Built to be trusted
Your setup stays on your Mac.
Steer needs permission to move your cursor and type. Here is what it does with that access. Not a trust badge; the actual answer.
No account, no tracking. Nothing you type leaves your Mac.
Anything risky is shown to you first.
Import someone else's setup and, if a button does more than press a key (opens a web page, runs a script), Steer shows you each one before it applies. You approve it, or it does not run. Scripts run from your own macOS scripts folder: an import can name one you already installed, not bring its own.
Plain files, on your computer.
Your mappings live on your Mac, in a file you can open and read. No sign-in, nothing synced.
What you type stays on your Mac.
Steer goes online for three reasons. It checks your licence key when you enter it, then re-checks that key on launch and about once a day. It looks for an update when you ask. It fetches a setup only if you paste a link to one.
Changes can be undone.
Steer saves a restore point as you edit each settings pane, and keeps a history you can walk back through.
No private Apple code is linked in.
Apple published no recipe for some of what Steer does: real pinch and rotate, and speaking directly to a controller's triggers, rumble, and light bar. Steer works those out from scratch, linking no private frameworks, only the developer tools Apple publishes for everyone. The full technical account is written out, because hiding it would be worse.
What it can't do is written down too.
Where a controller can't do something, Steer hides it rather than pretending. The controller page marks the gaps, including the features nobody has yet confirmed on real hardware because I don't own the pad. Snapping windows into place needs the Rectangle app, installed separately. The login screen and Touch ID stay out of reach.