See how your data stays private

1. The normal data path is device to PostHog

Hogly's product screens build requests on your device and send them over HTTPS to the host attached to the selected project: PostHog US Cloud, PostHog EU Cloud, or the self-hosted URL you entered. Dashboard, Insight, Event, Person, Replay, Survey, Error Tracking, Experiment, Feature Flag, and Support responses are decoded in the app. They are not routed through hogly.app for normal browsing.

Hogly keeps transient API responses in memory for a responsive interface. It does not copy your dashboards, insights, events, Person profiles, Replay contents, Support messages, or issue details into a parallel Hogly analytics database.

2. Hogly never receives your PostHog password

For PostHog Cloud, Hogly opens Apple's system authentication session. PostHog handles the sign-in page and its cookies; Hogly receives only the authorization result. The authorization-code flow uses PKCE, which binds the result to the app instance without shipping a reusable client secret inside the app.

The app exchanges and refreshes the grant directly with PostHog's OAuth token endpoint. Access tokens, refresh tokens, and Personal API Keys are stored as generic-password items in the app's shared Apple Keychain access group. They are not written to UserDefaults, SwiftData, a plain-text file, CloudKit records, or the Hogly website.

Hogly enables iCloud Keychain synchronization so a connection can follow the user to their other Apple devices. Apple performs that credential synchronization; Hogly does not receive a copy. An OAuth grant can be revoked from PostHog, and a Personal API Key can be deleted from PostHog at any time.

You can inspect Hogly's live, machine-readable OAuth Client ID Metadata Document. It identifies the public client, callback, PKCE-compatible grant type, and exact requested scope names.

3. iCloud sync is for Hogly-owned preferences

PostHog remains the source of truth for PostHog concepts. When PostHog already stores a dashboard pin, Insight favorite, tag, ticket, flag, survey, annotation, or Replay playlist membership, Hogly reads or updates that object in PostHog instead of recreating it in iCloud.

Hogly uses the user's private CloudKit database only for settings that PostHog does not model and that are useful on another Apple device:

• the chosen Overview cards and their order;
• the selected project references, cached permission list, project color/icon, and user-entered external project binding such as a RevenueCat Project ID;
• Hogly's Project Detail section order and visibility;
• Person favorites as project-scoped distinct_id references, plus pinned property keys and display aliases.

Those Person preference records do not contain names, email addresses, property values, or activity history. Those details are requested from PostHog when needed. Some per-device features, such as a Local Quick Funnel, intentionally stay only on that device.

4. Why Hogly requests these PostHog permissions

Hogly exposes a large part of PostHog, so its complete OAuth grant is broader than a read-only dashboard client. PostHog treats a resource's :write permission as satisfying its matching :read permission, so Hogly requests the write scope once instead of asking for both. The public metadata document above is the current machine-readable source; this ledger explains the human purpose of every scope.

Read access

organization:read

Discover the organizations the authorized account can use.

query:read

Run read-only analytics queries for metrics, Events, Persons, web analytics, and Error Tracking views.

user:read

Identify the current PostHog user and build the correct account/project context.

Write access, used only by matching product actions

annotation:write

Create project annotations after you submit the annotation form.

conversation:write

Send prompts to PostHog AI Chat and read the resulting conversation.

dashboard:write

Pin or delete a Dashboard and add, remove, or reorder its Insight cards.

error_tracking:write

Read Error Tracking context and resolve or reopen an issue when requested.

experiment:write

Read Experiments and perform the management actions Hogly exposes.

feature_flag:write

Read Feature Flags and confirm a flag enable/disable change.

hog_flow:write

Create or manage the per-installation PostHog Workflow used only when remote Support reply alerts are enabled.

hog_function:write

Create or manage the internal destination used only when remote new-issue alerts are enabled.

insight:write

Read, create, edit, favorite, duplicate, delete, or attach Insights after the corresponding action.

person:write

Read full Person details and save an explicitly edited display name or Hogly note.

project:write

List/read projects and save a project timezone selected in Settings.

replay_scanner:write

Read Replay Vision status and start a summarizer for a selected recording.

session_recording:write

Read Session Replay metadata/content and delete a recording after confirmation.

session_recording_playlist:write

Add or remove a Replay from PostHog's playlist-backed favorites.

survey:write

Read Survey results and perform the Survey management actions Hogly exposes.

ticket:write

Read, reply to, assign, prioritize, resolve, or reopen PostHog Support tickets.

uploaded_media:write

Upload an attachment to the selected PostHog project when you send an image reply.

OAuth requests the complete current bundle so features do not repeatedly interrupt you with a new grant. The Personal API Key path remains available for self-hosted PostHog and compatibility; features whose scopes are missing stay unavailable instead of silently bypassing PostHog's permission model.

5. The optional services are narrow—and disclosed

A truthful architecture description needs to name the cases that are not simply device-to-your-PostHog-host.

Remote Support and Error notifications

Remote alerts are off until you enable them for a project. The app then configures a narrowly scoped PostHog Workflow or destination that calls push.hogly.app. The service stores an opaque installation identity, an encrypted APNs token, the RevenueCat app-user ID needed to verify Pro eligibility, the project host and numeric ID, the selected notification topic, opaque source hashes, and temporary event or ticket identifiers.

The source contract rejects and discards customer names, Support message bodies, and stack traces. APNs receives a generic localized alert plus the minimum project/ticket/issue route needed to open the right screen. Delivery records expire after 30 days, closed aggregation windows after 7 days, and disabled installations after 90 days.

Hogly's own support image messages

If you explicitly send the Hogly creator-support conversation an image, a bounded push.hogly.app request uploads it to Hogly's own PostHog project and forwards the message. The proxy returns Cache-Control: no-store and does not use a connected customer's PostHog credential.

Product analytics, purchases, and diagnostics

Release builds use Hogly's own PostHog project for anonymous app lifecycle, a bounded set of onboarding/product/monetization outcomes, and crash diagnostics. Connection events include fields such as OAuth versus API Key, duration, broad failure category, and imported project count—not credentials, host URLs, organization names, project names, or raw server error text. RevenueCat separately processes purchase and entitlement data. None of this telemetry is written into the PostHog workspace you connected.

6. Controls you can use before and after connecting

• Explore first. Sample Data lets you inspect Hogly without a PostHog account or credential.
• Review consent. PostHog shows the OAuth grant before approval, and the public metadata document can be checked independently.
• Revoke access. Revoke Hogly's OAuth grant or delete a Personal API Key in PostHog whenever you choose.
• Disconnect locally. Removing a connection deletes its credential from Hogly's Keychain storage and removes the local project entry.
• Keep remote alerts off. Local browsing, widgets, and manually opened views do not require Hogly's remote notification service.

This technical explainer complements the Hogly Privacy Policy. If the implementation changes, we will update the public permission manifest, the in-app disclosure, and this article together.