Observability

Two optional reports can leave your Mac, both to servers in the EU: crash reports and anonymous usage counts. Neither is sent before you answer the first-run privacy screen.

Report	Default	Switch
Crash and error reports	On, with a one-click off on the first-run screen	Settings › Privacy › Send crash reports
Anonymous usage counts	Off, the box starts unticked	Settings › Privacy › Share anonymous usage

Your choices live in telemetry.json in the Pond folder. The file is sealed: if it cannot be verified, usage reads as off and the privacy screen asks again. Settings can also make a new anonymous install id, which drops events queued under the old one.

Only Pond.app reports. pond-ptyd, the pond CLI and Pond Computer are not instrumented. A helper crash shows in the app as a lost helper.

Crash reports

A report is sent when Pond crashes, hangs, or catches an error. An allow-list keeps:

• the level, release, environment, platform and time;
• the message and exception values, after the scrubber;
• threads and frames as addresses, function names and a safe file name;
• the names of loaded images;
• the OS, the app, and the Mac's model class, chip, memory, core count and thermal state.

Everything else is removed, including user, server name, breadcrumbs, locale, time zone, device name, registers, source lines and frame variables. Screenshots, view hierarchy, sessions, traces, profiling and network tracking are off.

Turning crash reports off drops a report that was already waiting.

The scrubber

Before any text leaves, the scrubber replaces, in order:

• terminal escapes, keeping only the first line;
• a shell prompt and what follows it;
• quoted text, URLs and email addresses;
• file paths, so nothing after a home folder survives;
• slash-joined names such as feature/payments-v2;
• your user name, full name and computer name;
• project, worktree and branch names Pond knows;
• long hex or base64 runs that look like tokens.

The result is capped at 200 characters.

Anonymous usage

Events are one closed list in the code, so a free-text property cannot be added by accident.

Event	Properties
app_opened	agents and projects, as ranges: 0, 1, 2-3, 4-7, 8+
task_started	agent: claude, codex or other
agent_ended	state: done, failed or stopped; duration as a range
friends_turned_on, browser_tile_opened, computer_use_enabled	none

Each event also carries the random install id, the app version and the macOS major version. Person profiles and GeoIP are turned off. Times are rounded down to the hour.

Events wait in memory, at most 200, and go out in one request at most every 10 minutes. A failed batch is tried 3 times, then dropped. Turning usage off empties the queue and cancels a request in flight.

Never sent

Code, terminal text, prompts, task titles, file paths, names of projects, repos, branches, worktrees or friends, URLs, your name, email or Mac name, or any location derived from your IP.

The hard guard

A request can reach a real host only when all of these hold:

• it is https, to the fixed EU host of that service;
• the process is not under tests and CI is not set;
• there is no POND_HOME override;
• POND_TELEMETRY is not 0.

The guard is asked before the SDK or the batcher starts, and again before each request. Builds without keys send nothing, and Settings says so.

Diagnostics export

Settings › Help › Export diagnostics… saves a zip to Downloads after a sheet lists what is in it. Nothing is sent. The zip holds versions, which features are on, the last 300 lines of the friends log, and short summaries of Pond's own recent crashes, all scrubbed. It never holds terminal contents, code, task text or other apps' reports.

Logs

Pond keeps one file log, the friends log, rotated at 5 MB with 3 files kept. pond-ptyd, the CLI, Pond Computer and the browser server keep no file log.