SiftawayWhat Siftaway never touches, and why
A cleaner earns trust by what it refuses to do. This page is the whole safety model, in the order the checks run.
1. Nothing is deletable by default
Most cleaners assume a folder can go and keep a blocklist of dangerous paths as a backstop. A blocklist is never complete, and the path it misses is a data loss. Siftaway works the other way round: a path can only be touched when a published rule names it.
There are 73 cleanup rules and 9 protection rules. All 82 are listed, with their paths, on the rules page. There is no “clean arbitrary folder” feature.
Refusals are always whole. If a directory fails a check, Siftaway does not shrink the job to “just one subfolder”. It leaves the entire item alone and tells you why. A partial run means you believe A was removed while B was touched, which is worse than doing nothing.
2. The never-delete list
These are refused no matter what a rule says. If the rule set were wrong, or even maliciously replaced, this layer would still hold.
| Location | Why it is off limits |
|---|---|
~/.ssh ~/.gnupg ~/.aws ~/.kube ~/.docker/config.json ~/.local/share/keyrings | Credentials. No download brings them back. |
~/Documents ~/Desktop ~/Pictures ~/Movies ~/Music | Your own files. They are not caches. |
~/Library/Keychains | The keychain. |
~/Library/Mobile Documents ~/Library/Group Containers | iCloud syncs local deletions to the cloud, so there is no safe “local copy only” here. |
~/Library/Mail ~/Library/Messages ~/Library/Safari ~/Library/Accounts ~/Library/Cookies ~/Library/Preferences | Mail, messages, logins, bookmarks, settings. |
~/Library/Application Support/MobileSync | Local iPhone backups, often the only copy. |
~/.ollama/models ~/.lmstudio/models ~/.cache/huggingface ~/.cache/torch ~/.cache/whisper ~/.cache/tensorflow ~/.cache/wandb | Model weights. Tens of gigabytes and slow to fetch, so “costly to rebuild” is as good as irreplaceable. |
~/.cache/pypoetry/virtualenvs | Virtual environments may contain packages you patched by hand. |
/System /usr /bin /sbin /etc /Library/Keychains /Library/Extensions /Library/LaunchDaemons /Library/LaunchAgents /Applications /Volumes | The operating system, installed apps, and other disks. |
/usr/local /opt/homebrew | Homebrew’s territory. Cleaning it is brew cleanup’s job. |
| Your home folder, and any of its top-level folders as a whole | ~/Library or ~/Downloads is too coarse; anything could be inside. A target must be at least one level deeper. |
Paths are also refused when they are relative, contain .. or control characters, pass through a symbolic link anywhere along the way, or contain fragments such as /Keychains/, /.ssh/, /Mobile Documents/ or /Photos Library, which inside a “cache” folder usually mean it holds real data.
3. Everything is checked again right before it moves
Minutes can pass between a scan and your click on Confirm. You may have switched branches, reinstalled dependencies, or mounted a disk at the same path. So each item is re-verified at the last moment:
- Same object. Device and inode must match what the scan saw. If the folder was deleted and recreated, it is skipped.
- Not a link, same volume. A path that became a symlink, or now lives on another volume, is refused.
- Not in use. If a process has files open there, the item is skipped. If the probe fails or times out, the item is also skipped: when unsure, Siftaway does nothing.
Skipped items are reported with the reason. Nothing is skipped silently, because you would assume it had been removed.
4. One destination: the Trash
- Cleanup uses the same system call as dragging to the Trash in Finder. There is no hard-delete code path and no “skip the Trash” option.
- Siftaway never empties the Trash, not even its own items. Space is reported as freed only after you empty it yourself.
- “Undo this cleanup” restores exactly the items from that run to their original paths. If something new already exists at a path, that item is left in the Trash rather than overwriting it.
- Siftaway never asks for administrator rights. System-level locations are reported, not modified.
- Startup Items are disabled through launchd, which keeps the choice in its own override database. The plist file stays where it is, so re-enabling is one click.
5. A rule update can never quietly widen what gets deleted
Changes that narrow the rule set (an extra exclusion, a removed rule, a higher risk level) apply on their own. Changes that widen it (a new path, a lower risk level, a shorter exclusion list) need your explicit confirmation, shown at the moment you start a scan together with what they would add on your Mac. Even an approved rule cannot override the never-delete list above.
Found a hole?
Tell us at support@siftaway.com. A path that should be protected and is not is the most serious kind of bug this product can have, and it is treated that way.