Privacy

What CodeCatch reads, keeps and connects to

CodeCatch has no account and no server. It never sends your codes, messages or mail anywhere.

By Uros Gazvoda · Updated 3 October 2026

What it reads

Only the places a code can arrive

You choose each source, and you can switch any of them off. Mail is opened read-only: nothing is marked as read, moved or deleted.

New incoming texts in Messages
New mail in the inboxes you turn on, up to the first 256 KB of each message
The Bitwarden logins you import: name, username, site and authenticator key

What it keeps

Codes live in memory, secrets in your Keychain

Codes and links are never written to disk. They are read again from Messages and mail when the app starts, for 1, 7 or 30 days back, as you choose.

A note of which messages you dismissed, without the code or the link
Service logos, saved once so they load fast

What it connects to

Five connections, and that is the whole list

There are no analytics, no crash reports and no advertising. CodeCatch goes online only for the five things listed here. The update check downloads a list of versions from this website and sends nothing about you or your Mac.

What it never does

Five things you can count on

It never sends your data anywhere: No code, message or email leaves your Mac.
It never opens a link by itself: You see where a sign-in link goes, then you decide.
It never types into other apps: Unless you turn on Automatically Type Codes. It is off by default.
It never changes your mail: Nothing is marked as read, moved or deleted.
It never keeps your master password: The Bitwarden password is used once, for the import.

The fine print

Permissions, leftovers and this website

Permissions

Full Disk Access is what macOS requires before any app can read Messages and Mail. CodeCatch reads only those two.

Accessibility is needed only if you turn on Automatically Type Codes.

On screen and clipboard

CodeCatch windows are hidden from screen sharing and recordings. Codes stay hidden until you unlock with Touch ID or your Mac password.

A copied code is cleared after 90 seconds and is marked so clipboard managers ignore it.

Can’t find your code?

If an email looks like a verification email but no code was found, CodeCatch keeps it so you can copy the code by hand: at most 20 emails, for 30 minutes, in memory only.

Removing everything

In Settings → Sources, remove each mail account and choose Remove Saved Import for Bitwarden. Then quit CodeCatch and move it to the Trash.

What is left is a small settings file and cached logos. Neither holds a code or a password.

This website

codecatch.app sets no cookies, runs no analytics and loads no third-party code.

Check it yourself.

CodeCatch is open source. Everything on this page can be checked in the code.

Read the code Ask a question