Deploying TrackStudio to a fleet.
One app, no daemon, no kext. The only managed permission is Accessibility, and a PPPC profile is how you pre-approve it.
TrackStudio installs as a single app in Applications. There is no system extension, no launch daemon, and no privileged helper, so the deployment is the app plus one privacy decision. That decision is Accessibility.
kTCCServiceAccessibility for xyz.trackstudio.app. Add kTCCServicePostEvent if you want the app to send keyboard shortcuts without a per-user prompt. Nothing else is required.Which permission, and why
Accessibility is used for two things: keeping the pointer still while a finger slides an edge, and sending the keyboard or window actions a layout maps to. Brightness, volume, media transport, and most surface actions work without it, but the app is designed to ask once and be done.
Input Monitoring is not part of the standard setup. Add kTCCServiceListenEvent only if your build prompts for it; do not pre-grant services the app never asks for.
The PPPC payload
The profile payload type is com.apple.TCC.configuration-profile-policy. A minimal Services entry looks like this. Replace TEAMID with the Team ID from codesign -dvvv /Applications/TrackStudio.app.
{
"Identifier": "xyz.trackstudio.app",
"IdentifierType": "bundleID",
"CodeRequirement": "identifier \"xyz.trackstudio.app\" and anchor apple generic and certificate leaf[subject.OU] = \"TEAMID\"",
"StaticCode": true,
"Authorization": "Allow"
}Put that object inside the Services array for each service: Accessibility first, PostEvent second if needed.
Deploy it
- Upload the app (DMG or pkg) to your MDM and scope it to the test group.
- Upload the PPPC profile as a custom configuration profile and scope it to the same group.
- Install on one Mac, open TrackStudio, and check System Settings, Privacy & Security, Accessibility. The app should be listed and enabled without a prompt.
- If it is not, confirm the bundle identifier and the Team ID in the code requirement, then re-deliver the profile.
Verify and reset on a test Mac
To test the clean path, remove the app from Accessibility, then reinstall the profile. For a full reset during debugging, run sudo tccutil reset Accessibility xyz.trackstudio.app and relaunch the app.
Uninstall
Remove the app, the profile, and the user data at ~/Library/Application Support/TrackStudio/. The uninstall guide has the full list, including the preferences plist and the login item.
What this app does not need
- No Full Disk Access.
- No Screen Recording.
- No kernel extension or system extension.
- No account, MDM enrollment token, or network service.
Make the trackpad do more than point.
TrackStudio maps edges, corners, areas, gestures, and haptics to the app in front of you. $5 once. No subscription, no account.
Start 3-day trialBuy — $5Questions
Does TrackStudio need a kernel extension or a daemon?
No. It is a single app in Applications. There is no system extension, no launch daemon, and no background helper to approve.
Which TCC services does it need?
Accessibility (kTCCServiceAccessibility) for edge dragging and keyboard or window actions. Add PostEvent (kTCCServicePostEvent) if you want synthesized shortcuts pre-approved. Input Monitoring is only needed if your build prompts for it.
Can I install the PPPC profile by hand?
Not reliably. On current macOS, TCC payloads are honoured when delivered by an MDM. Manual installation may be ignored for Accessibility.
Does the app collect data?
No analytics or telemetry. The update check is its only network request.
Sources
Payload keys checked November 2026. Apple changes deployment behaviour between releases; test on one Mac first.