- Permanently delete
- Cleanup goes to the Trash, so you can put it back yourself until you empty it. There is no other delete path in the product, and no Empty Trash button.
- Move, then hope
- A move copies first, verifies a BLAKE3 manifest of every file, keeps a sibling backup, links the original path, verifies the link, and only then commits.
- Act on stale evidence
- Every item is revalidated immediately before an action. Anything that changed since the scan is refused, with the reason — including a folder whose owning application is running right now.
- Follow a symlink
- Not while scanning, copying, building a manifest, rolling back or cleaning.
- Open your libraries
- Photos, Music and TV libraries and iCloud documents are refused by bundle type, in every permission state.
- Send a path anywhere
- No path, filename, inventory, size, count, recipe match, volume name, machine code or key is transmitted, ever. MakeRoom contacts nothing: an install that has run for a year and moved a terabyte has opened no socket.
- Phone home about a crash
- No analytics SDK and no crash reporter ships. A failure is recorded in a local log that writes [REDACTED] in place of every path, and if you want someone to read it you export the archive, see what it holds before it exists, and send it yourself.
- Update itself behind you
- The one contact MakeRoom may ever make is a version check you switch on in Settings. It carries two version strings, reads one number, and opens a download page compiled into the app — never an address the answer supplied. It downloads nothing and installs nothing.
- Trust a drive by name
- Drives are identified by volume UUID. A same-name drive with a different UUID is rejected; the same drive at a new path repairs itself.
- Run as root
- No privileged helper and no root entitlement. MakeRoom runs as you, with the access you already have.
- Let a program decide
- The agent endpoint is off until you switch it on. It drives the same operations you do, one at a time, and cannot decide what is safe to clean, grant itself access to a folder, resolve a judgement, or switch itself back on.
- Lock you out of restore
- Bringing data back, repairing a link and reconnecting a drive are never gated, in any entitlement state, including none at all.