Privacy
Poppet watches that your coding agent is working, never what you or the agent said. This page lists everything it reads, and everything that would ever leave your Mac.
What the app reads
These signals, and nothing else. The one part of the app that sees raw log lines keeps a short list of structural fields and drops the rest as it parses. Session titles aren't read either, since they summarise the conversation.
| signal | from | what it reads |
|---|---|---|
| you're typing / away | seconds since your last input | a number of seconds — not what you type |
| thinking · tool · done | Claude Code, Codex, GitHub Copilot and Grok Build session logs | the type of each entry and its time — never its text |
| which session, where | the same logs | the session's folder and which app hosts it |
| which desktop session to open | the Claude desktop app's session files | the first 256 bytes: two session ids |
| idle | no log activity for 60 seconds | nothing |
What it never reads
- Your prompts, the agent's replies, or any code, file contents or command output.
- What you type: only how many seconds ago you last typed.
- Your screen, your windows' contents, or other apps' data.
What leaves your Mac
Nothing about you or your work. Poppet collects no analytics, sends no crash reports and has no account. These are its only connections:
- Checking for app updates — once a day, and when you choose Check for Updates…, it reads the list of releases on poppet.itape.app. It sends only its version number.
- Checking for new characters — a little after it starts and every six hours, it reads the gallery's catalog on poppet.itape.app, and downloads new versions of the characters you have. It reads the catalog again when you open the Character Gallery, and downloads the characters you get there. It sends only its version number, and no cookies.
- Activating Pro — sends your license key and your Mac's name to Lemon Squeezy, and the same again if you deactivate. Poppet doesn't check the key again afterwards.
The first window Poppet shows asks whether to check for updates automatically, and Settings → About changes it. With it off, Poppet goes online only when you check for updates, open the Character Gallery or activate Pro. Like any website, poppet.itape.app sees the IP address a request comes from; nothing in the request says who you are.
Report a Problem… doesn't send anything either: it opens a new email in your own mail app, with the app's version, your macOS version and chip, the agents it found, the character in use and the last lines of its log, for you to read, change and send yourself.
All of its network code sits in a few clearly named files, so it's easy to audit.
Purchases
Payments are handled by Lemon Squeezy, the merchant of record. They see your payment and billing details; we see your email address and what you bought, to support your license. There are no accounts.
This website
poppet.itape.app is hosted on Cloudflare. Like every itape.app site, it uses Google Analytics to count visits and clicks such as downloads; it sets first-party cookies for that, and the numbers are not used for advertising. To opt out, block Google Analytics in your browser, or install Google's opt-out add-on. The characters on these pages run entirely in your browser.
It also counts how many times each character is downloaded: per day, character and version, and whether Poppet or a browser asked. It keeps no IP addresses, and nothing that tells one person or Mac from another.
Contact
Questions or requests: contact@itape.app