Safety & security

Facts you can check, not badges we made up. Omnibus holds no certification of its own; where a provider holds one, we name the provider.

CleanPanda looks at your files only on your computer: their names, sizes and dates, and for duplicates their contents. Your files, their contents and the lists of what was found are never sent to us or to anyone else. There is no account and no sign-in, no analytics or usage statistics in the app, and no advertising.

GDPR (EU and UK): your files are processed only on your computer. Error reports rely on our legitimate interest in keeping the app stable and secure; you can object by turning Send diagnostics off. Reports go to the USA under Standard Contractual Clauses.

California (CCPA/CPRA): we do not sell or share personal information, and we do not use it for advertising.

Read more: Privacy policy · EU & UK (GDPR) · United States · Canada (PIPEDA, Law 25)

CleanPanda processes your files, including any that hold protected health information, only on your computer. They never reach us, so we do not receive or store PHI. Your organization stays responsible for its HIPAA compliance; we do not sign Business Associate Agreements.

Error reports go to Sentry (Functional Software, Inc., USA), which holds ISO 27001 certification and a SOC 2 Type 2 report. A report contains the error and its message with your home folder, user name, file paths and quoted text removed; the stack trace; the app and system versions; the computer model; a random installation identifier; and, as with any internet request, your computer's IP address. Crash reports are always sent; other errors and logs only while Settings > Privacy & data > Send diagnostics is on (it is on at first). Your files and their contents never are.

Read more: Sentry's security and compliance page

Website purchases are handled by Lemon Squeezy, the merchant of record. Lemon Squeezy is a Stripe company, and card payments run on Stripe's infrastructure, which holds PCI DSS Service Provider Level 1 certification. We never see your card. If you buy the Mac App Store edition, Apple handles the purchase, payment and refunds; if you buy the Microsoft Store edition, Microsoft does.

Once you activate a license, the key, its activation ID and the email address it was bought with are kept in the macOS Keychain; on Windows, in a file that Windows encrypts for your user account (DPAPI). Only if that protected store cannot be opened do they stay in the app's preferences. License checks send the key, the activation ID and an anonymous device label, never your computer's name.

The app lists the open-source software it is built with, and each license, under Settings > Legal > Open-source licenses.

The protection list lives in the engine. Everything is refused unless it passes through one narrow door: an item you picked on the disk map, a cleanup rule's exact pattern, an app leftover named after the app's exact bundle ID, or a few other tested doors. Every door also refuses:

• the inside of app packages, Photos and Music libraries, keychains and cloud storage folders
• the rest of browser profiles, Apple's own files and system folders
• your home and standard folders themselves, and other users' files
• every place on your “Never clean this” list, its contents and the folders that contain it

If the “Never clean this” list cannot be read, nothing is removed. Each door has tests that try neighboring paths, and the safety rules were deliberately broken 111 ways to make sure the tests catch every one.

Right before each item moves, CleanPanda checks it again: protection list, still there, same kind, not a link, owner, not cloud-only, not on a connected disk, size, app not open, bundle ID. Anything that changed is skipped with a reason. A move is recorded first, then made, then marked complete, and is never cut halfway.

Removals go to the system Trash. Undo from Activity puts items back where they were and never writes over anything. Permanent deletion happens only when you empty the Trash with explicit confirmation, when you turn on “Delete Safe items right away” (off by default), or when you run a command that needs your password.

There is no privileged helper running in the background and no Touch ID for sudo. Work that needs an administrator password uses fixed commands written in the code, shows the exact command first, and asks through macOS's own password prompt every time. Paths and names are validated and passed as arguments, never as script text. On Windows, the same work goes through the UAC prompt.

• No account, no usage tracking, no advertising; error reports go to Sentry without your files (like any internet request, they carry your IP address), and everything but crash reports can be turned off in Settings
• License checks with Lemon Squeezy send an anonymous device label, not your computer's name
• App update checks run only when you ask; app update feeds are read over HTTPS only, with a 15-second timeout, a 5 MB limit and a plain CleanPanda user agent
• CleanPanda's own updates are off until you turn them on
• The app permissions database is opened read-only; extra permissions are requested only when you turn on the feature that needs them

• HTTPS only, with HSTS, a strict Content Security Policy and framing disabled
• Same-origin checks on every form submission
• Contact form protected by Cloudflare Turnstile with single-use tokens
• No third-party scripts before consent, except the spam check on the contact page

Reading, labeling, duplicates, the protection doors, the move to the Trash and Undo, step by step.

Read the technical overview →