Book12.04
“I caught myself making the exact mistake Kahneman describes — three times today.”
Thinking, Fast and Slow
Daniel Kahneman
Privacy
What we can’t read.
Your notes are sealed on your phone before they go anywhere. We hold them for you, the way a post office holds a letter: we know it arrived, not what it says.
01
Sealed on your phone
Every note is encrypted on your device, with a key only your devices hold, before it syncs. What reaches us is ciphertext. Even what kind of note it is (a book, a walk, a film) is inside the seal.
02
What we do see
Your account email, when notes were created and changed, how many there are, and how they’re grouped. We need those to sync and to keep your account working. Never a word of what they say.
03
Counting, not reading
We count actions, like “created a note” or “joined the waitlist”, to know what’s working. No titles, no content, no email addresses, and no cookies. The app itself sends no analytics at all.
Who we are
Ponder is made by Marc Ward, an independent developer in the United States. He decides how the information below is used, which makes him its controller. Questions about any of it go to privacy@goponder.app, and a person reads every one.
The waitlist
When you join, we keep the email address you typed and which page you joined from. We use the address for one thing: to tell you when Ponder is ready, and to confirm you joined. We don’t share it, sell it, or add it to anything else. The legal basis is your consent, which you can withdraw at any time.
To keep bots out, Cloudflare Turnstile checks the form. It looks at signals from your browser, not at you, and sets no tracking cookies.
The app
Ponder is in testing, through Apple’s TestFlight. If you use it, each ponder is encrypted on your iPhone before it reaches us, with a key kept in your iCloud Keychain, which Apple encrypts end to end. We store your ponders only in that sealed form. We can’t read them, and neither can anyone who asks us.
To run your account we keep your email address, the name you give us, and how you sign in: with Apple, with a code we email you, or with a passkey, of which we keep only the public half. For each device you sign in on, we keep its session and the IP address and device details it signed in from. Beside your sealed ponders we keep what syncing needs: when each was created, changed or deleted, and which collection and thread it belongs to.
Our server counts what you do in the app, like creating a ponder or a collection, under your account’s random id, never with your email address or anything you wrote. The app itself sends no analytics and has no crash reporting.
TestFlight is Apple’s, and Apple shares with us what you choose to send through it, like feedback, screenshots and crash reports, with the email address you joined with.
The legal basis for your account and your ponders is our agreement to provide the app; for the counts, our legitimate interest in knowing what works.
The contact form
When you write to us, we receive your message, its topic and, if you give one, your email address, and we use them only to read and answer it. If you leave an address, we send one email to say your message arrived. Turnstile checks this form too. The legal basis is our legitimate interest in answering you.
Server logs
Our servers log each request they receive, from the app, this site’s forms or anywhere else: when it came, what kind it was, how it went, the IP address it came from and, if you’re signed in, your account’s random id. Never what you wrote, your email address or a sign-in code. We read the logs to find and fix what breaks, and to keep the service safe, which is our legitimate interest.
Who helps us
A few companies process data on our behalf, under contract, and only to do this job:
- Apple
- Signs you in with Apple, keeps your key in iCloud Keychain, and runs TestFlight.
- Knock and Resend
- Send sign-in codes and the confirmation, welcome and launch emails.
- PostHog
- Counts page views and actions, cookieless, never with your address.
- Cloudflare
- Hosts this site and runs Turnstile.
- Google Cloud
- Runs our servers and the queue that sends emails, in the United States.
- PlanetScale
- Holds our database (the waitlist, accounts and sealed ponders), in the United States.
- Linear
- Receives what you send through the contact form, so we can answer it.
- Grafana Labs
- Shows us our servers’ logs and metrics, read where Google keeps them, in the United States.
How long we keep it
Your waitlist address stays until Ponder launches and we’ve written to you, or until you ask us to remove it, whichever comes first. After the launch email, we delete it within 60 days unless you create an account.
Your account and your sealed ponders stay while you have an account. A ponder you delete keeps its sealed copy, so you can restore it. When you ask us to delete your account, we delete it and everything in it.
We keep a contact message only as long as we need it to answer and act on it.
Server logs are deleted after 30 days.
Your rights
You can ask to see what we hold about you, correct it, or have it deleted, including your Ponder account and everything in it. Write to privacy@goponder.app from the address you signed up with and we’ll do it within a month, usually much sooner. If you think we’ve got something wrong, you can also complain to your data protection authority.