NetSweep doesn't collect anything from you. There are no accounts, no analytics, no SDKs. This page exists to explain — in plain language — what little leaves your device, why, and where it goes.
Last updated: July 2026 · NetSweep 1.0
TL;DR. Your watchlist, your inspection results, and your settings stay on your device. NetSweep makes outbound requests only to the hosts you explicitly pinned (the same kind of requests a browser would make) and to three named public APIs (your public IP, NVD, crt.sh) when you use those specific features. No personal information is ever sent.
All of this is stored in SwiftData on your device. None of it is synced to a server NetSweep operates, because NetSweep doesn't operate any servers.
NetSweep makes outbound network requests in five categories. Each is named, scoped, and only sends the query needed for the feature.
When the Inspector runs (manually or via background refresh) NetSweep makes the same kinds of requests a browser would:
These are addressed to the host you chose to watch. Nothing about you is sent beyond a polite User-Agent: NetSweep/1.0 (+inspect).
When the Inspector finishes a TLS handshake it auto-searches the public NIST NVD catalog by the apex domain of the host. The CVE Search tool also queries NVD by the keyword you type. The query goes to services.nvd.nist.gov. Results are cached on-device for 5 minutes to avoid duplicate round trips. NetSweep sends only the search keyword.
The Inspector queries crt.sh for recent CT log entries matching the apex domain. crt.sh is operated by Sectigo as a free public service. Only the domain you're inspecting is sent.
The home canvas and the Connection screen show what the public internet sees of your connection (your IP, ISP, ASN, approximate region). That lookup hits ipwho.is. The result is shown only to you.
If you tap Run Test on the Connection screen, NetSweep measures latency with a TCP connect to 1.1.1.1:443 and downloads ~1 MB from speed.cloudflare.com to estimate throughput.
PrivacyInfo.xcprivacy) marks NetSweep as non-tracking, with no collected data types and a single Required-Reason API declaration (UserDefaults, category CA92.1).If you turn on the Watchtower's expiry alerts, NetSweep schedules local notifications on your device 30 / 14 / 7 / 1 days before any watched cert is set to expire. These are local — they're computed from data already on your device and posted by iOS's UserNotifications framework. No remote push, no notification server.
NetSweep registers a single BGAppRefreshTask with iOS. When iOS chooses to run it, NetSweep re-inspects every watched host whose last inspection is older than ~12 hours. The same outbound rules above apply. You can disable Background App Refresh for NetSweep in Settings → General → Background App Refresh.
NetSweep registers an "Inspect Website" App Intent and a netsweep://inspect URL scheme so Siri, Shortcuts, Spotlight, and other apps can hand a URL to NetSweep. These pass only the host you chose to inspect — no other context — into the same in-app Inspector flow.
NetSweep doesn't collect personal information from anyone. It is not directed at children, and it does not knowingly process information about children.
If this policy ever materially changes, the Last updated date at the top will change too, and a note will appear in the in-app About panel.
Mail the developer at camgarrison.com.