Is Keepresso safe? Open source and notarized

Keepresso is free and GPL-3.0-licensed, with public source code. The developer signs releases with a Developer ID certificate, and Apple notarizes them. Those checks identify the publisher and check the distributed app for known malicious content; they do not replace reviewing what its features can access.

What permissions it asks for

An ordinary keep-awake session does not need Accessibility, camera, microphone, calendar, Bluetooth, or location access. Optional features request additional access when you enable them:

• Administrator approval, for privileged operations such as closed-display mode, AWDL pausing, fan control, game CPU priority, scheduled wake, Keyboard Cleaner, and DNS flushing. Approve the helper once to use these operations without repeated password prompts.
• Location, only if you use a Wi-Fi trigger, because reading the current network name needs it on modern macOS. Nothing else uses your location.
• Accessibility, if you select a keyboard or mouse method for Keep me active. The default macOS activity-reporting method does not need it. Keyboard Cleaner uses the administrator helper instead and does not request Accessibility access.
• Calendars, if you enable a calendar trigger. macOS asks for full calendar access; Keepresso uses events to decide when to hold the Mac awake. Leave that trigger off if you do not want to grant access.
• Bluetooth, if you add a trigger for a paired Bluetooth device. This lets Keepresso list paired devices and check whether the selected device is connected.
• Notifications, for reminders and optional session, trigger, automation, battery, and thermal notices.

You can review or revoke these grants in System Settings → Privacy & Security, and manage notifications in System Settings → Notifications. Turn off the corresponding feature in Keepresso if you no longer need it. Administrator-helper removal is described in the helper guide.

What it does not touch

• No camera or microphone permission. The meeting trigger reads only the system signal that a camera or mic is in use, the same thing that lights the dots in your menu bar. It never opens a stream.
• No trackers, no analytics, no account.

Guardrails you might not notice

A few deliberate choices keep the sharp edges covered:

• Imported settings cannot run commands unseen. Importing a settings file brings in any shell-command event hooks switched off. You review and re-enable the ones you trust under Preferences, Automation, so a shared or downloaded settings file cannot run a command behind your back.
• Automation stays on your terms. Automation leases are bounded and self-expiring, a switch turns them off entirely, and letting automation change the system wake schedule is a separate opt-in that is off by default.
• Updates are locked down. The auto-updater is pinned to an exact Sparkle version with its signing tools verified by checksum, and every release is signed and notarized. The agent-hook and administrator-helper commands are hardened against untrusted input.

Why it is not on the Mac App Store

Keepresso's privileged helper and system-level features, including closed-display overrides and AWDL controls, require capabilities outside the App Store sandbox. Basic keep-awake functionality can exist in a sandboxed app. Keepresso distributes its full feature set through signed, notarized releases on GitHub and Homebrew.