Trust & Uninstall

LessLLM installs a small root helper and points your DNS at a local resolver while a blackout is active. That's a lot to ask of an app, so here is exactly what it does, what it never does, and how to remove all of it.

What gets installed

The app — LessLLM.app, a menu-bar app. It registers as a login item so it's always around to start and end your blackouts on time.
A root daemon — com.lessllm.daemon. This is the DNS sink: while a blackout is active it answers “no such host” for the AI domains you chose and forwards every other lookup untouched. It runs as root only because binding the DNS port and changing system DNS otherwise prompt for your password every time.
A guardian — com.lessllm.guardian. A tiny helper that runs a health check every ~15 seconds and exits. Its only job is the safety floor: if the DNS sink ever wedged, the guardian restores your normal DNS within about 30 seconds, so the app can't strand your network. It holds no state and makes no outbound connections.

Why it asks for approval once

macOS asks you to approve the helpers a single time in System Settings → General → Login Items & Extensions. After that, no password prompts. The helpers are registered and managed by macOS (via SMAppService), not as loose files you'd have to hunt down later.

What actually changes on your Mac

Only while a blackout is active, your system DNS is pointed at a local resolver (127.0.0.1) that the daemon runs. It refuses the blocked AI domains and passes every other lookup through to your normal upstream, unchanged. The moment the blackout ends, your DNS is restored to exactly what it was before.

Files it keeps:

Your settings — schedules, which services you block, severity, your self-ransom price — in this Mac's app preferences. Local to you.
Block state in /Library/Application Support/LessLLM/, so a blackout survives a restart and can't be escaped by quitting the app or rebooting.

What leaves your device

Nothing automatically. The app does not phone home. The only things that ever leave are:

Coverage-gap reports — only when you click “Report a Coverage Gap.” That sends the domain you flag (and a screenshot if you attach one).
Self-ransom payments — handled by Stripe if you choose to break a block early. LessLLM never sees your card details.
An anonymous download count on the website.

It never sends your prompts, your chats, your browsing, your schedules, or which AI tools you use. Full details on the Privacy page.

Verify it yourself

Confirm the download is the real, notarized build (compare against the SHA-256 on the home page):

shasum -a 256 ~/Downloads/LessLLM.dmg
spctl --assess --type open --context context:primary-signature -v ~/Downloads/LessLLM.dmg

See what's installed and whether DNS is currently routed through it:

# the daemon (present only after you approve it)
launchctl print system/com.lessllm.daemon | head

# your DNS — shows 127.0.0.1 ONLY during a blackout, your normal servers otherwise
scutil --dns | grep nameserver

Uninstall completely

First, end any active blackout (or let it finish) so your DNS is already restored. Then:

# 1. Move the app to the Trash — macOS unregisters its login item and helpers
#    (drag LessLLM.app from /Applications to the Trash, or:)
rm -rf /Applications/LessLLM.app

# 2. Remove its block state
sudo rm -rf "/Library/Application Support/LessLLM"

# 3. (Only if your DNS still looks wrong) reset it to your network's default.
#    Replace "Wi-Fi" with your active service from `networksetup -listallnetworkservices`
sudo networksetup -setdnsservers "Wi-Fi" Empty

Confirm it's gone: launchctl print system/com.lessllm.daemon should report it can't find the service, and scutil --dns should show your normal nameservers.

A reboot also fully clears any helper and any blackout DNS state — so if anything ever looks stuck, restarting is always a clean reset.

If something goes wrong

You can't be bricked. The guardian restores normal DNS within ~30 seconds if the sink ever fails, and a blackout can never outlive its schedule — the daemon self-lifts at the end time even with the app closed.
Reset DNS now: sudo networksetup -setdnsservers "Wi-Fi" Empty puts you back on your network's default resolver immediately.
A reboot always clears it. Nothing LessLLM does survives a restart except a blackout you scheduled — which lifts on time on its own.

Signed, notarized — and why this page exists

LessLLM is built with a Developer ID certificate and notarized by Apple, which scans it for known malware. That's a real signal, but it is not a reason to blindly trust any app that installs a root helper. The block list and enforcement are defined in the app's source, and this page lays the rest bare on purpose: you should know exactly what you're installing, and be able to remove every trace of it in under a minute.