Privacy

Documents, devices and speech

Recordings, photos and transcripts saved by a pop are document content and travel with the .pop file when you send a copy. A pop must declare camera or microphone access before the host admits a capture request. macOS permissions are granted to pop as an application; there is no separate per-document permission dialog yet. Change those decisions in System Settings → Privacy & Security.

The speech.transcribe service recognizes stored recordings on-device on the Mac. If the requested language cannot be recognized locally, it reports that limitation; it does not fall back to sending the recording to a server. Speech Recognition has its own macOS permission, separate from Microphone. See capabilities and permissions for the exact limits.

Pop can make HTTPS requests and load external images, media and embedded web pages. Those requests reach their respective providers. Local document storage and on-device transcription do not mean that all authored apps work offline or never use the network.

Live collaboration

Live collaboration is optional. To create a link, the owner signs in with Apple through Firebase Authentication. On the Mac, sign-in opens Apple’s page in a browser sheet; the iPhone uses Apple’s native sign-in. The relay uses that account identity to manage the owner’s links. Guests join with the edit link and need no account.

Sharing uploads the document’s app, saved content, edit history and referenced attachments to the pop relay, hosted on Cloudflare. Participants receive the same copy, including text that was later deleted, and exchange edits through that relay. This content is not end-to-end encrypted. Anyone with the link can edit, so share it only with people you intend to give access to. While you are signed in, the app asks the relay whether your shared and iCloud documents have a link, so you can manage it from any of your devices.

Stopping sharing ends the link and deletes the room’s documents, edits, attachments and your account and document identifiers from the relay. A record that the link has ended remains for 30 days so old links report it, then it is deleted too. A link nobody opens for 90 days ends the same way. When a busy room is condensed, the edits it replaces are kept for up to 14 days for recovery, then deleted. Deleting the sharing account ends all of its links, removes their relay data and deletes the Firebase account; the app also attempts to revoke Apple access. Copies already saved on participants’ devices remain theirs. Signing out alone does not end links. See live sharing for these controls.

Sharing event metrics record event names and counts, without document contents, account or document identifiers, IP addresses, tokens or edit links. The service uses client IP addresses to apply request limits and does not store them after a connection closes.

Analytics and crash reporting

Release builds of the Mac app enable Firebase Analytics and Crashlytics. They send launch, open, create (source), duplicate and export (format) events; operation breadcrumbs; failure records with fixed operation, classification, reason and format fields; crash reports; and Firebase’s standard app and device data.

Our custom event, breadcrumb and failure fields do not include document contents or file paths. Automatic crash reports contain diagnostic information collected by the Firebase SDK. Collection is enabled in release builds with no in-app toggle; Debug builds and tests do not upload telemetry.