Tattle

Your Mac talks behind your back. Tattle tells you.

Tattle is a menu bar app that shows which apps on your Mac connect where, and lets you allow or block them. Out of the box it only watches: nothing is blocked until you make a rule or choose a stricter mode.

See the plans

macOS 26 or later · Apple silicon

Tattle’s main window, Connections by app: Chat App, Mail, Music, Safari and other apps with their hosts, data and a verdict each. Photo Editor is open and its blocked host telemetry.example.net is selected; the pane beside it says it was blocked by your rule, that the address is registered in France, and offers Allow, Block and Edit Rule.Tattle’s main window, Connections by app: Chat App, Mail, Music, Safari and other apps with their hosts, data and a verdict each. Photo Editor is open and its blocked host telemetry.example.net is selected; the pane beside it says it was blocked by your rule, that the address is registered in France, and offers Allow, Block and Edit Rule.Tattle’s main window, Connections by app: Chat App, Mail, Music, Safari and other apps with their hosts, data and a verdict each. Photo Editor is open and its blocked host telemetry.example.net is selected; the pane beside it says it was blocked by your rule, that the address is registered in France, and offers Allow, Block and Edit Rule.Tattle’s main window, Connections by app: Chat App, Mail, Music, Safari and other apps with their hosts, data and a verdict each. Photo Editor is open and its blocked host telemetry.example.net is selected; the pane beside it says it was blocked by your rule, that the address is registered in France, and offers Allow, Block and Edit Rule.Tattle’s main window, Connections by app: Chat App, Mail, Music, Safari and other apps with their hosts, data and a verdict each. Photo Editor is open and its blocked host telemetry.example.net is selected; the pane beside it says it was blocked by your rule, that the address is registered in France, and offers Allow, Block and Edit Rule.Tattle’s main window, Connections by app: Chat App, Mail, Music, Safari and other apps with their hosts, data and a verdict each. Photo Editor is open and its blocked host telemetry.example.net is selected; the pane beside it says it was blocked by your rule, that the address is registered in France, and offers Allow, Block and Edit Rule.
Tattle’s own window, drawn by the app on an invented Mac: made-up apps and hosts, simulated traffic.

At a glance

What it is
Tattle for Mac, by Polytopic Systems: a menu bar app that shows which apps on your Mac connect where, and lets you allow or block them.
Who it’s for
Anyone who wants to see what their Mac’s apps do on the network and decide what they may reach, without being a network expert.
Requirements
A Mac with Apple silicon running macOS 26 or later.
Runs on your Mac
The firewall, its rules, the connection history (30 days by default), the DNS log (7 days) and the optional DNS proxy all run and stay on your Mac.
Leaves your Mac
License and update checks to this website; downloads of blocklists you subscribe to; lookups to your chosen resolver if you turn encrypted DNS on; and, only if you turn the AI assistant on with a provider off your Mac, the connection details you approve.
What it doesn’t do
No account, no analytics, no cloud copy of your history, and it never reads what apps send: it sees connections, not their content.

How it works

It watches first. You decide what changes.

Tattle’s network extension sees each new connection on your Mac: which app, which host, which port, and how much data. It decides each one by your rules and the mode you chose, and keeps the record on your Mac. It sees who talks to whom, never what they say.

  1. 1Approve the extensionmacOS asks you once, in System Settings, to allow Tattle’s network extension and its filter.
  2. 2WatchAllow and watch is the default: nothing is blocked, and every connection is listed under the app that made it.
  3. 3DecideAllow or block from the list, answer questions in Ask mode, or switch to Lockdown so only what you allowed gets through.
The pill at the notch, grown into a question: Screen Recorder wants to connect to stats.example.net, port 443, outgoing, TCP. Waiting for you; if you don’t answer, it’s allowed at a time shown. Menus for This host and Forever, and Later, Block and Allow.The pill at the notch, grown into a question: Screen Recorder wants to connect to stats.example.net, port 443, outgoing, TCP. Waiting for you; if you don’t answer, it’s allowed at a time shown. Menus for This host and Forever, and Later, Block and Allow.The pill at the notch, grown into a question: Screen Recorder wants to connect to stats.example.net, port 443, outgoing, TCP. Waiting for you; if you don’t answer, it’s allowed at a time shown. Menus for This host and Forever, and Later, Block and Allow.
The question as the app draws it, on the invented Mac.

In Ask mode, the notch asks

When an app makes a connection no rule covers, the pill grows into a question: which app, where to, and until when it waits for you. Choose how wide the answer is and how long it holds, then Allow or Block. No key answers it, so a stray Return never decides for you.

On a Mac without a notch, the question opens in a small window instead.

Features

Every connection, and the reason for it.

Each connection is listed under the app that made it, with a plain sentence on why it was allowed or blocked and a button to change that.

The main window

Connections are grouped by app, with a live view beside them. Select one and Tattle tells you why it got its verdict: one of your rules, an answer you gave, a built-in Essentials rule, or the mode. Allow and Block make a rule on the spot, and Rules, DNS, History, Map and Alerts are one click away.

This window runs in your browser on invented apps and hosts. Switch it to Ask and open an app: the question appears in the pill at the top of the page, and your answer changes what you see here.

Tattle’s main window loads here as you scroll.

The pill, at your notch

Point at the pill around your Mac’s notch and it opens into a panel: the mode, the counts and Block All, then the newest connections, DNS lookups or blocked connections, five at a time, with more a scroll away.

Point at a row for Allow and Block; the small arrow on each one does the whole app. The list holds still while your pointer is on it and counts what arrived above it. Click a row to open it in the main window. When something is blocked, the pill says so briefly, grouping a burst into one line; Settings › Notch turns that off.

The pill at the top of this page works the same way, on the same invented Mac as the window above.

The pill opened into its panel: Allow and watch with the connection and blocked counts and a Block All button; Connections, DNS and Blocked tabs; five rows of time, app, host and why. The pointer is on Screen Recorder’s license.example.com row, which shows Allow and Block buttons, each with a small arrow.The pill opened into its panel: Allow and watch with the connection and blocked counts and a Block All button; Connections, DNS and Blocked tabs; five rows of time, app, host and why. The pointer is on Screen Recorder’s license.example.com row, which shows Allow and Block buttons, each with a small arrow.The pill opened into its panel: Allow and watch with the connection and blocked counts and a Block All button; Connections, DNS and Blocked tabs; five rows of time, app, host and why. The pointer is on Screen Recorder’s license.example.com row, which shows Allow and Block buttons, each with a small arrow.
Pointing at a row: Allow and Block, each with a menu for the whole app.
The same panel held still while the pointer is on PDF Reader’s row, with a capsule at the top of the list saying how many new rows wait above it.The same panel held still while the pointer is on PDF Reader’s row, with a capsule at the top of the list saying how many new rows wait above it.The same panel held still while the pointer is on PDF Reader’s row, with a capsule at the top of the list saying how many new rows wait above it.
Held under the pointer, with the new rows counted above it.

A map of where it all goes

Map shades the countries your Mac’s connections went to today, in the last 7 days or 30 days, with blocked ones hatched. Select a country for the apps that reached it, the hosts, and the networks that own their addresses; Table lists the same. Connections and History name the country too.

The places come from an address table bundled with Tattle, so nothing is looked up online. A country is where an address is registered, which for large networks and CDNs is often not where the server is.

Tattle’s Map for the last 7 days: a world map with the United States, Brazil, Australia, Japan, South Africa and several European countries shaded by how many connections went there, India, France and Italy among those hatched for blocked connections, Singapore as a dot, the local network listed off the map, and the most used countries beside it: Netherlands, Brazil, Sweden, France, Germany.Tattle’s Map for the last 7 days: a world map with the United States, Brazil, Australia, Japan, South Africa and several European countries shaded by how many connections went there, India, France and Italy among those hatched for blocked connections, Singapore as a dot, the local network listed off the map, and the most used countries beside it: Netherlands, Brazil, Sweden, France, Germany.Tattle’s Map for the last 7 days: a world map with the United States, Brazil, Australia, Japan, South Africa and several European countries shaded by how many connections went there, India, France and Italy among those hatched for blocked connections, Singapore as a dot, the local network listed off the map, and the most used countries beside it: Netherlands, Brazil, Sweden, France, Germany.Tattle’s Map for the last 7 days: a world map with the United States, Brazil, Australia, Japan, South Africa and several European countries shaded by how many connections went there, India, France and Italy among those hatched for blocked connections, Singapore as a dot, the local network listed off the map, and the most used countries beside it: Netherlands, Brazil, Sweden, France, Germany.Tattle’s Map for the last 7 days: a world map with the United States, Brazil, Australia, Japan, South Africa and several European countries shaded by how many connections went there, India, France and Italy among those hatched for blocked connections, Singapore as a dot, the local network listed off the map, and the most used countries beside it: Netherlands, Brazil, Sweden, France, Germany.Tattle’s Map for the last 7 days: a world map with the United States, Brazil, Australia, Japan, South Africa and several European countries shaded by how many connections went there, India, France and Italy among those hatched for blocked connections, Singapore as a dot, the local network listed off the map, and the most used countries beside it: Netherlands, Brazil, Sweden, France, Germany.
The app’s Map, drawn by the app on the invented Mac. Its addresses are public ones of hosting networks, picked to spread the example around the world; none of it is anyone’s traffic.

Three modes, and rules you can read

Allow and watch blocks nothing. Ask asks about each connection no rule covers: it waits for you (30 seconds by default) and then, unless you set it otherwise, lets it through, so nothing hangs while you’re away; connections that can’t wait go through at once and the question stays for next time. Lockdown blocks whatever no rule allows, while Essentials keep name lookups, joining networks, Bonjour, the clock and Tattle’s own updates working. Block All stops everything, Essentials included, until you turn it off.

A rule can name an app (by its code signature), a domain with or without its subdomains, an address or range, a port, a protocol, a direction, and the local network or the internet. It can last for good, for an hour, or until the app quits, and the list says in a sentence what each rule does.

Encrypted DNS, labelled honestly

DNS is off until you turn it on: a fresh install changes nothing. Tattle’s own DNS proxy can send your Mac’s lookups to an encrypted resolver you choose, over HTTPS or TLS, with presets for well-known public resolvers and for services that give you a personal profile, or any address you enter. A simpler mode makes a system profile for you to install instead. Blocklists you subscribe to block their names for every app.

Two limits come from macOS, and the DNS screen says when they apply: while a VPN is connected, its DNS takes precedence for the lookups it handles, and apps that do their own encrypted DNS never reach Tattle’s proxy. The DNS log stays on your Mac, for 7 days by default.

History and alerts, on your Mac

History keeps connections and data per app and per host on your Mac, 30 days by default, with search and a chart by day. Alerts tell you when an app’s code signature changes or an app opens an unusual number of connections; apps seen for the first time are listed quietly, without a notification each.

An assistant, off until you choose one

The assistant can explain a connection, write a summary of your activity, suggest rules and answer questions about your history. It is off until you pick a provider: a model on your Mac, a server you run, or a service you have your own key for.

Before anything goes to a provider off your Mac, Tattle shows exactly what it will send and waits for you: connection details such as app and host names, never what the apps sent. You can stop the preview for a provider you trust. Suggested rules do nothing until you accept them, one at a time.

Rules, DNS and History, as they are

Three more of the app’s own screens on the invented Mac: your rules as sentences with what each decided, DNS with who is answering and the lookup log, and History with data by day per app and host.

Tattle’s Rules: your rules as sentences, each with its switch, its note and how many connections it decided, such as Block Photo Editor connecting to or from telemetry.example.net and Allow Notes Sync connecting to or from the local network on port 7000; then rules from your answers, a blocklist, and Essentials.Tattle’s Rules: your rules as sentences, each with its switch, its note and how many connections it decided, such as Block Photo Editor connecting to or from telemetry.example.net and Allow Notes Sync connecting to or from the local network on port 7000; then rules from your answers, a blocklist, and Essentials.
Rules: each one a sentence, with what it decided and when. Drawn by the app on the invented Mac.

A console for the curious

Turn on Developer mode in Settings and Tattle opens its Developer Console: the live log, the app’s own network requests, the firewall’s numbers and stats for nerds. Everything in it stays on your Mac.

This one runs in your browser on the same invented Mac as the window above: switch modes, open an app, answer the pill, and watch the log, the firewall’s numbers and its own tab follow.

The Developer Console loads here as you scroll.

Themes

Your colours, light or dark.

Tattle comes in three palettes, or your own two colours, in light or dark. This is its Settings page, working: what you pick here colours this site too.

  • Overview
  • Firewall
  • DNS
  • Blocklists
  • Network Profiles
  • Appearance
  • Notch
  • AI
  • Network Extension
  • License

Appearance

AppearanceSystem follows your Mac’s Light or Dark setting. The notch pill always stays dark.

Colors

The Dock and the app switcher show the icon in these colors while Tattle runs. Finder and notifications show the standard icon.

Your choice is kept in this browser’s local storage, on your device. It is never sent anywhere.

Privacy

What Tattle learns stays on your Mac.

Your connection history, DNS log, rules and settings are files on your Mac. There is no account, no cloud copy and no analytics.

  • It sees connections, not content. Which app reached which host and port, when, and how much data: never what was sent, and nothing inside encrypted connections.
  • It goes online for very little. Its license and updates, from this website; blocklists you subscribe to, from where each list is published; your lookups, to the resolver you chose, if you turn DNS on; and the AI provider you pick, if you pick one, only with what you approved.
  • You can take your settings with you. Export your rules, mode and DNS settings to a file and import them on another Mac. AI settings and keys are never in the file.

Every request the app makes, and what the license service keeps, is in the privacy notes.

The film

See it in a minute.

A short film of Tattle at work. It has sound, and streams only after you press play.

Has sound. Streams from Mux, our video host, once you press play.

Plans

Buy a version, or every version.

Every edition has every feature. Pick how many Macs, and whether you want this version or all of them.

Personal

3Macs at once
  • This version$15

    The current version and every update to it. Free upgrade if the next version arrives within a year.

  • Lifetime updates$60

    Every version, now and later.

One-time payment, in US dollars. Buying opens soon.

Business

10Macs at once
  • This version$35

    The current version and every update to it. Free upgrade if the next version arrives within a year.

  • Lifetime updates$100

    Every version, now and later.

One-time payment, in US dollars. Buying opens soon.

How versions work

  • You buy a version. It’s yours to keep, with every update to it.
  • A version lasts at least a year. A new version comes when a new macOS brings features that warrant one.
  • A new version within a year is free. If the next version arrives within a year of your purchase, you get it too.
  • Lifetime covers every version, now and later.
  • Installs are reusable. Personal covers 3 Macs and Business 10. Unregister a Mac in the app or on the account page and the install is free for another Mac.

A license is just a key. No account, no name. Your license is checked on your Mac, so it doesn’t need a connection to keep working day to day.Already have a key? Manage your installs.

Questions

Short answers.

What does Tattle do?

It shows which apps on your Mac connect where, and lets you allow or block them by app, domain, address, port and direction. By default it only watches; Ask mode asks you about connections no rule covers, and Lockdown blocks whatever you haven’t allowed. It can also send your DNS lookups to an encrypted resolver you choose, and it keeps a history of connections and data on your Mac.

Does my data leave my Mac?

Your history, DNS log, rules and settings stay on your Mac. Tattle goes online to check its license and look for updates (with this website), to download blocklists you subscribe to (from where each is published), to send lookups to the resolver you chose if you turn encrypted DNS on, and, only if you turn the AI assistant on with a provider off your Mac, to send that provider the connection details you approve. It never sends what your apps send. The privacy notes list it all.

Can it see what I do in my browser?

It sees that a connection was made, by which app, to which host and port, and how much data went each way. It does not read what is inside connections, and encrypted connections stay encrypted.

Does it work with a VPN?

The firewall sees and decides connections whether or not a VPN is connected. DNS is different: macOS gives a VPN’s DNS precedence for the lookups it handles, so while a VPN is connected some or all lookups may skip Tattle’s DNS proxy. The DNS screen says when that is happening. Apps that do their own encrypted DNS also bypass the proxy.

How is it different from the firewall in macOS?

The firewall built into macOS decides which apps may accept incoming connections. Tattle is about connections in both directions, outgoing above all: it shows every app’s connections and lets you allow or block them by app, host, port and more.

Why does macOS ask me to allow a system extension?

Tattle sees connections through a network extension, a system extension that macOS runs apart from the app. The first time, macOS asks you to approve it in System Settings › General › Login Items & Extensions, then asks once whether Tattle may filter network content; until you allow both, Tattle can’t see connections. The app must be in your Applications folder for macOS to accept the extension. The docs show each step.

Is the AI assistant on?

No. It is off until you choose a provider in Settings › AI: a model on your Mac, a server you run, or a service you have your own key for. Before anything goes to a provider off your Mac, Tattle shows exactly what will be sent. Rules it suggests do nothing until you accept them.

Which Macs does it run on?

Macs with Apple silicon running macOS 26 or later.

How does licensing work, and on how many Macs?

A license is a key, with no account and no name. Personal covers 3 Macs at once and Business 10, and every edition has every feature. Buy this version, with every update to it, or lifetime updates for every version. It’s checked on your Mac, so it doesn’t need a connection to keep working day to day. The editions are under Plans.

Can I try it first?

Yes: every new Mac gets 14 days with everything included, no key needed. After that it asks for a license.

I got a new Mac. How do I move my license?

Deactivate the old Mac from the app, or unregister it at the account page, then activate the new one. The install is free again straight away.

I lost my key. Can I get it back?

If you added a recovery email, use “Lost your key?” on the account page and we’ll email you a replacement. If you didn’t, it may still be recoverable: contact Tech on Tires, LLC through the contact page at on.tires with the date you bought it and your payment receipt. Never send card details.

When can I download it?

Soon. The download button on this page will start working on release day.

More in the docs and FAQ, and exactly what’s stored in the privacy notes.

Not out yet. Nearly.

There’s no mailing list to join: we don’t collect email addresses for marketing. Come back to this page; on release day the download button will work.

Read the docs

Loading the panel…