Mojito / Privacy

Mojito and your privacy

Mojito reads your keystrokes, so you should know exactly what it does with them. This page lists every permission it asks for, every request it makes to the internet, and everything it keeps on your Mac, checked line by line against its source code.

By Wells Riley, who makes Mojito·Updated October 5, 2026·Checked against Mojito 1.10.0

Is Mojito safe to give keystroke access?

Here’s everything in one paragraph. Mojito watches what you type for shortcodes like :tada:, on your Mac. What you type isn’t saved or sent anywhere, with one exception: when you search for a GIF with :::, the search words go to KLIPY, the GIF service. Beyond that, Mojito goes online only to check for updates and, unless you switch it off, to send a once-a-day anonymous count of which features and emoji get used. It never opens in password fields. And it’s open source, so none of this has to be taken on trust.

Why does Mojito need Accessibility and Input Monitoring?

Every app that autocompletes as you type, in any app, needs this same pair. Here’s what Mojito does with each.

Input Monitoring: seeing the shortcode

Mojito has to see keystrokes to notice :, ::, :::, or :) as you type them. It ignores key combinations that use ⌘, ⌃, or ⌥ (except ⌘ Z, so undo works). It holds only the shortcode you’re in the middle of typing, plus the current word so it can turn :) into 🙂, and only in memory. The shortcode is dropped the moment you insert or cancel; the word is dropped at a space or after a second of not typing.

The keyboard hook can swallow keys, because Return and the arrow keys need to drive the picker instead of your document while it’s open. It never swallows anything in an app you’ve excluded, and it’s removed entirely while Mojito is paused.

Accessibility: finding your cursor and inserting the emoji

Accessibility does four jobs:

1. Find your text cursor, so the picker opens right next to it. To tell whether you’re at the start of a line, it looks at the one character before the cursor. It doesn’t read the rest of your document.
2. Check what kind of field you’re in, so it stays out of password fields.
3. Read the current website’s address in your browser, so per-site exclusions work. Only the host name is matched.
4. Put the emoji in, by typing it the way a keyboard would, or by pasting a GIF.

In Electron and Chromium apps such as Slack, Mojito switches on the app’s accessibility support so it can find the cursor there.

Automation: Arc only

Arc doesn’t show its address bar to Accessibility, so to apply per-site exclusions there, Mojito asks Arc for the current tab’s address using AppleScript. macOS asks you first, with this reason: “Mojito reads the current tab’s URL in Arc to apply your per-site exclusions.” Every other browser uses Accessibility instead.

What Mojito doesn’t ask for

Screen Recording, Full Disk Access, your camera, microphone, location, or contacts. To check what it has, open System SettingsPrivacy & Security; you can switch any of them off there.

Password fields and Secure Input

Mojito won’t open its picker, search GIFs, or paste into a password field. It checks the field’s type before it starts listening for a shortcode, and again before it pastes. If it can’t tell what kind of field you’re in, it treats it as off-limits.

Separately, when an app switches on macOS’s Secure Input (Terminal’s Secure Keyboard Entry, some password managers and VPN clients do), macOS cuts off every keystroke tool, Mojito included, until that app lets go. If Mojito suddenly does nothing anywhere, that’s usually why; here’s how to find the app responsible.

What Mojito keeps on your Mac

• Your settings: triggers, which features are on, your excluded apps and sites, and whether Mojito is paused.
• How often you use each emoji, as a single count per emoji with no dates, so the ones you use rise to the top. Plus lifetime totals (emoji, symbols, GIFs), and the date you first opened it.
• Your favorites and custom aliases.
• GIFs: a cache of up to 50 MB of results, and each GIF you paste, kept in a temporary folder for a few minutes. That file’s name includes your search word, because chat apps show it when you upload.

None of it records the text you type. The closest it gets is which emoji you use, your alias words, and, briefly, a GIF search word.

Anonymous usage stats: exactly what’s sent

Stats are on by default, but nothing is sent until Mojito has shown a one-time notice explaining them. You can choose “Not now” there, or switch stats off any time in SettingsGeneral. Development builds never send them.

When stats are on, Mojito sends at most one report a day to stats.mojito.wells.ee. This is the complete list of what’s in it:

Never sent: anything you type, which apps or websites you use, your GIF searches, your aliases, timestamps, or any ID that could link one day’s report to the next. The stats service reads only the report itself, never your IP address or device details, and stores daily totals, not individual reports. Everything it has is published at mojito.wells.ee/stats.

Coming in the next release: three yes/no answers worked out on your Mac (is this a new install, used this week, used this month) so active users can be counted without giving anyone an ID.

GIF search and KLIPY

Type ::: and a word, and Mojito asks KLIPY for matching GIFs. Each request carries:

• Your search words. Requests go out after a short pause in typing, so a half-typed word can be sent too.
• The results page, the number of results (24), a content rating (KLIPY’s “medium”), and “GIFs only.”
• Your country, so results suit where you are.
• Mojito’s app key, which is the same for everyone. No customer ID, device ID, or account.

The GIF images themselves then load from KLIPY’s servers. KLIPY’s own privacy policy covers what it keeps on its side. Mojito doesn’t keep a list of your searches, though recent results sit in its GIF cache for a while. Mojito used GIPHY until version 1.10.0, and no GIPHY code is left in the app.

By default, GIF search works even in apps and sites Mojito otherwise steps aside for, like Slack and Discord. Turn off Always let GIF search work in SettingsExclusions to change that, or switch GIF search off entirely in SettingsGeneral.

How to check all this yourself

• Read the code. Mojito is AGPL-3.0 open source. The keyboard hook, the field checks, and the network code are all there, and you can build it yourself.
• Watch its connections. With a firewall like LuLu or Little Snitch, you’ll see mojito.wells.ee and github.com (updates), api.klipy.com and KLIPY’s image servers (only during GIF search), and stats.mojito.wells.ee (at most daily). Or, in Terminal: lsof -nP -i -a -c Mojito.
• Check the signature. Mojito is signed with an Apple Developer ID and notarized by Apple, and every update is signed with a key the app checks before installing. The Homebrew cask is pinned to the checksum of the GitHub release.

Your controls

Privacy changelog

This website

mojito.wells.ee sets no cookies and loads no analytics or tracking scripts. The stats page loads its numbers from stats.mojito.wells.ee. Download buttons go through mojito.wells.ee/download, which sends you on to GitHub and may note which page the click came from, the referring site, and your country, with no cookies and no IP address.

Privacy questions