Help with Perch

The Mac app is signed with a Developer ID certificate and notarized by Apple, and delivered as a disk image. That's the check Gatekeeper runs on any Mac app from outside the store, and Perch passes it, so Gatekeeper doesn't refuse to open it. macOS still shows its usual first-launch confirmation for anything downloaded from the internet; that dialog is separate from the block notarization clears.

Raw network work is impossible under the App Sandbox the Mac App Store requires, which is why the Mac app ships this way instead of through the store.

Opening Perch straight from the mounted disk image gives it a new identity every time you launch it, so no permission you grant survives to the next launch.

Move Perch into /Applications first, then open it from there. Perch detects a disk-image or mounted-volume launch and tells you to move it before anything else on screen.

Three prompts on the Mac, each arriving next to what it buys rather than at launch. Location Services names the networks around you, sets the country code that decides which channels Perch can recommend, and unlocks a beacon detail some access points broadcast. Refuse it and Perch still counts your neighbours, grades the contention and gives you a verdict, but refusing costs more than names: Perch also loses the country code that decides which channel it can legally recommend, plus the beacon detail. Local Network is asked before Perch looks for devices on your network. Notifications is asked only when you turn alerts on, and again when you open the pairing window.

That's the one permission the iPhone needs, and it asks ahead of your first measurement rather than during onboarding. Perch tells you the ask is coming and why beforehand, explains it in five languages, and reports a refusal as a refusal rather than as a broken router.

Perch compares two probes: one to the internet, which passes through your router, and one to your router itself, which stops there. Comparing the two says which side of your router the delay built up on.

When Perch says the fault sits past your router, it stops there too. A second router behind the first, a powerline backhaul or a bloated modem your provider supplied all sit past the first hop and inside your own house, and all three look the same from here. Perch doesn't try to name your provider's line.

Because guessing is worse than admitting it. When the two measurement windows disagree, when your router refuses to answer probes aimed at itself, or when something else on the network answers for the internet target, Perch reports the result as inconclusive instead of picking a side.

Perch grades the delay your link picks up while it's busy, on the conventional scale: under 5 ms is an A+, under 30 ms an A, under 60 ms a B, under 200 ms a C, under 400 ms a D, and anything worse an F.

It's opt-in every run, because measuring it means filling your link with a download from Cloudflare's speed.cloudflare.com. Perch asks first every time, and the check stops at 100 MB and spends around 25 MB on a typical home connection. You get both numbers before you agree.

Because it isn't a speed test. Perch reports the median of the transfer's consecutive 500 ms windows, to two significant figures. That figure is what one connection moved during one download. There's no score, no threshold and no published range attached to it.

On a fast link it can read above your actual plan speed, because providers burst at the start of a transfer. Perch reports what it moved, so the on-screen title reads "Download speed" rather than anything larger.

The channel recommendation is the answer. Treat the neighbour count as the evidence behind it. Free tools already read how crowded the air is without naming a channel to move to. Naming the channel is what makes Perch useful.

Open pairing on both. The Mac shows a six-digit number derived from its certificate, and the iPhone shows the same number. Check that they match, confirm on both screens, and the phone pins that certificate as its whole trust decision for that Mac.

You compare only that number by eye. The pairing code itself never crosses the network.

Reinstalling the Mac app generates a new certificate, and your phone was only ever trusting the old one's digest. Accepting a changed certificate silently would look exactly like an attack from Perch's side, so it refuses instead and asks you to pair again with a fresh code.

Forget this Mac, on the phone, works even when the Mac answers nothing at all. A Mac you sold, wiped or reinstalled won't leave your phone stuck thinking it's still paired.

Perch holds the power assertion that blocks idle sleep, and that assertion has no effect at all on clamshell sleep. Closing the lid ends the watch no matter what Perch does. Perch prints "leave the lid open" as a plain instruction inside the app.

A stretch with no readings draws as a gap, never as a line through it. A line through a four-hour hole would look exactly like a healthy four hours, which is how a monitoring chart lies to you.

The Mac needs a Wi-Fi radio for the radio checks. A Mac on Ethernet still gets a report, and Perch still reads the air around it, but a watch will not start on a machine with no Wi-Fi link to watch.

Only while Perch is open and the watch is running. There's no scheduling and no background service. Quit the app or end the watch, and alerts stop with it.

Nearly everything. Every diagnostic check that ships is free, but the Mac and the iPhone don't run the same five. The Mac runs all five; the iPhone runs the two that need no radio, whether the delay sits in your home network or past your router, and whether the link collapses when someone downloads. The verdict, the channel recommendation, the device list, the download observation, the live latency meter, one watch session, export with its redaction pass, and all five languages are free as well.

Every check that ships declares itself free in its own source file, and export gates on nothing.

Four things, and only these four: watch history kept 90 days on the Mac instead of one session replaced by the next, tonight compared against previous evenings on the same network, alerts while Perch is running and watching, and 90 days of diagnosis history on the phone instead of just the latest result.

No. Nobody can buy Pro yet. The purchase path doesn't exist, and a debug setting on the Mac stands in for it during development.

Perch Pro is planned as a one-time lifetime purchase alongside a subscription, and there's no price to announce until the purchase path ships.

Your network data stays on your network. Scan results, device addresses, network names, IP addresses and hostnames go into a database file on your own Mac, and the only other thing that ever reads them is an iPhone you paired yourself, across your own network, over TLS pinned to the certificate you approved by comparing six digits. Network names and BSSIDs never leave the Mac at all. There is no account and no backend.

Two things, both disclosed in the app before they run. The connection check opens and closes TCP handshakes to your router, to the DNS server your Mac already uses, and to public resolvers: Cloudflare's 1.1.1.1, and Quad9's 9.9.9.9 if the first goes quiet, plus one reserved address used only to detect a local interceptor.

The bufferbloat check downloads from Cloudflare's speed.cloudflare.com, and asks first every run. Those servers see your IP address, the same as any website you open. Perch sends none of your data to any of them.

At ~/Library/Application Support/Perch/Perch.store on the Mac. It's named and set apart on purpose, so you can find it and delete it yourself. The iPhone keeps its own copy inside its app sandbox, and deleting the app removes it with everything else there.

No. Neither app has been released. There's no download, no App Store listing and no price yet. Join the waitlist on the app page and you'll get one email the day that changes.

Raw socket access, which the radio and network checks depend on, is unavailable under the App Sandbox the Mac App Store requires. Direct distribution is the only route that supports what the Mac app does, so it ships signed with a Developer ID certificate and notarized by Apple instead.

A Mac running macOS 26.4 or later, with a Wi-Fi radio for the checks that need one. A Mac on Ethernet still gets a report, just no watch. An iPhone running iOS 18 or later.

You need both to get the whole product. The radio checks, the device list and the watch are all Mac-only, and once purchasing exists, you'll need the iPhone to buy.