What MExplorer sends off your Mac
The short answer: usage statistics, crash reports, and update checks. No file names, no file contents, no paths of any kind.
What never leaves your Mac
- File names, paths, file contents. Never, with no exception.
- Your installed apps, scan results, cleanup logs. They live in a SQLite database in the app’s own support folder, on your machine.
- Your work. No scan results, app inventory or cleanup log ever leaves the machine — not even inside a licence activation call.
This is not just a promise. The list of events that may be sent is a closed type in the source: every parameter is an enum, a count, or a size band. No field accepts free-form text, so there is nowhere for a path to be slipped in. A gate that runs on every build turns red if someone adds a string parameter, or if the telemetry module touches the file system.
What does leave your Mac
1. Usage statistics (Firebase Analytics)
| Event |
Sent with it |
| App launched |
interface language code |
| A screen opened |
which screen (cleanup, duplicates, disk analysis…) |
| Cleanup finished |
scan depth, how many groups were ticked, the band of space freed |
| Permission step outcome |
granted or skipped |
| Feature tour closed |
finished, or which page it stopped on |
| Licence activated |
nothing at all |
Sizes are sent as a band (“under 1 GB”, “1–10 GB”, “over 10 GB”), not as the real number. An exact figure repeated across sessions starts to be a fingerprint of one particular machine; a band does not.
Firebase attaches more on its own, outside our control: app version, macOS version, machine model, country inferred from your IP address, and one identifier per installation.
2. Crash reports (Firebase Crashlytics)
When the app crashes: the call stack, app version, macOS version, machine architecture, interface language. Not the name of the file you had open — the report does not travel that path.
3. Update checks (Sparkle)
Downloads an XML file listing the versions, and the update package if there is a newer one. The server sees what every web server sees: IP address, time, macOS version and MExplorer version. The package is verified against an EdDSA signature before it installs. Can be turned off in Settings → Updates.
4. Licence activation (from 1.0.3)
Only happens when you actively activate a key on this Mac, or open the list of Macs using your key. There is no heartbeat: the app never calls the licence server on a schedule, and after the first activation it does not call it again at all.
- Your licence key — to look up your licence.
- A machine code — to count the Macs in your plan. It is a one-way hash of a hardware identifier, not a serial number: the server never holds your Mac’s real identifier, and the code cannot be cross-referenced with anyone else’s records.
- Your Mac’s name (“Công’s MacBook Pro”) — so you can tell which Mac to remove. This is the only new personal field, and without it the list is just rows of hashes.
- macOS version and app version — support and compatibility statistics.
Retention: activation records and the event log are deleted after 24 months. Licence and order records are kept longer because they are proof of purchase.
Nothing locks up when you go offline. The licence on your Mac is permanent and verified offline — even if the licence server shut down for good, an activated Mac would not notice.
Turning it off
Usage statistics and crash reports are on by default and currently have no off switch. That is a business decision, and it goes against the “opt-in” requirement our own specification sets. We are writing it down here instead of staying quiet about it.
- Block it at the firewall: MExplorer only talks to
*.google-analytics.com, *.crashlytics.com, firebaselogging.googleapis.com, MOBILUCK’s update server, and licence.code247.ai when you activate a licence.
- Use a build with no Firebase configuration. A build without the configuration file sends nothing at all — that is the code’s default behaviour, not a hidden option.
What Full Disk Access is for
macOS requires this permission to read ~/Library, where apps keep their data. Without it, three of the main features — storage by app, leftovers from removed apps, and cache cleanup — cannot work, because the operating system blocks them at the door.
The permission lets MExplorer read. It is not used to collect anything for sending: nothing read from your disk ever reaches the events above.
Check for yourself
You do not have to take this page’s word for it. Firebase batches events in a local database and sends them on its own schedule, so looking at network connections once usually shows nothing — which does not mean the app sends nothing. To see what is queued, open the queue on your own machine:
sqlite3 ~/Library/Application\ Support/Google/Measurement/google-app-measurement.sql \
"SELECT name, count(*) FROM events GROUP BY name"
You will see exactly the events in the table above, plus a few of Firebase’s own automatic ones. You will not see any file name or path, because there is no route for them to get there.
Updated 1 September 2026. Before that date MExplorer sent nothing but update checks, and this page said so. We changed the software and this page on the same day, rather than leaving the old promise standing.
This document is published in every language the MExplorer website speaks. The translations are provided so you can read the terms in your own language; where a translation and the English differ in meaning, the English version governs. This does not affect your statutory rights in your country of residence.