Netlink Privacy Policy

Effective date: September 23, 2026 · Last updated: October 10, 2026

Scope: the macOS app "Netlink" (Bundle ID: com.netlink.app)

中文版 · Chinese version

Netlink is a local network environment inspection tool for viewing your Mac's local network, public exit, proxy/VPN signals, DNS, IPv6, system environment, and hardware overview, with additional capabilities including AI service availability check, bandwidth speed test, multi-location probing, domain diagnosis, network tools, and report export; the country, ISP and VPN / data-center flags of an IP come from data bundled with the app and need no online lookup. Apart from support emails you choose to send us, we do not collect any user information, provide no account system, show no ads, do no cross-app or cross-site tracking, and operate no servers that receive, store, or analyze user data. The app does not request or read Location, Microphone, Camera, Contacts, or other system privacy permissions. All inspection results and history stay on your Mac by default; only if you turn on the optional iCloud sync (Pro, off by default) are the score history, IP history and environment profiles also stored in your own iCloud private database (see Section 4).

1. How we read Apple's privacy disclosure requirements

Apple requires developers to accurately disclose, in App Store Connect, the data actually collected, used, and transmitted by the app and any third-party services, and to keep the privacy policy, the App Privacy label, and the app's behavior consistent. Accordingly, this document explains what information Netlink, as a local tool, processes on your device, which third-party services it may reach during inspection, and how to interpret results under restricted or weak network conditions.

2. What this app never does

3. Information processed on your device

To complete a network environment inspection, Netlink reads, computes, and displays the following information locally on your Mac. It is used by the app on-device only; we do not collect or upload it:

The hardware and system information above is used only to show your current device environment in the app UI and is stored locally. Hardware identifiers -- including the device serial number, network interface MAC addresses, and display serial info -- never leave your device, are never sent to any third-party service, and are never used for user identification, device fingerprinting, or tracking of any kind. The device serial number and MAC addresses are shown masked in the app by default until you choose to reveal them; report exports and diagnostics exports never include the device serial number, MAC addresses, or display serial info.

Data bundled with the app: the country and operator (AS name) of a public IP, VPN / data-center / Tor exit flags, the location of each hop in a path trace, and the time zones that belong to an exit country all come from data files installed with the app and are looked up on your Mac, with no network request and without sending your IP to any service. The data comes from DB-IP (the DB-IP Lite databases, licensed CC BY 4.0), the X4BNet VPN and data-center lists (MIT license, expanded with public-domain iptoasn data), supplementary data-center and VPN ASN tables maintained by the developer (based on public registrations at the regional internet registries, bundled with the app), the Tor exit list published by the Tor Project (CC0, IPv4 only) and data published by IANA (the time zone mapping is public domain, the RDAP bootstrap tables are CC0); credits and the full license text are under Settings › About. These lists are updated with app versions and may lag behind; not being listed does not mean there is no risk. On macOS 26 and later, city-level location data is delivered as an Apple-hosted asset pack that the system downloads in the background; while it downloads or when it is unavailable, the Public IP page shows "City data downloading / unavailable", and on macOS 14 / 15 locations stop at country level.

4. Information stored on your device

Netlink stores necessary app state locally so the most recent inspection can be restored on next launch:

This data lives on your Mac (with iCloud sync on, the score history, IP history and environment profiles also have a copy in your own iCloud private database). Uninstalling the app or manually clearing its data may remove these local records. You can also use "Clear Inspection Traces" in Settings › Privacy at any time to delete the inspection snapshot, IP history, score history, event timeline, environment profiles, the change history of scheduled AI service probing, per-stage timing statistics for the last 10 inspections, the desktop widget snapshot, the speed test history, the line baseline records and the certificate check results, and to clear the Pro probe results of the current session and the in-memory caches (the certificate monitor's domain list, app settings and purchase state are unaffected). When iCloud sync (Pro) is on, you can also tick "Also delete data in iCloud" to delete the score history, IP history and environment profiles in iCloud as well; records already synced on your other Macs are cleared too, and ones not yet uploaded are kept.

iCloud sync (optional, Pro, off by default): it is enabled only if you have purchased Pro and turn it on yourself in Settings › Privacy › iCloud Sync. When on, the score history and IP history (including inspection time, exit IP, IP version, country / city, carrier, proxy / VPN flags, deduction codes and an inspection summary: network access type, DNS server count, gateway latency, system proxy types, reachable-site count) and environment profiles (LAN segment, network access type, DNS servers, latest exit IP, exit country and score, first / last inspection time and count) are stored in your own iCloud private database and synced between Macs signed in to the same Apple Account; the content of each record is encrypted on your device by Apple's CloudKit before upload, so the developer cannot access it. Record names do not contain plain-text IP addresses. Each record carries a random install identifier (no device name or hardware information) so that the app can tell which Mac it came from. Sync uses your own iCloud storage. Settings, the desktop widget snapshot and purchase state are not part of this sync. Turning sync off does not delete the records already in iCloud; you can tick "Also delete data in iCloud" when you use "Clear Inspection Traces" to delete them (records already synced on your other Macs are cleared too, and ones not yet uploaded are kept), or delete this app's iCloud data under System Settings › your name at the top of the sidebar › iCloud › Manage. When Netlink finds that its cloud data has been deleted, it turns sync off automatically and your records on this Mac are unaffected.

The free-run usage records for each diagnostic and network tool, the time-calibration record used to help prevent those records from being tampered with, the cached purchase-unlock state (local only, never uploaded; used to show the purchased state sooner at launch), and the signing key used to verify them, are additionally stored in the local macOS Keychain; after uninstalling the app, these Keychain entries may still remain; to have the Keychain entries removed, contact [email protected].

Since version 2.2.0, the counts and dates in the free-run usage records above are also kept in your own iCloud key-value store, so that they stay consistent across reinstalls and multiple Macs; the developer cannot access them. This copy is not removed by uninstalling the app or by "Clear Inspection Traces", and the developer cannot delete it on your behalf.

The desktop widget snapshot is stored in the shared container ~/Library/Group Containers/L59DPZ37AM.com.netlink.app/; "Clear Inspection Traces" deletes it as well, and the widget returns to its "No inspection yet" state. macOS may keep this shared container and the app's data folder after you move the app to the Trash; to remove them completely, quit Netlink, choose Go › Go to Folder in Finder, open ~/Library/Group Containers/ and ~/Library/Containers/, and delete the L59DPZ37AM.com.netlink.app folder in the former and Netlink's folders in the latter (actually named com.netlink.app and, for the widget, com.netlink.app.widget; Finder may show them by the app's name, such as "Netlink" or "网连").

Report export (PDF / Markdown / JSON / CSV / share-card PNG) is generated entirely on your device, and you choose the save location in the system save panel. Exporting makes no network requests, and exported content is never uploaded to the developer or any third party.

"Export Diagnostics" in Settings is likewise generated entirely on your device: it contains the app version, macOS version, a summary of your current settings, and a redacted copy of the last inspection (IP addresses partially masked), saved as a text file to a location you choose. It is written only when you explicitly export it and is never uploaded. Diagnostics exports also include per-stage timing statistics for the last 10 inspections (no IP addresses included), stored locally and cleared together when you use "Clear Inspection Traces".

5. Third-party network services

Netlink itself collects nothing and sends nothing to developer servers. Some inspection features require your device to contact third-party services directly to determine the public exit, IP geolocation, proxy/VPN flags, risk, and connectivity. When these services are contacted, your public IP address and ordinary request metadata are received by the respective third party -- this is inherent to performing a live lookup. Except for the cases listed under "Automatic network activity" at the end of this section, the requests below happen only when you start a check yourself.

Third parties that receive data

In accordance with Article 23 of the Personal Information Protection Law of the People's Republic of China, we tell you, for each recipient, its name, contact details, purpose of processing, method of processing and the types of personal information, and we obtain your separate consent before you first use any online inspection (see Section 10, "Consent and withdrawal"). Netlink has no servers of its own; your device sends the data directly to these third parties and the developer neither handles nor receives it. How a third party treats the requests it receives is governed by its own privacy policy and terms. The date after each privacy contact is when we last opened its official page to check it.

In addition, for the targets you enter or add (custom sites on the Connectivity page, domain diagnosis, the connection timing breakdown, TCP ping, port check, HTTP headers, etc.), Netlink sends requests to those targets themselves at your command; your system DNS server and operator also see the DNS queries your system sends. Details follow in the entries below.

Automatic network activity: besides checks you start yourself, while Netlink is running it goes online automatically in the following cases, using only the services listed above:

See Section 10 for how to turn these off.

In addition, the connection timing breakdown and domain diagnosis (port reachability, TLS certificate chain) send network requests, at your command, directly to the URL or domain you enter; the target server therefore receives an ordinary network request from your device. Please use these features only against targets you are entitled to test.

With a system proxy on: requests that Netlink sends over HTTP / HTTPS -- including "HTTP headers and redirect chain", "IPv6 dual stack" and "Certificate check" on the Tools page, ASN and registration lookups, multi-location probing, and the outage check's requests to the target URL -- follow your system proxy settings as a browser would, so the proxy server sees those requests; TCP ping, the port check, the exit self-check's STUN (UDP) request, reading the PAC configuration file, and the plain DNS queries made with "System DNS" do not go through a proxy and are sent directly from your Mac.

These services are operated by their respective providers. We do not receive or store your personal information from them; how they handle access logs, IP addresses, and request metadata is governed by their own privacy policies and terms.

External entry points: Netlink supports netlink:// links, Shortcuts (read latest result, start an inspection, open a page, diagnose a domain), the system Services menu, the Share menu and the Control Center control (macOS 26 or later). These entry points accept only a fixed whitelist of actions and parameters; the ones that diagnose a domain only fill the domain into the "Domain deep diagnosis" page and never start it automatically -- whether to start is up to you. "Netlink" in the Share menu is a system extension: it only extracts a domain from the URL or text you share and hands that domain to the main Netlink app through a netlink:// link; the extension itself has no network entitlement, does not go online or upload anything, and does not read or write the free-run counts or purchase state. A full inspection triggered from Shortcuts or an external link only opens the window, without re-running, if the last inspection from any source was too recent, and is limited to a number of times a day; the desktop widget's Inspect button and the Control Center control are tapped by you, and never start a second run while one is in progress.

6. Reachability under restricted or weak networks

Some third-party services and connectivity targets may be unreachable in certain regions due to local policy, routing, carrier behavior, or the services' own restrictions. Unreachable does not necessarily mean your local network is broken.

When a public or risk lookup fails, Netlink shows the failure reason. If a previous successful result exists on disk, the app may display it clearly labeled as the last successful result; it should not be read as a fresh successful inspection.

7. Purposes

Netlink processes the information above on-device only to:

8. Data sharing

We do not collect, upload, or share your local inspection records. Provided you have agreed to where your data goes (see Section 10), when the app contacts third-party services, those services receive your public IP address and request metadata as part of the network request; the third parties that receive data are listed one by one in Section 5. The ASN and registration lookup on the Tools page sends only the IP or AS number you enter, and only when it is managed by RIPE NCC, to RIPE NCC; global DNS / HTTP, path trace and the outage check send the domain or URL you enter to the Globalping volunteer probe network, whose measurement data is public; an API key you enter yourself is sent only to the service it belongs to. All of these are queries you start or turn on yourself. Beyond that, Netlink never submits your hardware overview, history, or app settings to any third party.

9. Data security

Netlink runs inside the system sandbox with outbound-only network permission (no inbound listening). A full inspection measures how quickly your router (default gateway) and the DNS server configured on your local network respond, to check your local network connection; this triggers the system's Local Network permission prompt, which you can simply allow; when you enter an address on your local network in a tool (TCP ping, port check, HTTP headers and redirect chain, etc.) or in domain diagnosis, the app likewise connects only to the address you entered, which can also trigger this prompt. The public data endpoints the app contacts itself all use HTTPS, except that the exit self-check sends one unencrypted STUN (UDP) request to Cloudflare and captive-portal detection sends one fixed plain-HTTP request to Cloudflare's 1.1.1.1 (see Section 5; it contains no personal data); addresses you enter yourself (custom sites on the Connectivity page, the connection timing breakdown) are accessed with the scheme you give, defaulting to HTTPS when none is given. The DNS chain probe sends queries for the fixed name www.apple.com (one A and one AAAA query) over plain UDP port 53 to the DNS server configured on your system, as the DNS protocol itself does, plus up to 5 resolve-time-sampling queries, up to about 7 per full inspection; this part sends only fixed domain names, no personal data, but it does not go through the system's encrypted DNS profile. The reputation stage additionally issues one reverse DNS (PTR) lookup through the system resolver -- its query name is your public exit IP reversed, and therefore contains that IP -- likewise via the DNS server configured on your system, with the result used only on your Mac. The port reachability check in domain diagnosis makes TCP connection attempts to ports 80, 443, 22, 21, 25, and 8080 of the host you specify (once per round, in the first 3 rounds of a diagnosis only), solely to determine whether a port is reachable -- the connection is closed immediately after it is established, no application data is sent, and nothing personally identifiable is transmitted. Note that any internet request may be logged by the target service with access time, IP address, User-Agent, and other basic request information.

10. Your controls

On first launch, the "Data Sharing" step of onboarding lists the third parties in Section 5 one by one; on the first launch after updating to this version, a consent dialog opened in the main window does. It shows the name, privacy contact, purpose, method of processing and types of personal information, and you choose "Agree and Continue" or "Don't Agree" separately; until you agree, Netlink does not contact these third parties (in-app purchase, the Apple-hosted asset pack download, and the iCloud key-value sync of the free-run counter and iCloud account-status check are handled by Apple's system services and are not covered).

11. Children's privacy

Netlink is not designed for children and contains no social, advertising, account, or profiling features. We do not knowingly collect personal information from children.

12. Changes to this policy

If Netlink later adds accounts, developer-operated servers, ads, analytics SDKs or new third-party services, or widens what iCloud sync covers, we will update this policy and the App Privacy information in App Store Connect accordingly. (Report export shipped in version 1.5.0; its privacy practice is described in Section 4 -- generated entirely on-device, never uploaded.)

13. Contact

Operator: the Netlink developer.

If you have questions about this policy or how data is handled, email [email protected] or visit the support page.

Support emails you choose to send us (including your email address and the message content) are used only to answer and troubleshoot that request and for no other purpose. The in-app "Send Feedback" panel lets you optionally attach diagnostic info and a screenshot of the current main window: diagnostic info includes the app version and build number, macOS version, interface language, the time / score / grade / deduction codes of your last inspection, error codes, access type (Wi-Fi / wired, etc.), which system proxy types are on, IPv6 availability, and whether you're on the free or Pro tier -- it never includes an IP address, DNS server address, proxy address, or hardware identifier. The screenshot (optional, unchecked by default) captures the current main window; if the window is showing your public IP or similar info at that moment, the screenshot may include it -- whether to attach it is entirely your choice. None of this is actually sent until you click Send in your own mail app.

This document describes the privacy practices of the current version of Netlink and is not legal advice.