The short version
PonoLens checks activity exposed by supported AI coding tools and stores its audit history locally on your Mac. PonoLens does not upload that local Prompt History or Data Trail to its website. If you create an account, make a purchase, or contact support, the information needed for those features is sent to the services described below.
Who operates PonoLens
PonoLens is operated by Holmgren Studio, LLC. In this policy, “PonoLens,” “we,” and “us” refer to Holmgren Studio, LLC. You can contact us through the PonoLens contact form.
Information that stays on your Mac
The desktop app stores prompt receipts with prompt-text redaction on by default. You may turn that setting off for future prompt text only after accepting a security warning. Tool and command details, file locations, tool inputs, and other receipt fields remain redacted. The app also stores findings, policies, settings, and other Data Trail records in a local SQLite database. The default retention period is 60 days. You can change retention or delete local data in the app.
Account credentials and signed purchase status used by the Mac app are stored in macOS Keychain. Appearance settings may be stored in local browser storage. Your AI coding tools and model providers operate under their own privacy terms; PonoLens cannot control information they receive outside supported PonoLens connections.
Information our online services receive
- Account information: email address, Firebase user identifier, authentication records, and account creation information.
- Subscription information: subscription status, plan, billing customer identifiers, entitlement dates, and purchase status. Stripe processes card and payment details; PonoLens does not receive complete card numbers.
- Device access information: a random installation identifier, operating-system category, and last-seen time used to manage the device limit.
- Support information: your account email, ticket category, subject, description, status, replies, and screenshots you choose to attach.
- General inquiry information: your name, email, subject, and message when you use the Contact Us form.
- Enterprise interest information: your name, company, and work email when you ask for Enterprise updates.
- Organization information: organization name, member email addresses, Owner, Admin, and Member roles, account status, pending invitations, and an administrative history of invitations, role changes, suspensions, reactivations, and removals. Invitation links contain a single-use secret; PonoLens stores only a one-way hash of that secret.
- Basic service records: hosting and cloud providers may process IP addresses, request times, browser or device information, and security logs needed to deliver and protect the service.
Website storage
When you sign in on the website, PonoLens keeps your Firebase sign-in tokens in that browser tab’s session storage so you remain signed in while using the account and support pages. Closing the tab or signing out clears that website session. If you allow optional analytics, PonoLens uses Google Analytics and Google Tag Manager to understand website use, and the homepage uses Klaviyo onsite tracking to support signup forms and understand visits from people Klaviyo recognizes. These services may use cookies and receive page, browser, device, and referral information. Advertising storage and personalized advertising remain disabled. PonoLens does not sell this information. Your choice is saved in local browser storage and can be changed with the Privacy choices button in the website footer.
How we use information
We use online information to authenticate accounts, provide trials and paid access, manage organizations and devices, process payments, answer support requests, prevent abuse, diagnose failures, protect PonoLens, and meet legal obligations. We do not sell personal information or use it for targeted advertising.
When information is shared
We use service providers to operate PonoLens, including Google Firebase for hosting, authentication, cloud functions, database storage, and support files; Stripe for payments and subscription management; Google Analytics and Google Tag Manager for optional website measurement; and Klaviyo for homepage signup forms and related onsite tracking. These providers process information under their own terms and privacy commitments. We may also disclose information when required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards.
How long information is kept
Local audit data follows the retention setting on your Mac. Online account, organization, membership, administrative activity, subscription, device, and transaction records are kept while needed to provide the service, maintain security, resolve disputes, and meet tax, accounting, or legal obligations. Support tickets and screenshots are kept while needed to handle and document the request. You may ask us to delete eligible information; some records may need to be retained when required by law.
Your choices and rights
You can change local retention, delete local audit data, sign out, remove registered devices, cancel a recurring subscription through the billing portal, and choose what to include in a support request. Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or an objection to certain processing. Submit a request through Support. We may need to verify your identity before completing it.
Security
We use access controls, token verification, restricted database rules, encryption provided by our service providers, and macOS Keychain storage for desktop credentials. No system can promise perfect security. Protect your password and contact us promptly if you believe your account has been accessed without permission.
Children
PonoLens is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. Contact us if you believe a child has provided personal information so we can review and remove it where appropriate.
International processing
Our providers may process information in the United States and other countries. Privacy protections may differ from those where you live. Where required, we use appropriate legal mechanisms for these transfers.
Changes to this policy
We may update this policy as PonoLens changes. We will post the revised policy here and change the effective date. If a change materially affects how we use personal information, we will provide additional notice when required.