How PonoLens protects your data

Local detection and storage

Sensitive-format detection runs locally. Receipts are redacted before SQLite storage, including commands, paths, tool inputs, and auxiliary strings. Command output is never stored. Saved prompt redaction is on by default; disabling it requires a warning. Detection isn’t perfect: redaction can miss private information. For false-positive review, complete prompt originals may be stored separately encrypted only on the Mac that created them, with the private key protected by macOS Keychain. Revealing an original in the Mac app requires macOS authentication. Originals are excluded from Search, exports, and cloud uploads; deleting a receipt also deletes its encrypted original. There is no separate originals-retention toggle. Disabling saved-prompt redaction stores future prompt text in readable form instead. Protected values and token maps are not sent to an LLM.

Local connection

The collector binds to loopback with an authenticated dashboard and scoped integration tokens. The desktop collector uses port 43817 to avoid conflict with OpenTelemetry’s default 4317. Explicit port overrides remain supported. Do not expose the collector to the internet. Agent-reported executable paths are shown in Finder instead of being launched. Custom regex rules reject ambiguous repetition.

Cloud archive

Solo cloud archiving is optional and defaults to on. When enabled with upload consent and an active subscription, statistics reporting sends daily aggregate totals per user/device over HTTPS. Prompt/command/tool text, paths, destinations, session text, review notes and originals stay on the Mac. Online dashboards and reports use daily statistics only. Updated clients send only daily snapshots; the service discards individual references from older clients. Older stored cloud records may still contain previously shared redacted text; this change does not purge them. Manage it in website My Account or desktop Settings. Enabling it does not upload existing local history. Solo queries are restricted to the signed-in user’s three registered Macs. While cloud archiving and subscription access are active, the desktop app sends a minimal heartbeat every five minutes. Online means a heartbeat arrived within ten minutes. New receipts include locally redacted working-directory metadata for project reporting. Business access follows organization membership and roles. Cloud evidence has fixed 365-day retention; expired subscriptions pause uploads. Protected values, command output, raw tool payloads, token maps, model responses, encrypted originals, and screenshots are excluded. Database recovery backups can retain deleted cloud records for up to seven additional days; those records are not available in the dashboard.

Accounts and credentials

Cloud requests require authentication and server-side authorization. APIs use a dedicated restricted service account, request limits, bounded summaries, and cursor pagination. Private account, purchase, and support-report pages do not load marketing analytics. Capture pauses when account ownership is unavailable or changes. Supported API credentials use macOS credential facilities. Developer integrations use scoped tokens. Stripe handles subscription payments. A compromised account or Mac remains a risk.

Observation and enforcement

Redact is the default for new policies, with Report where unsupported. Existing saved choices are preserved. Redact and Block are experimental and depend on supported, configured before-action hooks. Trusted synchronous local Codex desktop and CLI prompt hooks, Claude CLI prompt hooks, Cursor before-submit prompt hooks, and Windsurf native Cascade pre-hooks support experimental Redact and Block. The current app also includes Grok Build typed CLI prompts, Muse synchronous CLI hooks, Oh My Pi interactive terminal input, and OpenClaw normal local-agent prompt gates. Compatible Antigravity PreInvocation hooks inspect lastUserInput and support experimental prompt Block/Redact when terminationBehavior is supported; native UI verification remains pending. Compatible Hermes pre_llm_call runtimes support experimental prompt Block/Redact; older runtimes remain observation-only with a warning. Tool blocking is separately supported for Antigravity desktop, OpenCode CLI V1 and Hermes CLI. Install the current application and restart AI tools after adapter refresh. A standalone source installation can run without Electron. Oh My Pi RPC/print/ACP prompt protection, OpenCode Desktop/V2 enforcement, and Hermes Gateway enforcement are not claimed. Regular Claude Desktop Chat and Cowork are unsupported. The current app recognizes the separate official local Code runtime for reporting, stop-and-copy and supported file inspection; runtime checks passed, while actual Desktop window dispatch remains pending. Codex cloud-orchestrated chats, session observation, and untrusted, disabled, or background prompt hooks do not enforce prompt protection; these paths remain observation-only. Redact stops the original and provides a cleaned copy for manual review and resubmission; it does not replace or submit the copy automatically. MCP coverage includes only calls routed through the PonoLens gateway. Receipts do not prove complete device-wide coverage. Deletion after transmission does not undo disclosure.

When inspection fails

Supported synchronous hooks stop unexpected collector outages, timeouts, invalid responses and storage failures. An explicit user pause or Stop Collector permits continuation with a warning. Observation-only and post-action paths cannot stop submission. An inspection-unavailable stop is not a sensitive-data finding or proof of a completed scan. Open PonoLens to recover, or use Pause protection deliberately. New hooks reject a collector with an older inspection revision. Older installed adapters require an upgrade and refreshed integrations.

Native warning visibility varies by interface. The new fail-closed wire responses require invoked, supported synchronous hooks. Cursor desktop verification is separate from adapter tests; the installed Cursor CLI did not invoke its prompt hook in the synthetic test and is not covered for prompt or Write prevention.

Distribution and limitations

The private Apple silicon v0.2.57 test app is Developer ID signed, Apple notarized, and stapled; its signature and staples were verified. These checks do not certify product security or compliance. PonoLens supports macOS 13 or later. Automatic updates and broad clean-device testing remain further work. No independent third-party security assessment has been published. Internal regression tests, Developer ID signing, and Apple notarization are separate checks; they do not amount to an independent assessment or certify privacy, security, or compliance.