Tidy documentation · Security and privacy

Safety, security and privacy

Tidy's safety guarantees and exactly where they stop, which folders it refuses, how moves are checked, journaled and undone, what the journal records about your files, and why it needs no network or elevation.

Product
Tidy
Section
Security and privacy
Page
1 of 1

Note

Tidy is in development. The engine, the tidy command line and the Tidy.exe desktop app are implemented and tested internally; there is no public download or release yet. This page describes the current implementation.

At a glance

Question Answer
Does it change my files? Only when you apply a plan you reviewed. It moves files; it never deletes, copies or overwrites.
Does it open my files? No. It sorts by name and never reads, opens or runs a file.
Does it use the network? No. Network locations are refused before anything is opened.
Telemetry or account? None.
Administrator rights? Not required and never requested.
What does it keep? A private journal of the moves it made (file names and paths) and the app’s own settings.

The guarantees

  1. Nothing changes without an explicit, approved apply. Scanning and planning only read file attributes. Applying needs the plan and the plan ID you reviewed; if the folder changed since, the plan ID no longer matches and nothing is applied.
  2. Nothing is ever overwritten or merged. Every move is a rename that the file system itself refuses if anything already has the target name.
  3. Nothing leaves the folder. Files move only between the folder you chose and category folders directly inside it, on the same drive. No link, junction or mount point is followed.
  4. Only the planned file is moved, unchanged. Immediately before each move, Tidy opens the file so that no other program can write, rename or delete it, and checks that it is the same file, with the same size and modification time, as when it was planned.
  5. Nothing is deleted, copied or opened. The only thing Tidy removes is a category folder it created itself, when that folder is empty after an undo.
  6. The journal tells the truth. A move is recorded as started before the rename and as succeeded only after the rename has been verified and flushed to disk. A move whose outcome is unknown, for example after a power cut, is reported as interrupted, never as completed.
  7. Undo never makes things worse. It moves a file back only if it is still the same, unchanged file and its original name is free. Anything else is reported as a conflict and left exactly where it is.

Folders Tidy refuses

Tidy organises a folder only on a local NTFS drive, outside cloud-synchronised folders such as OneDrive. It refuses drive and share roots, the Windows and program folders on any drive, ProgramData, the user profile folder itself, AppData (including the temporary folder), the Recycle Bin, network paths and devices. The checks run on the path as typed and again on the path Windows resolves, so a short 8.3 name, a junction or a subst drive cannot get around them.

FAT32 and exFAT drives have no stable file IDs and ReFS does not promise them across folders, so Tidy could not verify or undo moves there; they are refused rather than handled less safely.

What is left alone

Within the folder, Tidy never moves subfolders, symbolic links and junctions, cloud placeholders, system files such as desktop.ini, hidden files (unless you include them), unfinished downloads (.crdownload, .part and similar), temporary and Office owner files, names Windows treats specially (CON, nul.txt, trailing dots or spaces) and files no rule recognises (unless you ask for an Other folder). Scripts and shortcuts are deliberately not filed with documents.

What Tidy stores

  • The journal, in %LOCALAPPDATA%\UtilityForge\Tidy\Journal, per user and not roaming. Tidy creates that folder so that only your account and SYSTEM can open it, and refuses an existing journal folder that another account owns or can open. The journal records, for every operation, the folder, and the original and new path of each file it moved. Treat it like a file listing: it reveals the names of files in that folder. It keeps the most recent 100 operations.
  • The desktop app’s settings, in %LOCALAPPDATA%\UtilityForge\Tidy\Desktop\settings.json.

Nothing is sent anywhere. Deleting the journal folder removes the history, and with it the ability to undo those operations.

Where the guarantees stop

  • A batch is not a transaction. Each single move is atomic, but a run that is stopped, crashes or loses power leaves some files moved and others not. Tidy reports exactly which, and undo can move the moved ones back.
  • Classification trusts the name. Tidy never checks that a .pdf is really a PDF. To find out what a file really is, use FileScope or the manual inspection guide.
  • Programs acting at the same moment. A program that writes through a memory-mapped file without an open handle, or that restores a file’s size and timestamp after changing it, can defeat the “unchanged” check; the file ID still guarantees it is the same file.
  • The journal protects against other accounts, not against yourself. A program running as your account could edit it. Undo and recovery still check every file by identity, so an edited journal cannot cause an overwrite or a move outside the folder.
  • Older operations beyond the 100 kept in the journal can no longer be undone.

Doing it by hand

The guide Organise Downloads safely without a cleanup utility shows the same discipline with PowerShell: a written plan, collision checks, individually confirmed moves, a record of every move and an undo that refuses to overwrite.

Signing and reporting

There is no public release yet, so nothing can be downloaded or verified. The packaging pipeline builds reproducible portable ZIPs with SHA-256 sums, a manifest and an independent verifier, but every package so far is an unsigned internal build that is not distributed. A public Tidy release would follow the same pipeline as every Utility Forge application: a clean build from a tagged commit, published SHA-256 checksums, immutable release paths, a signed or unsigned status stated before download and the owner’s approval of the exact files. No code-signing certificate exists; free signing is being evaluated, and an unsigned Tidy release would first need its own policy decision. The security page explains what Windows shows for signed and unsigned files and how to report a vulnerability. Please do not report security issues in public.