Trust
Data handling
A source-backed inventory of what HogScope stores, where it stores it, and how to remove it.
Storage inventory
OAuth access and refresh tokens, or the optional personal API key fallback. They are never intentionally written to SQLite, UserDefaults, files, logs, or screenshots.
Configuration, cached JSON/query results, saved queries, saved chart definitions, dashboards, and related local records.
Widget event name, time range, refresh request, host, project ID, and project/event options. No credential is copied into preferences.
Data in transit
The app uses URLSession to call the configured PostHog host with an OAuth access token or personal API key as bearer authentication. Query text, filters, project identifiers, and returned analytics data therefore travel between the device and that PostHog host over the configured connection.
OAuth login opens PostHog's own sign-in page. A short-lived, PKCE-bound authorization code passes through HogScope's static HTTPS callback and immediately returns to the app; the page does not receive an access token, refresh token, API key, or password.
No app-owned relay is implemented. For a custom host, the deployment owner is responsible for DNS, TLS, reverse-proxy behavior, network logging, and the PostHog instance itself.
Caching
Response caching can be switched off. When enabled, cached responses use a local cache-duration setting from 1 minute to 24 hours. A stale result may remain useful for context, but it is not a substitute for a successful refresh when current state matters.
Deletion controls
- Use Disconnect PostHog to revoke the OAuth session when available and remove credentials from Keychain.
- Use Delete all local data to remove the SQLite cache and local definitions.
- Enable Also delete Keychain credentials when deleting local data if both stores should be cleared together.
Security boundary
OAuth is the recommended connection method and requests only the read scopes HogScope uses. If you choose the personal API key fallback, create a dedicated key with narrow read scopes and revoke it when the device no longer needs access.