Is a keyboard sound app safe?
Updated
A keyboard sound app has to notice your key presses while you type in other apps, so macOS makes you allow it under Input Monitoring. That permission is powerful, so it is worth knowing what it allows and what a given app does with it.
What the permission allows
Apple describes it plainly: “Some apps can monitor your keyboard, mouse, or trackpad even when you’re using other apps.” You switch each app on or off under System Settings, Privacy & Security, Input Monitoring.
An app with this permission is told about key events everywhere on your Mac. What it does with them is up to the app, which is why the questions below matter more than the permission’s name.
Input Monitoring or Accessibility
Some apps ask for Accessibility instead. Apple’s documentation says an app can only watch key events with a global NSEvent monitor “if accessibility is enabled”. Accessibility lets an app do much more than listen, such as control other apps’ windows. On Apple’s developer forums, Apple’s engineer recommends a CGEventTap under Input Monitoring for this job, and notes that the privilege is available to sandboxed apps.
Questions to ask of any keyboard sound app
- Does it only listen? A listen-only event tap gets a copy of each event and cannot change, block or add keystrokes.
- Does it need the letter, or only the key? A sound app only needs to know which key moved, to pick a sound.
- Does it keep or send anything? Look for a privacy page that says what leaves your Mac.
- Is it signed and checked by Apple? Apps from the Mac App Store are sandboxed and reviewed; an app sold directly should at least be signed with a Developer ID and notarized, so macOS can confirm who made it.
Teclo’s answers
- Teclo uses a listen-only event tap on your login session, under Input Monitoring. The copy sold on teclo.app is signed with a Developer ID and notarized by Apple.
- It hears the key, not the letter. It keeps no log of keys, words or text; to set the pet’s mood it keeps only the timing of recent presses in memory.
- It has no account and no server of its own. It sends your licence key to Polar, which sells it, at most once a day, and checks teclo.app for new versions.
- The privacy page lists everything in detail, and the support page shows how to allow or remove the permission.
If you are comparing apps, the guide to keyboard sound apps for Mac and Teclo vs Mechvibes cover the rest.
Questions
Why does a keyboard sound app need Input Monitoring?
macOS only tells an app about keys pressed in other apps once you allow it under Privacy & Security, Input Monitoring. Without it, the app hears nothing and plays nothing.
Can Teclo change or block what I type?
No. Teclo watches key events with a listen-only event tap, which macOS documents as a passive listener: it cannot change, block or add a keystroke.
Does Teclo send what I type anywhere?
No. Teclo keeps no record of keys, words or text. It sends your licence key to Polar to check it, at most once a day, and checks teclo.app for updates.
How do I take the permission away?
Open System Settings, go to Privacy & Security, then Input Monitoring, and switch the app off. A sound app then simply goes quiet.
Sources
Other facts on this page come from these pages, read on or before the date above.