Pingr
Notification archive for macOSOne local SQLite file100% on device
You swiped it away. Pingr still has it.
macOS deletes a notification the moment it is dismissed, so the 2FA code you flicked off by reflex is simply gone. Pingr copies every notification into a durable local archive before that happens, makes the whole pile full-text searchable, and puts a copy button on any one-time code it finds.
v1.4.1 · macOS 14+, including 27 Golden Gate · Apple Silicon & Intel · Signed & notarized by Apple · No account
01 How it works
Install. Allow. Stop losing codes.
Drag it into Applications
Open the DMG, drag Pingr across, launch it. It lives in the menu bar, with no Dock icon.
Grant Full Disk Access, then reopen
It's the only permission macOS offers that reaches the notification store. Onboarding walks you there and watches for the grant, then hands you a Quit & Reopen button, because macOS only checks the permission when a process starts.
It starts archiving immediately
Pingr watches the notification store's write-ahead log and copies each record out within a second of it arriving, well before you can swipe it away. Nothing is sent anywhere; the archive is one SQLite file on your Mac.
Search it, or grab the code
Full-text search by app, title or message body, narrowing as you type. When a one-time code arrives, the menu-bar icon badges and the code is one click from your clipboard.
02 Private by construction
It reads. It never writes. It never uploads.
Pingr holds a complete record of what your Mac told you, which is exactly why it's built to keep that record on your Mac and nowhere else.
One local file
The archive is a single SQLite database in
No cloud
~/Library/Application Support/Pingr/. No account, no server, no sync. You can back it up, inspect it, or delete it. It's yours and it's just a file.Apple's store is opened read-only
Pingr opens the system notification database
Never writes
SQLITE_OPEN_READONLY, per poll, and never holds it open. If macOS refuses the live open it falls back to a private snapshot copy rather than forcing its way in.Excluding an app deletes its history
Add an app to the exclusion list and it's never recorded again, and everything Pingr already stored from it is deleted, not just hidden. An exclusion that only hid things would be a lie.
Retroactive
Retention is a decision you make
One week to forever, pruned hourly. The default isn't "keep everything", because a permanent archive of every notification you've ever received should be something you chose on purpose.
Pruned hourly
It would rather show no code than the wrong one
A run of digits only becomes a copy chip when the surrounding wording says it's a code. Phone numbers, prices, times, dates, versions and order numbers are excluded outright. A missing chip costs one extra ⌘+C; a wrong one costs a failed login.
Biased to silence
03 Features
Everything Notification Center forgets.
macOS deletes a notification the moment it's dismissed. Pingr copies it out first, then makes the whole pile searchable.
Codes on the clipboard as they land
Safari can fill in a code from Messages. Chrome, Firefox and Edge can't, and nothing can for a code that arrived by mail, from an authenticator, or in a Slack message. Pingr can put it on the clipboard the moment it appears, once per code, and the menu says it did. Off until you turn it on.
Every browser
Export what you're looking at
Save the current search as CSV, JSON or Markdown: not the whole archive, the rows on screen. "Everything Slack sent me last week" is a search you already ran, so it's the one that gets written out.
CSV · JSON · Markdown
Straight back to the app
Found the thing you lost? Now go and deal with it. One click brings the app the notification came from to the front. The button isn't there for an app you've since uninstalled, rather than being there and doing nothing.
One click
Full-text search across everything
Every notification by app, title, or message body, indexed with SQLite FTS5 and prefix matching, so results narrow as you type. The thing you swiped away this morning is three keystrokes away.
FTS5
One-time codes, one click
Pingr recognizes 2FA codes and puts a copy button directly on them. A code that just landed is also one click away in the menu bar: the icon grows a badge the moment it arrives.
The headline
A real timeline
Everything your Mac told you, in order, grouped by app and by day. Not a stack of three cards that vanish when you glance at them.
By app, by day
Sub-second capture
Pingr watches the notification store's write-ahead log with a vnode source and re-arms across checkpoints, so a notification is archived within a second of arriving, well before you can swipe it away.
Not a polling loop
Survives Apple moving things
The record payload is an undocumented binary plist, so every field is decoded defensively. A key that moves in a macOS update costs one field, never a crash. A bundled self-test proves the whole pipeline against the real store on your Mac.
Defensive decode
Per-app exclusions
Keep whole apps out of the archive entirely. Excluding one also deletes what Pingr already has from it, so it names the app and counts what is about to go before it does, and asks nothing at all when there is no history to lose.
Retroactive, and it asks
Undo a delete
This is an archive of things macOS has already thrown away, which makes a permanent delete the one mistake it cannot afford. ⌘⌫ still deletes, but the toast now carries Undo and stays up long enough to reach, and ⌘Z works from anywhere in the window. The notification comes back whole: its code, its thread, and its place in the timeline.
⌘Z
Thirteen languages, and you choose
English, German, Spanish, French, Italian, Japanese, Korean, Dutch, Polish, Portuguese (Brazil), Russian, Turkish and Simplified Chinese. The language is picked in Pingr's own Settings rather than inherited from your Mac, and takes effect on the next redraw. Light and dark, and WCAG 2.1 AA in both, with the timeline drivable from the keyboard: type in the search field, walk the results with the arrow keys, ⌘W to close.
13 languages
Local only
One SQLite file on your Mac. No account, no server, no usage analytics, no sync. The only connection it makes is the update check and, if you enter a business license key, the check that activates it.
No network
Signed, notarized, universal
Developer ID signed and notarized by Apple, so it opens with a double-click. One universal build runs natively on Apple Silicon and Intel.
macOS 14+
05 Pricing
Free. For everyone.
Personal use is free forever: unlimited history, full search, no key, no account, no nag screens. Free for commercial use at work too, no license required.
Personal
Free forever
For individuals and personal projects
- The full archive, unlimited history
- Full-text search across every notification
- One-time code detection and copy chips
- Per-app exclusions and retention control
- 100% on-device, nothing uploaded
- Free updates forever
At work
Free commercial too
No license, no subscription
- Everything in Personal
- Use it commercially at work, free
- No license to buy, ever
- Free updates forever
Free for everyone: personal use, commercial use, no license required.
06 Download & install
Get set up in seconds.
Download it and drag it into Applications. Setup is two steps: grant Full Disk Access, then let Pingr restart itself. macOS only checks that permission when a process starts.
Version 1.4.1 · macOS 14+ · Free updates forever
macOS 14 Sonoma or later, including macOS 27 Golden Gate · Apple Silicon or Intel
Everything Pingr needs is in the app: native SwiftUI, nothing else to install. One universal build runs natively on both architectures.
Opens with a double-click
Pingr is signed with an Apple Developer ID and notarized by Apple, so it opens cleanly the first time: no
Open Anyway trip through System Settings. Open the DMG, drag Pingr into Applications, and launch it.Grant Full Disk Access, then Quit & Reopen
macOS keeps notifications in a protected group container, and Full Disk Access is the only permission that reaches it. There's no narrower one. Onboarding walks you to System Settings › Privacy & Security › Full Disk Access and watches for the grant. Because macOS evaluates the permission at launch, Pingr then offers a Quit & Reopen button; that restart is required, not a suggestion.
History starts the day you install it
macOS deletes a notification record as soon as it's dismissed, so there's nothing older to recover. Pingr archives what arrives while it's running, so the sooner it's installed, the more of your history exists.
Check the file you downloaded
Pingr is signed with an Apple Developer ID and notarized by Apple, and macOS checks that every time you open it. That is the check that catches a file altered on its way to you. To confirm it yourself, compare the SHA-256 of your copy with the one published for the
Pingr.dmg this page serves.SHA-256 checksum
Published checksum
Run this on your download and compare
shasum -a 256 ~/Downloads/Pingr.dmg
Or have your Mac compare them for you: save Pingr.dmg.sha256 beside the download and run shasum -a 256 -c Pingr.dmg.sha256.
07 FAQ
Common questions.
Is Pingr really free?
Personal use is free forever: the whole archive, unlimited history, no account, no trial timer, no nag screens. If you use Pingr at work, free for commercial use at work too, with no license to buy.
Why does it need Full Disk Access?
macOS keeps its notification store in a protected group container, and Full Disk Access is the only permission Apple offers that reaches it. There's no narrower entitlement and no API to request one. Pingr opens that database strictly read-only, copies the rows it needs, and closes it again. It never writes to Apple's store.
Why do I have to quit and reopen after granting it?
macOS decides what a process is allowed to read when the process starts. An app that's already running when you grant Full Disk Access still can't use it until it restarts, so Pingr shows a Quit & Reopen button rather than letting you sit there wondering why nothing happened.
Does anything leave my Mac?
No. The archive is a single SQLite file in
~/Library/Application Support/Pingr/. There's no account, no server, no sync and no usage analytics. The only network connections Pingr makes are the update check, which sends nothing about your notifications, and (if you enter a business license key) the check that activates it.How does it find one-time codes?
It reads the surrounding wording, in about ten languages: a run of digits only counts as a code when the text around it says so. Phone numbers, prices, times, dates, versions, years, order numbers and URLs are all explicitly excluded. The bias is deliberately toward offering no code rather than a wrong one: a missing chip costs you one extra ⌘+C, and a wrong chip costs you a failed login.
Can I keep some apps out of it entirely?
Yes. Excluded apps are never recorded, and excluding one also deletes everything Pingr has already stored from it, rather than just hiding it from the timeline going forward. Because that is a real deletion, Pingr names the app and counts the notifications about to go before it does it. It asks nothing when there is no history to lose, so the question means something when it appears.
What if I delete something by mistake?
Press ⌘Z, or the Undo button on the toast, which stays up long enough to reach. The notification comes back whole: its code, its thread, its category and its original place in the timeline. This is an archive of things macOS has already thrown away, which makes a permanent delete the one mistake it can least afford.
What languages does Pingr speak?
Thirteen: English, German, Spanish, French, Italian, Japanese, Korean, Dutch, Polish, Portuguese (Brazil), Russian, Turkish and Simplified Chinese. You pick one in Settings, where the default is Auto (match macOS), so you can run Pingr in Korean on an English Mac, and it takes effect on the next redraw rather than the next launch. CSV column names and JSON keys in an export deliberately stay English, because they are a contract with whatever opens the file. Code detection reads the wording around a number in about ten languages, which is separate from the language you read the app in.
How long does it keep things?
Whatever you choose, from one week to forever, pruned hourly. The default is a middle setting rather than "keep everything", because an archive of every notification you've ever received is a decision you should make on purpose.
Can it recover notifications from before I installed it?
No. macOS deletes a notification record the moment it's dismissed, so there's nothing left to recover. Pingr can only archive what arrives while it's running. The history starts the day you install it.
Will it be on the Mac App Store?
It can't be, ever. A sandboxed app cannot read another app's container under any entitlement, and reading Apple's notification store is the entire feature. That's a hard architectural limit, not a decision.
Does it slow anything down?
No. Pingr watches the store's write-ahead log with a vnode source and reacts in under a second, rather than polling in a loop. There's a 15-second backstop poll for the case where the file is checkpointed out from under the watcher.
What happens when macOS changes the format?
Every field in the record payload is decoded defensively, so a key that moves costs one field rather than crashing the app. Pingr also ships a self-test that proves the whole pipeline against the real store on your Mac, worth running after a macOS update.
Will macOS warn me about an unidentified developer?
No. Pingr is signed with an Apple Developer ID and notarized by Apple, so it opens with a normal double-click the first time: no Open Anyway trip through System Settings, no Terminal.