrator prompt is validated first, symlinks are refused outright at that level, and paths are quoted so that a filename can never be read as a command.

Permanent items are moved to the Trash, not unlinked. Anything classified permanent is put in the Trash rather than deleted outright, so a decision you regret is reversible until you empty it. Regenerable items are still removed directly — trashing those would report space freed that the disk had not actually given back.

Every removal is written down. An append-only log at ~/Library/Logs/Dustloft/operations.log records the timestamp, action, size and full path of everything touched. It is a plain tab-separated file you can read, grep or delete without this app, and it never leaves your machine.

Time Machine snapshots are thinned, not deleted. Local snapshots are thinned with tmutil; backups on external drives are never touched.

Claims it will not make

It does not report purgeable space. Purgeable is released by macOS on its own schedule and no third-party application can free it on demand. Reporting it would be claiming credit for something outside the app's control. The full explanation is here.

It measures real disk usage, not apparent size. A sparse Docker image that reports 494 GB is shown at the 9.3 GB it actually occupies, because the alternative is a headline number that is not true.

It collects nothing. No telemetry, no analytics, no account. Scanning happens locally and nothing about your disk leaves the machine. The operations log described above is written to your disk and read by nobody but you.

Why these particular rules

They are not hypothetical. The list was written after a manual cleanup that freed a great deal of space and came close to destroying a git repository whose history existed nowhere else — the remote was configured, so deletion looked obviously safe, and nothing had ever been pushed to it. Every rule above exists because something nearly went wrong.

The source is public and the safety rules are covered by tests, so none of this has to be taken on trust: read the code.