Storage

Pond keeps its state in one folder on your Mac, plus a few Keychain items. It reads your repos and Claude Code's session files. It does not keep task text, prompts or terminal output on disk.

The Pond folder

The folder is ~/.pond, or the path in POND_HOME when that is set.

• It must be a real directory owned by you, not a symlink.
• Its mode is 0700. If group or other bits are set, Pond removes them. If the folder belongs to someone else or is a symlink, Pond refuses to use it.
• Files inside are mode 0600.
• Pond never shares this folder, its socket or its lock with other apps.

What is in it

File	What it holds
pond-pty.sock, pond-pty.lock	The terminal helper's socket and its single-instance lock.
browser.sock, computer.sock, feed.sock, preview.sock	The other local sockets (see Processes and IPC).
projects.json	The repos Pond may start tasks in, with per-project settings such as the test, run and setup commands.
sessions.json	For each agent: its agent id, Claude Code session id and terminal id, with project, worktree, branch and start time. The last 200 are kept. No text.
sessions/<agent id>.json	One session's hook settings. The helper deletes it when the agent exits.
settings.json	App settings. Its safety switches are sealed (below).
stage.json	Which terminal tiles were open, for a relaunch.
ports.json	The port each worktree's dev server uses with Run.
prs.json	Draft PRs Pond opened, so a second push does not open a second PR.
telemetry.json	Your crash-report and usage choices and a random install id.
updates.json	Whether the daily update check is on.
review-viewed.json	The files you marked Viewed in the diff tile, per worktree. Each mark holds a fingerprint of the file's content, so an edit clears it. At most 100 worktrees and 3000 marks per worktree. No file text.
usage/samples.json	The 5-hour usage readings Claude Code gives Pond's sessions: a percentage and a reset time for the current window, with when each was read, at most 400 points. No project, session, model or transcript. Its folder is mode 0700.
agents-meta/<session id>.json	Per session, from the same status line: the context size in tokens, the model's short name and the effort level. Numbers and a short fixed set of words only. Files older than 2 days are removed when a new one is written. Pond does not show these yet.
panes.json	For a tile split into two panes: the shell's terminal id, the direction, the divider position and which pane has the focus.
permission-modes.json	The permission mode last used in each project. Bypass is never stored.
fanouts.json	The worktrees, branches and agent ids of each group of tries. Never the task text.
editor.json	The editor you chose in Settings for Open in.
friends-*.json, roster.json	Friends state, only when Friends is on.

Pond writes these files atomically, at mode 0600.

Reads outside the folder

• Your repos. Git reads them through /usr/bin/git with a short fixed environment and no prompts.
• Claude Code's transcripts. To draft a friends task summary, Pond reads the tail of that session's transcript under ~/.claude/projects/: read-only, at most the last 256 KB, and only the session's own replies. It never writes there. The draft is scrubbed and capped before you see it.
• Kadans. When Kadans is installed, Pond reads its small usage-line file. It never changes Kadans' files. A fresh Kadans file wins over Pond's own usage readings.

Sealed settings

An agent runs as your macOS user, so it could edit a JSON file in the Pond folder. To stop an agent from turning on a safety switch that way, those files are sealed.

A sealed file looks like this:

{"v":1,"gen":3,"mac":"<hex>","payload":"<base64>"}

• The MAC is HMAC-SHA256 over a fixed prefix, the file name, the generation and the payload. A signed file therefore cannot be copied over another file.
• The key and the latest generation of every sealed file live in a Keychain item, one per Pond folder.
• A hand edit, a swapped payload, an older signed copy put back, a deleted file that was sealed before, or a missing key all read as unverified.
• Every caller maps unverified to its safe value. Settings shows one quiet line: "Pond reset a setting it could not verify."
• Only Pond.app writes sealed files. The CLI and Pond Computer read them with a read-only store that never creates a key and never shows a Keychain prompt.

Setting	Safe value when unverified
Computer use on or off	off
Background input for computer use	off
Browser tools for new tasks	off
Friends on or off	off
Showing project names to friends	no names
Take mode per group, project and member	Ask everywhere
Automatic starts used today	used up until tomorrow
Post results automatically	off
Friends feed sharing and posting	all off
Crash-report and usage choices	usage off, and the first-run privacy screen asks again

Keychain use

Item	Used for
The settings seal key	Sealing the files above. One item per Pond folder.
Friends identity keys	Signing and opening friend items. Created only when you turn Friends on.

Items are stored as this-device-only and are not synchronizable. Pond prefers the data-protection Keychain, and uses the login keychain with the same attributes when the build cannot reach it. Reads never show a prompt.

Pond never reads or stores a GitHub token. Git and gh use your own sign-in.

Permissions

Pond.app asks macOS for Notifications only. It never needs Accessibility, Screen Recording, Finder automation or access to your Desktop folder. macOS may ask for folder access the first time Pond opens a repo on an external volume or in Documents.

Computer use is the one exception, and it is optional. Accessibility and Screen Recording then go to the separate Pond Computer.app, never to Pond.app. See Computer use.