How Kempt works

What goes over the internet

There are only two network calls, plus a checkout link that opens in your browser. There are no update checks, crash reports or analytics.

What	When	What is sent
License check	Only after you’ve entered a key: when you activate, once each time the app opens, and when you deactivate. It uses a private connection with no cookies and no cache.	The license key, an anonymous device ID, and a simple label like “Kempt on a Mac”. The Mac model and anything about your files are not sent. Like any website, Freemius sees the IP address.
Place names	Off by default. Only runs if you turn on “Use place names from photos”. There is one lookup per photo trip.	Apple’s geocoder receives one GPS position — the trip’s average position. Never the photo, and never its name.

“Get Kempt Pro” opens the Freemius checkout page in your own browser. The app itself sends nothing.

Try it with Wi-Fi off

Everything works offline: scanning, the quiz, renaming, sorting, invoice reading, photo trips, Undo and History.

Without internet you lose two things. Place names fall back to a date name like 2026-11-Trip. And a new license can’t be activated. An existing Pro license keeps working for seven days after the last successful check, then asks you to reconnect. The free features keep working.

If you block Kempt with a firewall app such as Little Snitch or LuLu, it behaves the same as being offline. Nothing breaks, nothing nags, and no lookup ever holds up a cleanup.

What Kempt reads

Kempt only looks inside folders you pick in the folder picker. It never asks for Full Disk Access. macOS may ask once if you pick Desktop, Documents or Downloads. Calendar and notification access are only requested if you set up a reminder.

The scan itself only reads names, types, sizes and dates. Two features read a little more, both on your Mac:

• PDF text, to name invoices, receipts and contracts. This is on by default. Kempt reads the first three pages of each PDF. Apple’s PDFKit reads the text layer first. If a page has no text — a scan — Apple’s Vision reads the first page on the Mac (English and German). Nothing is uploaded. The text is held in memory only, and is gone when you quit.
• Photo trips. Kempt reads each photo’s built-in date and GPS position (EXIF). The image itself is never opened or changed. Photos are never sent anywhere. Turning on place names, as above, sends only a GPS position, never the photo.

Kempt only sorts files sitting directly in the chosen folder. Files already in subfolders are counted for the score but never moved. Apple Intelligence is not used.

What Kempt saves on your Mac

In ~/Library/Application Support/Kempt/:

• Undo/One file per cleanup, with the old and new location of every file, the folder, the date, and the tidy scores before and after. This also powers History.
• license.jsonThe license key, Freemius install ID, anonymous device ID and this Mac’s name. Only you can read it.
• free-allowance.jsonHow many free files have been used.
• reminders.jsonReminders you set up.
• custom-structure.jsonYour own folder structure, if you made one.

Never stored: invoice text, file contents, or thumbnails.

Two small preferences also live in macOS’s settings file for the app, ~/Library/Preferences/app.jennykeller.Kempt.plist: the keyboard-shortcut hint setting, and your old screenshot location if you used “Put screenshots in a folder”.

The Keychain holds only the license, which is the same record as license.json, kept twice so a paying customer never gets locked out.

Kempt does not keep copies or thumbnails of your files. It only renames and moves the originals.

How your files stay safe

• Kempt never deletes a file, never overwrites one, and never sends anything to the Trash. It only renames, moves and creates folders. Files that don’t fit anywhere go to an Archive folder, never the Trash.
• Undo removes only folders Kempt made, and only if they’re empty.
• If two files would end up with the same name, Kempt adds _2, _3 and so on before the extension. The preview flags this beforehand.
• There is no limit on how far back you can undo, and Undo survives a restart because every cleanup is saved to disk and kept.
• Before undoing, Kempt checks every step. If anything is in the way — a file was moved since, or a name is taken — it moves nothing and explains why. If a newer cleanup touched the same files, you undo that one first.
• Before a cleanup, Kempt checks the whole plan and opens its Undo record. Each move is saved to that record right after it happens, so a cleanup cut off by a crash or a power loss can still be undone. In the worst case, the one file being moved at that exact instant isn’t in the record. That file is still intact, just under its new name.
• App bundles and packages (.app, Photos libraries) are skipped completely, and so are hidden files and shortcuts (symlinks). System folders are only touched if someone picks one.
• Folders already inside your chosen folder are never moved, so a project sitting inside Downloads stays whole.

Cloud folders and external drives

Renaming and moving work on iCloud Drive, Dropbox and external drives the same way they do anywhere else. Files that are only in the cloud are counted and can be moved without being downloaded.

One caveat. Reading a cloud-only PDF or photo makes macOS download it first, so a big cloud folder can trigger downloads.

Your license and payment

The license is checked only after you’ve entered a key: when you activate, once each time the app opens, and when you deactivate.

The check sends the license key, an anonymous device ID, and a simple label like “Kempt on a Mac”. The device ID is a one-way scrambled form of the Mac’s hardware ID, so it can’t be traced back to the Mac. The Mac model and anything about your files are not sent. Like any web request, Freemius sees the IP address.

Freemius handles payment in your browser. Kempt never sees the card or the email address. It only gets the key you paste in.

The license is checked once per launch. Pro keeps working for seven days after the last successful check. After that it asks you to reconnect, and the free features keep working.

Why it isn’t sandboxed

Kempt is not a sandboxed Mac app. A sandboxed app has to ask permission again for every folder, and it struggles to move files between folders — which is exactly what a cleanup, and a reliable Undo, needs to do. That’s why Kempt is unsandboxed, which is usual for this kind of file organiser, and why it still only looks inside the folders you pick. Hardened Runtime is also off for now, and would come with Apple notarization.

Check your download

Each release has a SHA-256 checksum. After you download the DMG, you can check that your copy matches.

Kempt 0.9.1 · Kempt-0.9.1.dmg · 3.9 MB (3,855,273 bytes)
SHA-256: c3e8f99a106e66f8dc0850a5a3bb524d8012ad987d4013f768e829c737874bd9

In Terminal, run:

shasum -a 256 ~/Downloads/Kempt-0.9.1.dmg

The result should match the checksum above.

The app is ad-hoc signed, not signed with an Apple Developer ID, which is why macOS shows the “Open Anyway” step the first time. That’s about where the app came from, not about Kempt having touched your files. The three official steps are in the install guide.

Remove Kempt completely

Dragging the app to the Trash is not enough to remove everything it saved. A “Remove all Kempt data” button is coming in an update.

Until then, to remove everything:

1. Deactivate the license. This frees the activation.
2. If you used it, click “Put it back” for the screenshot location.
3. Delete the folder ~/Library/Application Support/Kempt/.
4. Delete the file ~/Library/Preferences/app.jennykeller.Kempt.plist.
5. Delete the item app.jennykeller.Kempt.license in Keychain Access.
6. Delete any calendar events Kempt added. Kempt can only add events, so it can’t remove them itself.

Questions or found a security issue?

Write to TODO-SECURITY-EMAIL.