Are cheap or free Mac notch apps safe? What each app states
Price does not tell you whether a notch app is safe. Free apps vary: some are open source and say they are unsigned, and some say they are notarized. Paid apps vary too, in what they collect. The useful question is what each app states about signing, source code and data. This page lists those statements, not opinions. Prices as of 4 November 2026.
What “safe” can mean here
A notch app sits at the top of your screen and often reads your clipboard, calendar, camera or now playing. Three things help you judge it. Is it signed and notarized, which means Apple scanned it? Can you read the source code? What does its own page say it collects? None of the three proves an app is safe, and none of them proves it is not. They tell you what to check.
“Not stated” below means the page that was read did not say. It does not mean the app does it or does not.
Free and open source apps
| App | License | Signing, as the page states it | Data, as the page states it |
|---|---|---|---|
| Boring Notch | GPL 3.0 | README says the team has no Apple Developer account yet, so it is not signed with a Developer ID. First launch needs a Terminal command, Open Anyway in System Settings, or Homebrew | Not covered in what was read |
| MewNotch | GPL 3.0 | README says it is unsigned and macOS may warn on first launch | Not covered in what was read |
| NotchBar | AGPL 3.0 | README footnotes mention a Gatekeeper popup; the version is a pre release, 0.0.3.2 | Not stated |
| Vibe Notch | Apache 2.0 | Not stated | README says it sends anonymous usage data to Mixpanel |
| Notchi | GPL 3.0 | Not stated | Optional sentiment analysis sends prompts to Anthropic or OpenAI only if you add an API key |
| AgentNotch | MIT | Notarized app, per the v1.0.0 notes | README says it runs 100% locally |
| Top Notch (techuila) | MIT | README says builds are Developer ID signed and notarized | README says no analytics and no account |
| NotchPop | MIT | Not stated | No privacy policy page is linked |
The pattern is that open source gives you the source, and signing is a separate choice the makers make. Boring Notch and MewNotch tell you plainly that they are not signed, which is honest and also means you carry the first launch step. Boring Notch has about 2 million downloads of its stable releases on GitHub, which shows use and says nothing about safety. If you want to read what you run, the open source list is the place to start.
Cheap and paid apps
| App | Price | What its pages state |
|---|---|---|
| NotchStar | $4 once | Closed source. Developer ID signed and notarized. No account. Activating a license sends the key and the Mac’s name to Dodo Payments. Anonymous version info only if you opt in |
| Tuneful | $4.99 once | App Store privacy label says Data Not Collected. Source on GitHub, with no license |
| Notchet | $9.99 once | Closed source. Clipboard stays on the Mac. Contacts the internet for the license check and updates |
| MediaMate | 6.99 euros | Privacy policy lists app version, license state, theme and macOS version, stored through iCloud. Signing not stated |
| Droppy | $9.99 once | Privacy page says clipboard contents, files and captures are processed on your Mac and not collected. A beta added optional crash and slowdown reports |
| NotchNest | Free, $14.99 lifetime | Privacy policy says no personal data, no analytics and no tracking, and names Firebase Crashlytics for crash reports and a server that checks subscription receipts |
| Crest | $14.99 once | Page says signed and notarized. Its website uses Microsoft Clarity and Cloudflare Web Analytics |
| CueNotch | Free, $29.99 lifetime | App Store privacy label lists email, name and device ID linked to you |
| Notchie | $29.99 once | App Store says the developer collects no data |
Look at the last two rows. A higher price does not map to less data, and a lower price does not map to more. The difference is in what each page says, so read the page.
Some optional features reach further than the app’s core. Gojo’s optional cloud transcription sends audio to a provider. NotchThings can track AI usage, and its privacy policy says it reads local credential files and Keychain entries for the providers you enable. DynamicLake reads notifications to show messages, which means it asks for notification access. All three say so on their own pages. These are choices you make when you switch the feature on.
A checklist before you install
- Find the maker’s own page. Download from the developer’s site, GitHub releases or the Mac App Store, not a third party mirror.
- Check the signature. After installing, run
spctl -a -vv /Applications/AppName.app. A notarized app says accepted and shows the source Notarized Developer ID. If it does not, find out why. If a README tells you to run a Terminal command to open the app, read the command first and make sure you understand it. - Read the privacy page, or the store’s privacy label. Look for named services, such as Mixpanel or Crashlytics, and for what is sent.
- Check the license. An MIT, Apache or GPL license gives you the right to read and reuse the code. Source on GitHub without a license, as with Tuneful, does not state those rights.
- Look at the permissions. In System Settings, Privacy & Security, see what the app asked for. A feature should explain the permission. Be wary of Accessibility or full disk access you cannot match to a tool.
- Watch the network once. A firewall tool such as Little Snitch or Lulu shows what the app connects to.
- Use the trial and the refund. A trial or a refund window lets you test with a real setup before you commit. NotchStar has 7 days of each. Droppy has a 14 day refund.
The full privacy checklist goes deeper on each of these and covers the permissions notch tools usually need.
Where NotchStar fits
NotchStar is closed source, so the checklist above is how you verify it rather than the code. It is signed and notarized since version 1.0.3, and the 1.0.5 download is too. Versions 1.0.0 to 1.0.2 were signed ad hoc, so use the current download. It asks for four permissions, each tied to one tool. Is NotchStar safe lists them, what is stored and what can leave your Mac. If open source decides it for you, Boring Notch is free and says so openly.
How this was checked
Each statement comes from the app’s own README, privacy page, changelog or store listing, read on 4 November 2026. No app was installed or tested for this page, and nothing here claims an app does something its pages do not say. Policies change, so read the live page before you rely on one.
Sources
- Boring Notch README and MewNotch
- NotchBar, Vibe Notch and Notchi
- AgentNotch and NotchPop
- Tuneful on the Mac App Store and Notchie on the Mac App Store
- Droppy privacy and data and Notchet
- MediaMate privacy policy and NotchNest privacy policy
- Crest and CueNotch on the Mac App Store
- Gojo and NotchThings privacy policy
- NotchStar pricing
