Kirpi

Privacy Policy

Last updated: 28 September 2026

Kirpi shows data from your own PostHog account on your iPhone or iPad. The short version: Kirpi has no accounts and no servers, it never sees your PostHog data, and anonymous usage stats are off unless you turn them on.

What stays on your device

• Your PostHog API key is stored in the iOS Keychain on your device. It is sent only to PostHog, never to me.
• Your settings (the projects you added, event names you set, pinned events, chart style and filters) are stored on your device only.
• The Home Screen widget (if you add it) reads the same key and settings from a Keychain group shared between the app and the widget on this device. It asks PostHog directly for the event counts it shows and keeps the last numbers it saw on the device, so it can still show something when you are offline. It sends nothing to me.
• Background checks and notifications (only if you turn them on in Settings) run on your device with your key. When an event stops or falls sharply, the device makes a notification itself. Nothing is sent to me.
• Looking up a person reads that person from your PostHog and shows it on your device. Results may be held briefly in memory to avoid repeating a request. They are not written to a Kirpi server or sent to our usage analytics.
• The trial start date is stored in the device Keychain so that reinstalling does not restart the trial.

Who the app talks to

• PostHog, for your data. When you connect a project, the app sends requests directly from your device to PostHog's API (us.posthog.com, eu.posthog.com or a host you enter), using your key, to read your own analytics. Kirpi only reads. PostHog's own privacy policy governs what it does with those requests. I do not see any of it.
• Apple. Kirpi manages the trial locally; the one-time purchase and restore are handled by the App Store. Apple's terms and privacy policy apply to payments. I never receive your payment details.
• PostHog, for anonymous usage stats, only if you say yes. See the next section.

Anonymous usage stats (optional, off by default)

The first time you open Kirpi it asks whether you want to share anonymous usage stats. If you say no, nothing is sent and no identifier is created. If you say yes, Kirpi sends anonymous usage events to the PostHog project I use to understand how the app is used. You can change your mind at any time in Settings, then Share anonymous usage stats; turning it off stops everything immediately.

What is sent when it is on:

• Which screens and buttons are used, for example that the chart was switched, that a range was chosen, that the unlock screen was shown, or that a purchase completed. Only from a fixed list of actions, never free text.
• Whether connections, analyses and store requests worked, were cancelled, or failed, with general error categories (for example a rejected key or no internet). Load durations are sent in broad time buckets, not as customer analytics values.
• Purchase and restore outcomes, including whether the lifetime unlock was verified, cancelled, pending, or failed. No payment details, receipts, transaction IDs or Apple IDs are sent to usage analytics.
• App opens and closes, the app version, your iOS version, device model and language, and where you are in the free trial (for example "trial" or "unlocked").
• A random anonymous ID generated on your device (and a random ID for each session), so that events from one install can be counted together. It is not linked to your name, your Apple ID, your PostHog account or any other identifier.

What is never sent: your PostHog data or numbers, your API key, your project names or IDs, your event or property names, any filter values, your name, email or contact details, your time zone, or your location (location lookup from the connection is switched off).

These stats are processed by PostHog on its EU cloud (eu.posthog.com) on my behalf. The project is set to discard IP addresses, so they are not stored with the events. The stats are used to understand usability, reliability, trial conversion and purchases, are not used for advertising, and are never sold or shared. Because they are anonymous, I cannot tell which events came from you; turning the switch off simply stops any new ones.

Your choices

You can turn usage stats on or off at any time in Settings. You can remove a project, and its stored key, at any time in Settings. Deleting the app removes its normal local files and settings. iOS Keychain items, including the trial record, can survive deletion and reinstallation; remove connected projects in Settings to remove their saved keys.

Children

Kirpi is a tool for people who use PostHog and is not directed at children. Usage stats are off by default and contain no personal information.

Contact

Questions about this policy: dgarhdez@gmail.com.