Who we are
Ponzu is made by Northbrook PBC (“we”). This policy covers the Ponzu desktop app (Mac, Windows and Linux), the ponzu command line, Ponzu for iPhone and this website. Ponzu is open source, so everything here can be checked against the code on GitHub.
Your designs
A design is a folder of files on your disk. Ponzu never uploads it to us. Agents work on it over MCP on the same computer, and Ponzu never sees your prompts. A few things in a design do reach other servers, because they would in any browser: fonts it names are loaded from Google Fonts, and images it links to are fetched from wherever they live. Opening a design from GitHub clones its repository from GitHub.
The desktop app
The desktop app sends pseudonymous usage data to us through PostHog, in the US: which tools agents call and whether they fail (with a coarse reason, like a timeout), which agents connect, how often the canvas opens and comments are left, and the Ponzu version and OS. No HTML, file names, paths, comment text or tool arguments are sent.
Each install is a random id. When Tailscale is running, that id is linked to a hash of your Tailscale user id, so we count people rather than machines. Your Tailscale name and email are never sent.
Agents can tell us how Ponzu is working for them with the send_feedback tool. That is the one event with words in it: a short note the agent writes about Ponzu, not your work.
Turn all of it off with ponzu telemetry off, or set PONZU_TELEMETRY=0 or DO_NOT_TRACK=1. Builds from source send nothing. To check for updates, the app downloads release information from GitHub.
Ponzu for iPhone
The iPhone app talks to Ponzu on your own Macs over your Tailscale network, and shows their designs. It looks on your Wi-Fi only to find a Mac to pair with; it always reaches a Mac by its Tailscale name. What it keeps (the Macs you paired, recent designs and their previews) stays on the phone.
It asks for local network access to find your Macs, the camera to scan a Mac’s pairing code, and the microphone and speech recognition to dictate comments. Dictation runs on the phone; your voice is not sent to us or to Apple.
It sends the same kind of pseudonymous usage data as the Mac app (the app opening, a Mac paired, a design opened, a comment left with no comment text, the Activity tab opened, an agent’s link opened). It decides from the Macs it has heard from: it sends only when they all have telemetry on, and stops as soon as it hears from one that has it off. Events from before any Mac answers wait until one does. App updates come from Expo, which delivers them.
This website
ponzu.design is hosted on Vercel and counts page views (with how far down you scrolled) and download clicks with PostHog, which keeps a cookie to tell visits apart.
So we know when the site breaks, it also sends errors in its own code, with their stack traces; how fast each page loads and responds (Core Web Vitals); and whether a page stayed open for a few seconds or was closed by the browser running out of memory. That last one keeps a marker in the tab’s session storage while the page is open, and no more. These events carry the page, browser, operating system and type of device, never anything you type. The site makes no session recordings.
It all honors Do Not Track. Pages that show a design from GitHub read it from GitHub’s public servers. The site has no sign-in and doesn’t sell or share data with advertisers.
What we don’t do
We don’t sell data, show ads, or track you across other apps and websites. We use what we collect only to understand how Ponzu is used and to make it better.
Contact
Questions, or a request to delete data tied to your install id: open an issue on GitHub. If this policy changes, the change shows up here and in the repository’s history.
Last updated October 27, 2026.