Security and privacy

Pond runs on your Mac and your code stays there. This page lists everything that can leave your Mac, the permissions Pond asks for, and the limits it puts on agents.

What can leave your Mac

Two optional reports, both to servers in the EU. Neither is sent before you answer the privacy screen at first launch.

What	Default	Where to change it
Crash and error reports (Sentry, EU)	On, with a one-click off on the first-launch screen	Settings › Privacy, "Send crash reports"
Anonymous usage counts (PostHog, EU)	Off, the box starts unticked	Settings › Privacy, "Share anonymous usage"

Pond also checks once a day for a new version. See Updates.

A build without report keys sends nothing, and Settings says so.

Crash reports

Pond sends one when it crashes, hangs or catches an error. A report holds the Pond version, the macOS version, the Mac model class, chip, memory and core count, the error text and where it happened (function names, addresses and Pond's own file names).

Before a report leaves, Pond removes paths, URLs, email addresses, quoted text, long token-like strings, your user name, your Mac's name, and project and branch names. Turning crash reports off drops any report that was waiting.

Anonymous usage

Only these events exist:

Event	Carries
App opened	Number of agents and projects, as a range
Task started	Which agent: Claude, Codex or other
Agent ended	Done, failed or stopped, and the duration as a range
Friends turned on, browser tile opened, computer use enabled	Nothing else

Each event also has a random install ID, the Pond version and the macOS major version. Times are rounded down to the hour. No person profile is built and no location is looked up. Settings › Privacy can make a new install ID.

Never sent

Code, terminal text, prompts, task titles, file paths, the names of projects, repos, branches, worktrees or friends, URLs, your name, email, Mac name, or any location derived from your IP address.

Features you turn on

• Friends is off until you turn it on. Everything is sealed on your Mac before it is sent, and the relay cannot read it. It keeps IP addresses in memory for at most 10 minutes and writes no access log. Your code does not go through it.
• Sync with GitHub is off until you turn it on per project, after a sheet that names the remote. Pond fetches from and pushes to that project's own Git remote, never with force. It sends nothing to Pond's servers and stores no GitHub token.

An agent's own traffic to its model provider is the agent's, not Pond's.

Permissions

Pond.app needs no Accessibility, no Screen Recording and no Full Disk Access.

• It asks to send notifications the first time an agent needs you.
• macOS may ask once for folder access when you open a repo on an external drive or in Documents.
• Only the optional helper, Pond Computer.app, can ask for Accessibility and Screen Recording, and only when you turn computer use on.

How agents are kept in check

• Sheets that grant access in the browser preview and in computer use need your click. Return and Esc always deny.
• Pond never presses Return on its own. Text it pastes into a terminal, such as an error or review notes, waits for you to submit it. The exceptions are the ones you start: pressing Return in the browser's "Change this…" prompt and clicking "Ask the agent to fix" on a conflicting branch each send a message and its Return.
• Some commands are yours only. An agent that runs pond open, passes --force to pond worktree remove, or tries to set a project's setup, copy or run command is refused.
• An agent can reach only its own terminal and its workers' terminals.
• An agent cannot answer its own permission prompts. Only you can: in its terminal (Enter, a number or Esc) or on its card in the sidebar. Nothing the agent sends or types counts as your answer. Pond also watches the terminal for Claude Code's prompt itself, so stopping Pond's hook does not unlock it. If the hook cannot reach Pond, the tool is denied.
• When Pond can't hold a prompt for you, the tool is denied. Pond doesn't let it through. After an update, Pond may ask you to restart terminals: the old terminal helper keeps the old rules until its terminals end.
• Only Pond.app writes into the agents Pond started. A program that is not Pond.app may type only into terminals it started itself, and only an agent's coordinator (the agent that started it) may press Enter in it. Those keys wait until the agent's terminal has been quiet for a moment (Pond tries again for up to 45 seconds while it keeps printing), and they are refused while the terminal's size is not the one Pond set.
• If Pond shows "needs you" for an agent that is not asking anything (it printed a prompt's text, for example from a file or a test), right-click the agent and choose Clear needs you. A prompt Claude Code reported itself stays, and so does one that appeared after you chose Clear: Pond asks you to look again.
• Pond.app is recognized by where it is and by a valid signature. In a build from source, or any build that is not signed with Pond's Developer ID, an agent can rebuild or replace the file at that place, so such builds are not a security boundary. Only a release signed with Pond's Developer ID, where Pond also checks the signing team, can be one; that team check is not in Pond yet. Pond's own tests switch on a looser rule for themselves.
• What this does not cover: an agent runs as your user, so it can stop or change other programs you run. Pond stops an agent, and anything it starts, from answering its own prompt through Pond and through the terminal Pond gave it. It cannot fence off a program that runs as you, so do not give an agent tools or files you would not run yourself.
• Known gaps:
  • Pond sees a prompt only once Claude Code has drawn it. A coordinator that stops each of its worker's permission hooks as it starts can still press Enter in the moment between Claude Code opening the prompt and the prompt's text reaching Pond. Its Enter waits until the worker's terminal has been quiet for a moment, one at a time, and a prompt Pond has seen stays marked until you answer it, so this comes to about one try per prompt, not a stream of keys. Pond narrows that moment; it does not close it.
  • Pond recognizes Claude Code's prompt on screen by its option text. A prompt drawn in a way Pond does not recognize is caught only by the permission hook, and a file or a test that prints that text makes the agent look like it needs you (Clear needs you, above).
  • Programs Claude Code starts in the agent's terminal (git, hooks, MCP servers) can push keys into it through the terminal's own input queue, which Pond does not see. A hook the agent writes into its worktree's .claude/settings.json or .claude/settings.local.json is such a program, and one file is enough. Pond does not block this yet. Do not let an agent edit those files in a worktree you care about.
  • Pond.app is recognized by its place and a valid signature of any signer; the check of Pond's own signing team is not in Pond yet (see above).
  • When in doubt, Pond refuses. An agent that keeps printing, or prints a prompt's text, can make its coordinator's Enter wait and fail, or keep itself marked as needing you. That stops work; it never lets a key through. An agent that prints a prompt's text again and again also keeps you from clearing it: each Clear needs you then finds a new prompt and asks you to look again. Stop that agent instead.
  • Pond tells processes apart by the process that opened the connection. If that process exits and a new process gets its number while the connection still waits to be accepted, Pond cannot tell them apart and judges that connection by the new process (which programs it runs under). Pond accepts connections at once, but an agent runs as you: it can pause Pond's terminal helper and keep that wait open as long as it likes.
• Pond never merges by itself and never pushes without a confirm sheet.

Diagnostics

Settings › Help › Export diagnostics saves a zip to Downloads after showing what is in it. Pond does not send it. See Troubleshooting.