Mopup › Safety

What Mopup deletes, and what it never touches

A cleaner should say exactly what it removes. These are the rules Mopup follows. Every file it is about to delete or move to the Trash is checked against them first, whichever part of the app found it.

You see everything first

Scanning only reads. Before anything is removed, each item shows its size and what removing it means.
Every item is marked Safe or Your call. Safe means your tools make it again, like caches and build output, or it can no longer be used. Your call means you might want it back, like Xcode archives, an emulator, an old iPhone backup or what's in the Trash. Your call items are never ticked for you.
Nothing is removed until you ask for it. Two things can run on their own, and both stay off until you turn them on in Settings: the weekly automatic clean, which needs a plan and only ever cleans items marked Safe, and stopping dev servers that have sat idle.
Every clean goes into a history on your Mac: when, from which section, how much it freed and the names of what was removed.

Deleted, or moved to the Trash

What	What Mopup does
Caches and build output, like Xcode's DerivedData, npm and Homebrew caches, and node_modules in old projects	Deletes them, since your tools make them again. The next build or install takes a little longer.
Files you pick in Large Files, Duplicates or the Storage map	Moves them to the Trash, so you can put them back.
Apps you uninstall, with their settings and data	Moves them to the Trash. An app's data only goes once the app itself has gone.
Settings and data of apps you've already removed	Moves them to the Trash. A removed code editor's extensions and settings are deleted instead, and are your call.
Installers in Downloads, and macOS installers in Applications	Moves them to the Trash. An installer for a newer macOS than your Mac runs is your call.
Claude's Cowork virtual machine and Cursor's old database backup	Deletes them, only once you've quit Claude or Cursor. The virtual machine is your call, since Claude downloads it again for Cowork.
Everything in the Trash	Erases it only if you tick it.
Docker's build cache, images, stopped containers and unused volumes	Has Docker remove them, with Docker's own commands.
Simulators Xcode marks unavailable	Has Xcode's simctl tool delete them.
Time Machine snapshots on your Mac	Has Time Machine's tmutil tool delete them, only when you ask and through macOS's password dialog. Your backups on the Time Machine disk stay.
Git worktrees you're done with	Has git remove them, never forced. See below.

What Mopup never touches

Your documents, Photos library, source code and git history are never part of a cleanup.
Cursor's chat database is never cleaned. When it grows large, Mopup shows how to shrink it from inside Cursor.
Passwords and keys: your keychains and the .ssh, .gnupg, .aws and .kube folders are never deleted or moved to the Trash.
Your own folders: Documents, Desktop, Downloads, Pictures, Movies, Music, Public, iCloud Drive and other cloud drives, Mail, Messages and your apps' preferences. Nothing in them is ever deleted outright. A file there only goes to the Trash when you choose it.
The folders macOS and your apps rely on, like Library, Application Support, Caches and Containers, always stay. Only what's inside them can be cleaned.
No folder that sits directly in your home folder is ever deleted, apart from Dart's analysis cache and the extensions and settings of code editors you've uninstalled, like .vscode or .cursor, which are your call.
Nothing outside your home folder, except apps you choose to uninstall, macOS installers, Time Machine's snapshots on your Mac and one cache Yarn leaves when it runs with sudo. The snapshots and that cache can only go through macOS's own password dialog. Mopup never sees or keeps your password.
A symbolic link never leads Mopup out of your home folder. Removing a link removes the link, not what it points to.

Code, git, Docker and dev servers

A project folder counts as generated only when the file that makes it sits next to it: node_modules beside a package.json, target beside a Cargo.toml, build beside a pubspec.yaml or a Gradle file. Python environments are your call.
A worktree counts as done when its branch is merged, or its pull request merged on GitHub, asked through your own gh command so squash merges count, and it holds nothing but generated files. Mopup lists any ignored files inside, such as .env, before you remove it.
Removing a worktree runs git worktree remove, never --force, so anything uncommitted stops it. The branch and its commits stay. A worktree with commits that are on no branch is never removed.
Docker is cleaned only through the docker command, and only on this Mac's engine, never one on another machine. Stopped containers and unused volumes are removed by the names found when scanning, so a volume a stopped container still holds is never among them. Only the build cache is ticked for you.
Stopping a dev server sends it and everything it started the standard request to quit. Apps such as Docker Desktop are asked to quit like any other app.

Permissions

Full Disk Access is optional. Without it, Mopup leaves other apps' private data out of its scans, so macOS doesn't keep asking, and it doesn't offer to empty the Trash.
Uninstalling an app that belongs to another account, as App Store apps do, or that macOS protects, goes through Finder, which asks for your password the way it does when you drag an app to the Trash.

What leaves your Mac

Nothing about your files. Scans, file names and sizes stay on your Mac. Mopup uses the network only to check for updates, to ask GitHub which pull requests merged and, with a yearly plan, to fetch your renewed license. The privacy page has the details.

If something goes wrong

Files and apps moved to the Trash can be put back from the Trash until you empty it.
Caches and build output come back the next time your tools need them.
Write to support@mopup.online with what you cleaned. Mopup's history shows it. You'll hear back from the person who makes Mopup. Who that is.

Download free See plans