The technical appendix: every address, every byte
Pomeroy gives Claude local access to Mail, Calendar, Reminders, Notes, Contacts, Messages, Maps and Shortcuts. Pomeroy never sends that app data to a Pomeroy server. Not the text, names, subjects, locations, counts, or a hash of any of it. There is no Pomeroy server to receive it.
A short list of requests does go out, and this page is all of it.
Where Pomeroy connects
Four addresses. Pomeroy opens the first itself; the other three are opened by the two libraries it uses, one for updates and one for counting.
| Host | Why | What is sent | Opened by |
|---|---|---|---|
| api.lemonsqueezy.com | Licence check | The licence key you typed, and a random label for this Mac | Pomeroy |
| pomeroy.app | Update check | Nothing but the request | Sparkle |
| us.i.posthog.com | Four counts | Four events, listed below | posthog-ios |
| us-assets.i.posthog.com | The counting library’s own settings | Nothing but Pomeroy’s PostHog project token, in the address | posthog-ios |
Nothing else. No crash reports, no error logs, no usage statistics, no heartbeat, no font list, no screen size, no serial number, no advertising id.
A fifth address appears when you click Buy Pomeroy: the store’s checkout opens in your browser. That is your browser talking to the store, not Pomeroy. Pomeroy sends nothing and learns nothing about it.
Requests Pomeroy makes itself are checked against that list in code before a connection is opened, and it refuses anything that is not on it.
The licence check
Pomeroy sends two fields and no others:
license_key- The key from your purchase email, exactly as you typed it.
instance_name- The word Pomeroy followed by eight random characters, made once on this Mac and kept. It is not your Mac’s name, serial number, hostname or account. It exists so the store can show you which activation to free when you move to a new Mac.
A check that cannot reach the server changes nothing: a licensed Mac keeps working offline for as long as it stays offline. Only the server saying no takes a licence away.
The update check
Sparkle asks pomeroy.app/appcast.xml for the list of released versions. It is a plain request: no identifier, no licence key, no count. The answer is signed with a key whose public half is built into the app, and a download whose signature does not match the bytes is thrown away.
Switch it off in Settings → General and Pomeroy never asks.
The four counts
They exist to answer one question: of the people who install Pomeroy, how many go on to buy it. There are four, there have only ever been four, and a test fails if the code and this page disagree.
| Event | Sent when | How often |
|---|---|---|
| install | You close the setup window for the first time | Once per install |
| activation | Claude answers from your Mac for the first time | Once per install |
| cap_hit | The free weekly allowance runs out | Once a week at most, however many calls are refused |
| upgrade | A licence key is activated on this Mac | Once per activation |
Each one carries the event name, the moment it happened, the identifier described below, a random id for that one message, and exactly these four properties. That is the whole event.
| Property | Value |
|---|---|
| app_version | This build’s version — the same for everyone on that build |
| $process_person_profile | false — an instruction not to build a profile |
| $geoip_disable | true — an instruction not to look your address up in a location database |
| $ip | 127.0.0.1 — an instruction not to store the address the request came from |
The identifier, stated plainly
The four counts share a random identifier made on your Mac the first time Pomeroy needs one. It is not derived from your hardware — not your serial number, not a MAC address, not your hostname, not your licence key — and it is not linked to your name, your email or your purchase.
It exists for one reason: without it the four counts are four unrelated numbers, and how many people who install go on to buy cannot be answered.
Being exact about what that means: this makes the counts pseudonymous, not anonymous. Four events from this Mac can be told apart from four events from another one. Nobody receiving them can work out whose Mac it is, and no other app or website can read the identifier — but it is an identifier, and calling it anything else would be untrue.
You can throw it away. Deleting Pomeroy’s settings discards it, and the next one is unrelated to the last.
What is deliberately not there
No licence key. No hardware identifier. No macOS version, no Mac model, no Mac name, no screen size, no language, no time zone, no processor. No tool names. No counts of your events, messages or mail. Nothing you typed and nothing Claude said.
The one request that cannot be switched off
The counts are sent by an off-the-shelf library, posthog-ios. Out of the box that library captures a great deal more than four counts and attaches about twenty-five properties to every event, including this Mac’s model, name, language and time zone. Pomeroy switches off every collector the library allows to be switched off, then filters every event through a list of what is allowed: anything not in the tables above is dropped before it is queued, so a property added by a future version of the library is dropped by default rather than shipped by accident.
One thing cannot be switched off. When the library starts, it fetches its own settings from us-assets.i.posthog.com. That request carries Pomeroy’s project token in the address and nothing else — no identifier, no event, nothing about you. It is on the table above because it happens and you should know it happens.
So Pomeroy does not start the library when it launches. It starts it the first time a count is really going to be sent, which is after the setup window has been closed once. Until then the library never starts, so that request never happens either.
What the other end can see anyway
Being straight about the limits: any server you connect to sees that a connection arrived, and roughly from where, the way every server does. The instructions above stop PostHog storing your address on the event or turning it into a location; they cannot stop its servers seeing the connection. Deleting Pomeroy’s settings throws the install identifier away; it does not un-send a count that already left.
Pomeroy’s own requests do not make it worse. They carry a fixed user agent of Pomeroy and an English language header, replacing the ones macOS would attach, which name your exact macOS build and your language. They follow no redirects, keep no cookies and write nothing to disk.
Switching the update check off
Click the Pomeroy icon in the menu bar, choose Settings, then General. Keep Pomeroy up to date starts on and can be switched off for good. The four counts always run after the setup window has been closed once — there is no switch. With updates off and no licence, the four counts are the only requests Pomeroy makes.
Check rather than trust
The bridge — the piece that connects Claude Desktop to Pomeroy — is source available. Read it before you install anything: joesaunderson/pomeroy, the bridge.
The menu-bar app itself is closed source, and saying otherwise would be a lie. What holds it to this page is code rather than goodwill: every address it opens is checked against the list above before the connection is made, the four events and their four properties are checked against the same list, and a test in the repo fails if the page and the source ever disagree.