Privacy Policy

Pupa is an open-source native iOS and macOS app. This policy explains, in plain language, what data the Pupa app does and does not handle. The short version: the Pupa app collects no analytics, has no accounts, and gathers no personal data. Your data lives on your own devices and on a backend that you run and own.

The architecture, and why it matters for privacy

The Pupa app is a client. It talks to a backend that you run and own: either locally on your own machine, or deployed to your own cloud account. Pupa does not operate a server that sits between you and your data. There is no Pupa account to create and no Pupa-operated service collecting your usage.

What the app collects

No analytics. The app does not track your usage, does not embed third-party analytics, and does not send telemetry to us.
No accounts. There is no sign-up, no login to a Pupa service, and no user profile held by us.
No personal data collected by us. We do not receive, store, or process your personal information.

Where your data lives

On your devices. Your MyApps (typed components, canvas state) and your long-lived Memories filesystem are stored locally on your device, in the app’s own storage.
In your own iCloud. If iCloud is enabled on your device, your MyApps and Memories mirror through your iCloud account so your devices stay in sync. That uses Apple’s iCloud Drive, governed by your iCloud settings and Apple’s privacy policy. It does not pass through us, and you can turn it off in system settings.
On your own backend. When you pair the app to a backend, that backend is one you run, locally or in a cloud account you control. Conversation state and any persistence it keeps live there, under your control, not ours. Pairing sends your device’s name (the one your device already advertises, e.g. “Sam’s iPhone”) to that backend, so you can tell your paired devices apart in settings.

Model providers

Your backend sends your conversations to whichever model provider you configure it with, for example Anthropic, Amazon Bedrock, or any OpenAI-compatible endpoint. That processing is governed by that provider’s terms and privacy policy, and by the credentials you supply to your own backend. Pupa does not choose a provider for you and never receives your API keys. They live in your backend’s environment, never in the app or with us.

MyApp bundles

A MyApp bundle is a .pupa file. Today you install one from a file you already have (received over AirDrop, Messages, or picked from Files), which involves no network request and tells us nothing. Where a bundle is downloaded from a public catalog, it is fetched over HTTPS from that host (the official marketplace is served from GitHub); that is an ordinary web request to that host, and we do not track which bundles you view or install. Bundles are inert JSON, validated as untrusted input on import, and shown to you for confirmation before anything is added.

Images on cards

A tracker card can show an image from a web address you or the agent put in an image field. The app loads that image straight from whichever host the address points at, exactly like opening the link in a browser, so that host sees the request. Only addresses present in your own data are ever fetched.

Live screen share

Screen share is off unless you enable it on your backend and run the capture helper. When you start a session, the connection is negotiated peer-to-peer, which needs a public STUN server to discover how your network is reachable. Pupa uses Google’s public one (stun.l.google.com). It receives connection candidates such as your IP addresses; it never sees your screen or any other content. If you never turn screen share on, it is never contacted.

Children’s privacy

Pupa is not directed at children under 13 and collects no personal data from anyone, including children.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with a revised effective date.

Contact

Questions about privacy? Open an issue on GitHub, or email support@pupa-app.com.