Local name and address model
The current private Apple silicon app bundles Knowledgator GLiNER PII Small v1.0 as the upstream 8-bit QUInt8 ONNX model, with ONNX Runtime 1.23.2, NumPy, Tokenizers and a private Python runtime. No separate Python, pip, model download or ONNX installation is required. The lightweight worker does not load PyTorch, Transformers or the GLiNER Python package. Inference stays on this Mac; prompts are not sent to Knowledgator, Hugging Face or Microsoft by this model. It supplements Rust name/address checks on supported asynchronous live inspections; browser WASM and history cleanup do not use it. Detection can miss private values or flag harmless text. PonoLens does not use inspected prompts to train this bundled model. Its findings pass through the existing local receipt-redaction paths; they are not saved as new protected-value rules. The next-build default is On when no GLiNER preference has been saved. An explicit saved Off or On choice is preserved. Advanced Guard lets you review and confirm changes. Enabling adds model startup time, processing time and memory use. This source change does not update an already-built or installed app; v0.2.102 was built with the previous Off default.
The short version
PonoLens checks activity exposed by supported AI coding tools and stores its audit history locally on your Mac. Local Prompt History or Data Trail retains your existing saved-text settings. PonoLens does not upload prompt or command text in current statistics-only reporting. Solo and managed-company online dashboards and reports use daily aggregate counts per user and computer. New cloud uploads do not store individual prompt or Data Trail records. Totals cover detected warnings, saved redactions, supported stop evidence, inspection continuation choices and recorded local review outcomes. Authorized company Owners and Admins can filter by UTC dates, team, user and computer. Team filters use current membership. Prompt/command text, tool inputs, paths, destinations, session text, notes, token maps and encrypted originals remain local. Solo sync requires upload consent and an active subscription. Cloud retention is 365 days. Existing older cloud content is not automatically deleted by this change. Updated clients send daily snapshots only; the service discards older clients' individual event references while accepting their daily totals. If you create an account, make a purchase, or contact support, the information needed for those features is sent to the services described below.
Who operates PonoLens
PonoLens is operated by Holmgren Studio, LLC. In this policy, “PonoLens,” “we,” and “us” refer to Holmgren Studio, LLC. You can contact us through the PonoLens contact form.
Information that stays on your Mac
The desktop app stores prompt receipts with prompt-text redaction on by default. You may turn that setting off for future prompt text only after accepting a security warning. Tool and command details, file locations, tool inputs, and other receipt fields remain redacted. The app also stores findings, policies, settings, and other Data Trail records in a local SQLite database. The default retention period is 60 days. You can change retention or delete local data in the app.
When prompt redaction is on in the packaged Mac app, PonoLens may store the complete prompt separately as encrypted data so you can review a possible false positive. The private key is protected by macOS Keychain and tied to that Mac. PonoLens requests Touch ID where available before the normal reveal action. Encrypted originals are excluded from Search and reports, are deleted with their receipt, and are not uploaded to PonoLens. If the Mac's Keychain material is lost, the redacted receipt remains readable but the encrypted original may be permanently unrecoverable.
Account credentials and signed purchase status used by the Mac app are stored in macOS Keychain. Appearance settings may be stored in local browser storage. Your AI coding tools and model providers operate under their own privacy terms; PonoLens cannot control information they receive outside supported PonoLens connections.
Information our online services receive
- Account information: email address, Firebase user identifier, authentication records, and account creation information.
- Subscription information: subscription status, plan, billing customer identifiers, entitlement dates, and purchase status. Stripe processes card and payment details; PonoLens does not receive complete card numbers.
- Device access information: a random installation identifier, operating-system category, and last-seen time used to manage the device limit.
- Support information: your account email, ticket category, subject, description, status, replies, and screenshots you choose to attach.
- General inquiry information: your name, email, subject, and message when you use the Contact Us form.
- Enterprise interest information: your name, company, and work email when you ask for Enterprise updates.
- Beta-release notification information: your email address and selected Mac processor type when you ask to be notified that the PonoLens Mac beta is available.
- Product-update signup information: your email address when you ask to receive occasional PonoLens updates.
- Organization information: organization name, member email addresses, Owner, Admin, and Member roles, account status, pending invitations, and an administrative history of invitations, role changes, suspensions, reactivations, and removals. Invitation links contain a single-use secret; PonoLens stores only a one-way hash of that secret.
- Company governance information: enrolled-device health, PonoLens and macOS versions, processor architecture, configured integration status, active managed-policy version, daily totals per user/device, event IDs and times, harnesses, detection categories/counts, event type, risk level, supported enforcement result, review outcome and remediation actions. In the statistics-only source candidate, these records exclude prompt/command/tool text, destinations, paths, session text, notes, token maps and encrypted originals. Existing older archives may contain previously shared redacted text.
- Basic service records: hosting and cloud providers may process IP addresses, request times, browser or device information, and security logs needed to deliver and protect the service.
Website storage
When you sign in on the website, PonoLens keeps your Firebase sign-in tokens in that browser tab’s session storage so you remain signed in while using the account and support pages. Closing the tab or signing out clears that website session. If you allow optional analytics, PonoLens uses Google Analytics and Google Tag Manager to understand website use. These services may use cookies and receive page, browser, device, and referral information. Advertising storage and personalized advertising remain disabled. PonoLens does not sell this information. Your choice is saved in local browser storage and can be changed with the Privacy choices button in the website footer.
How we use information
We use online information to authenticate accounts, provide trials and paid access, manage organizations and devices, process payments, answer support requests, send requested beta-release notifications, prevent abuse, diagnose failures, protect PonoLens, and meet legal obligations. We do not sell personal information or use it for targeted advertising.
When information is shared
We use service providers to operate PonoLens, including Google Firebase for hosting, authentication, cloud functions, database storage, and support files; Stripe for payments and subscription management; Google Analytics and Google Tag Manager for optional website measurement. These providers process information under their own terms and privacy commitments. We may also disclose information when required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards.
How long information is kept
When a Company Owner confirms company closure, cancellation takes effect at the paid-period end. After the subscription ends, company cloud activity, memberships, invitations, fleet information, policies, administrative activity, and cleanup history are removed in batches. Each Mac keeps its local history. Private Solo archives are excluded. We retain billing and legal records plus a minimal versioned decision receipt identifying the Owner, company, confirmation time, acknowledged notice, and record counts; it does not contain employee prompt content. Company cloud removal does not delete recovery backups immediately.
Local audit data follows the retention setting on your Mac. Online account, organization, membership, administrative activity, subscription, device, and transaction records are kept while needed to provide the service, maintain security, resolve disputes, and meet tax, accounting, or legal obligations. Support tickets and screenshots are kept while needed to handle and document the request. Beta-release and product-update signup information is kept until the relevant notice is sent, you unsubscribe, or you ask us to delete it. You may ask us to delete eligible information; some records may need to be retained when required by law. Database recovery backups can retain deleted cloud records for up to seven additional days; backup records are not available in the dashboard.
Your choices and rights
You can change local retention, delete local audit data, sign out, remove registered devices, cancel a recurring subscription through the billing portal, and choose what to include in a support request. Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or an objection to certain processing. Submit a request through Support. We may need to verify your identity before completing it.
Security
We use access controls, token verification, restricted database rules, encryption provided by our service providers, and macOS Keychain storage for desktop credentials. No system can promise perfect security. Protect your password and contact us promptly if you believe your account has been accessed without permission.
Children
PonoLens is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. Contact us if you believe a child has provided personal information so we can review and remove it where appropriate.
International processing
Our providers may process information in the United States and other countries. Privacy protections may differ from those where you live. Where required, we use appropriate legal mechanisms for these transfers.
Changes to this policy
We may update this policy as PonoLens changes. We will post the revised policy here and change the effective date. If a change materially affects how we use personal information, we will provide additional notice when required.