Pharos privacy policy
Last updated 9 August 2026.
Pharos collects nothing about you and sends nothing anywhere you did not configure. The rest of this page is the detail behind that sentence.
What is collected
- No analytics. None.
- No telemetry. None.
- No crash reporting. None.
- No account. There is nothing to sign in to, so there is no profile, no identifier, and no record that you use the app at all.
How that is enforced
This is not only a policy. Pharos ships with a check that runs on every release build and fails it if the binary links against networking symbols outside the narrow set the backup engine needs. A build that could quietly phone home does not get released, because it does not compile into a release in the first place.
The bundled restic binary is integrity-checked at every launch, so a
substituted binary with different behaviour does not run.
Every network connection Pharos can make
There are exactly two kinds, and you create both.
- Your backup repositories. If you configure an S3 bucket, a Backblaze B2 account, Azure Blob Storage, an SFTP host, or a restic REST server, Pharos connects to it to write your backups. Your data is encrypted on your Mac before any of it leaves. A repository on a local disk involves no network at all.
- A Prometheus Pushgateway, if you set one up. This is off unless you turn it on per plan. It pushes run metrics: whether a backup succeeded, how long it took, how many bytes and files were involved. It does not push file names, file contents, or paths. Credentials for it live in the Keychain, not in the configuration file and not in the logs.
That is the complete list. There is no server operated by the developer, so there is nowhere else for anything to go.
Credentials
Repository passwords are stored in the macOS Keychain and never written to disk
in plaintext. They are handed to restic over a dedicated channel that zeroes
itself afterwards, so they do not appear in the process table, in shell history,
or in a crash log.
Diagnostics are scrubbed before they leave the app. Both the copy-to-clipboard button and the log export bundle strip credentials out of repository URLs, environment variables and access keys first, so a log you send for support does not hand over access to your backups.
Files
- Pharos reads only what you point it at. Access is granted through the standard macOS file picker and held as a security-scoped bookmark, one per folder you chose.
- The App Store build runs inside the App Sandbox. The direct download build, when it is released, does not; it is bounded by code signing, the Hardened Runtime, and macOS privacy controls instead, and asks for Full Disk Access explicitly. Neither build requests a sandbox exception entitlement.
- Logs stay on your Mac unless you export a bundle and send it somewhere yourself.
Apple, and changes to this policy
Pharos is distributed through the App Store, so Apple handles the download and any purchase. Whatever Apple records about that is governed by Apple’s privacy policy and by your own device settings, and is not visible to the developer beyond the aggregate figures Apple shows every developer.
If this policy changes, the date at the top changes with it and the change is noted in the changelog. Questions go to support at spqr dot dev.