SECURITY & PRIVACY
What happens
when Geist unlocks?
A closer look at stored data, password handling, and the checks behind every unlock attempt.
What Geist stores.
Enrollment creates a numerical face template. Geist stores it in the macOS data-protection Keychain on your device, with iCloud synchronization disabled. A face template is still biometric data, even though it is not a photo.
How your password
is used.
Automatic unlocking needs your Mac login password. Geist stores it in the device-only Keychain and enters it into the normal macOS lock screen after an approved face check. It does not replace or modify macOS authentication.
The boundary
of camera-based unlock.
Anti-spoofing checks can reduce the risk of a photo or screen being accepted. They cannot guarantee that every impersonation attempt will be detected.
Geist uses a regular RGB camera. It does not provide Apple’s Face ID hardware or the same biometric security guarantees. Anyone who passes Geist’s checks can trigger entry of the stored password.
Permissions, explained.
Camera and Accessibility.
Camera access supplies the input for recognition. Accessibility permission allows Geist to enter the saved password. Automatic unlocking needs both permissions.
Location is optional.
Location access is requested when you add a trusted place. Saved places are stored locally. Using Geist everywhere does not require setting up a trusted place.