Is Flick safe?

The short answer

Flick is a menu bar app from one independent developer, sold from flicknav.com.

• Not notarized yet: macOS asks you to approve it once.
• One required permission, Accessibility. Flick reads app names and window titles with it, never what's inside your windows, and keeps them in memory only.
• Online for two things only: update checks you allow, and your license if you buy one.
• Signed updates that never install without you.

Two points deserve your judgment: notarization is a check Flick hasn't been through yet, and Accessibility is a powerful permission.

Why macOS asks you to approve it

Notarization is Apple's automated check of an app for malicious software. Since macOS Catalina, macOS expects apps downloaded from outside the App Store to have been through it, and it won't open one that hasn't without your approval. Flick isn't notarized yet, so the first time you open it, you approve it: on macOS 15 and later with Open Anyway in System Settings › Privacy & Security (the button is there for about an hour after you try to open the app), and on macOS 14 by Control-clicking Flick and choosing Open. macOS then saves Flick as an exception, so you do this once for each copy you download; updates you install with Install Update don't ask again. The first open, step by step

Apple's guide is blunt about the risk: overriding these settings is the most common way a Mac gets infected with malware, and Apple advises against it for any app it hasn't checked, which today includes Flick. Apple also says that if you're certain an app comes from a trustworthy source and hasn't been tampered with, you might be able to temporarily override these settings to open it. That's the judgment you're making, which is why where you get Flick matters. What the message means for any app

Where to download it

Only from the download page on flicknav.com. Flick isn't on the Mac App Store, and we publish it nowhere else, so treat a copy from any other site as untrusted.

To confirm your download matches the published one, open Terminal, type shasum -a 256 and a space, drag the disk image onto the window and press Return. For Flick 1.1 in your Downloads folder, that's:

shasum -a 256 ~/Downloads/Flick-1.1.0.dmg

The 64-character code at the start of what it prints must match the code in the SHA-256 file linked under the download button, character for character.

What it can access

Accessibility is broad. Apple's guide notes that giving an app this access also gives it access to your contacts, calendar and other information, and advises allowing it only for apps you know and trust. Flick uses it only for what's in the table, and never saves window titles, document names or tabs. Each permission, and how to remove it

What it sends

No analytics, no diagnostics, no account. Flick goes online for two things, each starting with a choice you make:

• Update checks. On its second launch, Flick asks whether to check automatically. If you say yes, or when you choose Check for Updates…, it fetches the list of updates from flicknav.com (about once a day when automatic), with no profile of your Mac and nothing about your windows or license.
• Your license, if you buy one: activating it, a check about every two weeks, and freeing a seat. These send your key, a label for the Mac like “Mac · 3FA9” (never its name or serial number) or its activation ID, and Flick's version.

Until you allow update checks, check for updates yourself or activate a license, Flick makes no network requests at all, and browser tabs add none. Report a Problem… only drafts an email for you to send yourself, without your key. The full privacy policy

Updates are signed and checked

Flick never installs an update by itself: it shows the release notes with Install Update, Remind Me Later and Skip This Version. Updates come only from flicknav.com, and they're protected twice:

• The list of updates is signed, so even someone who took over the website couldn't change what the update alert says or where it points.
• Each update is signed with Flick's update key. Flick checks that signature before it opens the download, and the new app's code signature before it replaces itself. An update that fails either check isn't installed.

Updating keeps your settings and your license, and normally the Accessibility permission too. How updates work

Who makes it

Flick is made by one independent developer: Parth Savaliya, trading as Kasratbook, in India. Dodo Payments, the merchant of record, handles payments and issues license keys, so we never see your full card number. Flick isn't affiliated with Apple.

Questions