Privacy Statement
The short version. Sigweeper reads your Signal Desktop attachments on your own Mac and never uploads them anywhere. We operate no servers that receive your data, we have no accounts, and we collect no analytics or telemetry from the app.
The app makes exactly one kind of network request: asking
sigweeper.com whether a newer version exists. That is described in full
below, including what a server can infer from it.
What the app accesses on your Mac
To do its job, Sigweeper reads the following, all locally:
| What | Why |
|---|---|
The Signal Safe Storage item in your macOS Keychain |
Signal encrypts its database with a key protected by this item. macOS asks your permission the first time. |
~/Library/Application Support/Signal/config.json |
Contains the wrapped database key. |
Signal's encrypted database (sql/db.sqlite) |
Lists which attachments exist, their size, type, and conversation. |
Attachment files in attachments.noindex/ |
Decrypted in memory to show you a thumbnail or preview before you decide. |
What we never do
- We never upload your messages, attachments, thumbnails, or keys.
- We never transmit your Keychain password or the database key.
- We have no user accounts, no sign-in, and no user identifiers.
- We include no analytics, crash-reporting, or advertising SDKs in the app.
- We do not write decrypted content to disk except in a private, permission-restricted temporary directory when an external preview tool requires a file path; those files are deleted automatically.
- We do not sell or share any data, because we do not receive any.
The one network request: update checks
When Sigweeper starts, it requests
https://sigweeper.com/latest.json to learn whether a newer version has been
released. If one has, you are shown a notice and choose whether to install it.
Why this exists. Signal Desktop releases updates roughly every week. If one of those changes the way Signal stores or encrypts its data, Sigweeper can stop working. Without an update mechanism you would be left with a broken app and no way to learn that a fix had been published.
What is sent. The request contains no personal data, no identifier,
and nothing about your Signal data. It is an ordinary HTTPS GET for a static
file.
What a server can nevertheless observe. We want to be straightforward rather than technically-true-but-misleading. Any HTTPS request necessarily reveals some information to the server and its network provider:
- your IP address, which approximates your region and is retained in our hosting provider's standard logs;
- the fact that a copy of Sigweeper is running at that address; and
- the app version making the request.
Our site is hosted on Cloudflare Pages. Cloudflare processes these requests and retains standard server logs as our hosting provider. We do not combine this information with anything else, and we cannot link it to a person.
The website
sigweeper.com is a static site on Cloudflare Pages. It sets no cookies and runs no analytics or tracking scripts. Cloudflare records aggregate request counts, which we use only to see roughly how many people visit and download the app.
Children
Sigweeper is not directed to children under 13, and we knowingly collect no information from anyone.
Your rights
Privacy laws such as the GDPR and CCPA give you rights to access, correct, or delete personal data held about you. In our case there is effectively nothing to exercise those rights against: we hold no user database and no personal data beyond our hosting provider's transient server logs. If you have a question, write to us and we will answer honestly.
Changes
If we ever change what the app accesses or transmits, we will update this page and change the date above. We will not quietly begin collecting data.
Contact
Zeyu Guan — guanzy0123@gmail.com
New York, United States