It comes down to two things you can check yourself, in ten seconds, without taking anyone's word for it.
Outside the Mac App Store there is no store reviewing things for you, but that does not leave you blind. macOS ships two checks of its own, and anyone can repeat them from Terminal. This page explains what they are, which warnings you will see, and how to verify all of it for Tidy specifically.
It means Apple knows who made the app: there is a name and a team behind it, not an anonymous file. If anyone modifies the file after signing, the signature breaks and macOS notices.
Apple scanned the binary for malicious code before it reached you and issued it a ticket. It is an automated security check, not an editorial review like the store's.
With the app already in Applications, in Terminal:
codesign -dvv /Applications/Tidy.app spctl -a -vv /Applications/Tidy.app
The first line says who signed it. The second one has to answer "Notarized Developer ID". If it does not, do not install it.
Checked on 8 September 2026 against the published build:
Only these four, and each is requested at the moment it is needed, not at launch:
None of your files. No images, no text, no filenames. OCR runs on your machine with what macOS already ships, the index is stored encrypted on your disk with the key in your Keychain, and there is no account and no server. The only network call is the update check, which has its own switch to turn it off.
~/.Tidy folder, where its index lives.~/Library/Preferences/cl.tidy.app.plist, which is your settings.cl.tidy.app.indice entry, which is the index key.It is different. The store reviews apps before publishing them and makes them run in a sandbox. Outside the store, the check is the Developer ID signature plus Apple's notarisation, which scans the binary for malicious code. You can verify both yourself from Terminal before you ever open the app.
Because that app is not notarised by Apple, or because the file was corrupted while downloading. With a notarised app that warning does not appear: you only get the "downloaded from the internet" one, which is normal and answered once.
By downloading it from the official site rather than an intermediary portal, and by checking the signature with codesign. If the signature does not match the developer's name, or the portal hands you a different installer, that file is not theirs.
They arrive inside the app. Tidy uses Sparkle, and every update is checked against a cryptographic signature before installing: if the file is not signed with the developer's key, it is not applied.