The Short Version
- Signed and notarized by Apple. Proof is code-signed with a verified Apple Developer ID and notarized by Apple, which means Apple scanned the exact binary you downloaded for malware.
- A real, named developer. Proof is published by Erik Sawaya under Apple Developer Team ID
225KXPVW4C, tied to a legally verified Apple developer account. - Your photos never leave your Mac. Proof reads and edits the image files you point it at on your own disk. It does not upload your photos, catalog, edits, metadata, or file paths.
- One internet connection: update checks. On launch, Proof asks GitHub whether a newer version exists. Proof does not include analytics, telemetry, tracking, advertising, or cloud sync.
What Apple's Notarization Guarantees
Notarization is Apple's trust mechanism for Mac software distributed outside the Mac App Store. Before release, the Proof binary is uploaded to Apple, checked against a valid paid Apple Developer ID, scanned for malware, and issued a notarization ticket.
Your Mac checks that ticket the first time you open Proof. If the app has been changed after signing, even by a single byte, the signature breaks and macOS refuses to launch it. This is the same mechanism used by many paid, closed-source Mac apps.
Verify It Yourself
You do not have to take our word for it. Open Terminal and run:
spctl -a -t exec -vv /Applications/Proof.app
codesign -dvv /Applications/Proof.app
stapler validate /Applications/Proof.appThe first command should report that Gatekeeper accepts the app from a notarized Developer ID. The second command shows the signing identity and Team ID 225KXPVW4C. The third confirms the notarization ticket is stapled to the app.
What Proof Can Access
Proof runs without the App Store sandbox. That is deliberate: a photo tool needs to read the folders you choose, and Proof uses standard macOS tools already on your system, including sips for image conversion and exiftool if you have it installed, to read camera metadata and handle RAW or HEIF files.
Running unsandboxed means Proof can read files on your disk, like other desktop photo editors. The important question is what Proof actually does with that access.
| Proof does | Proof does not |
|---|---|
| Read the image folders you open | Upload, sync, or back up your photos anywhere |
| Write thumbnails and previews to a local cache | Send your catalog or edits to any server |
| Read camera metadata, including EXIF and film simulation details | Collect analytics, telemetry, or usage tracking |
| Check GitHub once on launch for app updates | Contact ad networks, trackers, or cloud photo services |
Local Cache Locations
You can inspect or delete Proof's local catalog and thumbnail cache at any time:
- Catalog:
~/Library/Application Support/com.werket.proof/ - Thumbnails:
~/Library/Caches/com.werket.proof/
The One Network Connection
On launch, Proof checks whether a newer version is available by fetching a small public manifest from GitHub:
https://github.com/werket-werk/proof-releases/releases/latest/download/latest.jsonThis is the standard Tauri auto-updater. Any update offered through that channel is cryptographically signed with a key held by the developer, and Proof verifies the update signature before installing it.
You can watch this with a network monitor such as Little Snitch or macOS firewall tooling. You should see a GitHub connection on startup and no analytics, telemetry, tracking, advertising, or cloud sync traffic.
Why Proof Is Not Open Source
Proof is an independent product in beta development, and the source code is part of the product's intellectual property. That is the same position as many closed-source Mac apps.
What Proof publishes instead is the trust surface that matters for safety: a verified developer identity, Apple notarization, a signed and tamper-evident update channel, a local-first data model, and commands anyone can run to verify the app on their own Mac.
Questions
If this page does not answer a security or privacy concern, use the support form.