Is this the real Perchy?

The only place to download Perchy is getperchy.com, on its download page. Check the address bar before you click: no extra words, no other ending, no shortened link. After that, updates arrive inside Perchy itself, from the same place.

Perchy is not sold or shared anywhere else: not through search ads, social posts, Discord or Telegram messages, file-sharing links or “cracked” copies. If one of those offers Perchy, or an app with a name and look like ours, it is not from us.

Installing takes no password and no Terminal: open the DMG and drag Perchy to Applications.

The first time you open Perchy, macOS asks whether you are sure you want to open “Perchy”, an app downloaded from the internet, and says that Apple checked it for malicious software and found none. That is Gatekeeper confirming the signature and Apple’s notarization. Choose Open, and you will not see it again.

Stop if macOS says anything else. If it says the app is damaged, that Apple cannot check it for malicious software, or that it cannot be opened, delete it and download again from getperchy.com. Never get around the warning with “Open Anyway” in System Settings or with a command from a website: the real Perchy never needs either.

Two commands that come with every Mac read the signature without changing anything. Open Terminal (in Applications › Utilities), type one, and press Return. They need no password and no sudo.

spctl -a -vv /Applications/Perchy.app

The answer must show all three:

• /Applications/Perchy.app: accepted
• source=Notarized Developer ID
• origin=Developer ID Application: 4Studios LLC (WKGAJNMYPW), ending in our Team ID

codesign -dv --verbose=2 /Applications/Perchy.app

Among the lines it prints:

• Identifier=com.getperchy.app
• Authority=Developer ID Application: … followed by Authority=Developer ID Certification Authority and Authority=Apple Root CA
• TeamIdentifier=WKGAJNMYPW

Any other Team ID, rejected, source=Unnotarized Developer ID or code object is not signed at all means it is not our app. Delete it.

Every release’s DMG has a fingerprint, its SHA-256 hash. If even one byte of the file were changed, the hash would be different. Before you open the DMG, compute it (use the version and build in the file’s name):

shasum -a 256 ~/Downloads/Perchy-x.y.z.dmg

The long string it prints must be exactly the one listed for that version under Release hashes. Each one also links to VirusTotal’s report, where many virus scanners have checked the same file.

Newest first. Each release is added here when it comes out; what changed in each is in the changelog.

If something that looks like Perchy, or claims to speak for us, does any of these, it is not us:

• Ask you to paste anything into Terminal. Not to install, not to fix a problem, not to unlock a feature. The commands on this page only read, and you never need them to use Perchy.
• Ask you to lower your Mac’s security. Perchy never asks you to change Gatekeeper, allow apps from anywhere, choose “Open Anyway” or turn off System Integrity Protection. When a feature you switch on needs access, such as your calendar or the camera for Face Unlock, macOS asks you in its own window; Full Disk Access, for Clock timers, you turn on yourself in System Settings.
• Ask for a wallet, seed phrase, private key or exchange API key. Perchy reads public prices. It has nothing to connect to and no field to type them into.
• Ask you to sign in to an exchange. No account is needed to use Perchy. Buyers sign in with their purchase email, on getperchy.com, only to manage their Macs.
• Ask for your Mac password in a pop-up. The only place Perchy takes your Mac password is Face Unlock’s set-up, in its settings or the welcome tour, which you start yourself, and it stays in your Keychain.
• Sell a token. There is no Perchy token or coin, and there never will be. No airdrop, no presale. Anyone offering one is running a scam.

Our ads and posts link to getperchy.com. Be wary of any that send you to a download or a form somewhere else.

With a firewall such as Little Snitch or LuLu you can see each connection Perchy makes. Perchy’s own connections go only to these hosts:

Besides those, the app may contact a few third-party services directly from your Mac, each only for the reason below:

Third-party services the app may contact directly are described by category in the Privacy Policy, with exactly what each request carries. Logos of exchange-listed coins ship inside the app, so showing them sends no request. While you pick an AirPlay speaker, Perchy looks for speakers on your local network; that stays inside your network. There are no analytics, advertising or tracking services.

Seen an ad, site, account or app pretending to be Perchy? Write to support@getperchy.com with the link, a screenshot and where you saw it, so we can have it taken down and warn others.

If you already ran a command or an app from a fake: disconnect that Mac from the internet, move any crypto from wallets that were on it to new ones created on another device, and change your passwords from another device, starting with email and exchanges.