Your camera stays on this Mac.
Effective
Pelion analyses camera frames on your Mac and discards them — no video is recorded, stored or uploaded, and this website collects nothing at all. The app does send anonymous usage analytics by default, which you can switch off, and those never include images.
How a frame is handled
1. Camera
A frame is read into memory while the camera light is on.
2. On-device inference
The model runs locally and derives angles and a load estimate.
3. Discarded
The frame is released. Only the numbers continue.
No step writes a frame to disk or sends one over a network. That is a property of how the app is built, not only a policy we promise to keep. See the original data-flow diagram and equivalent text.
Three separate boundaries
The Mac app
Analyses camera frames on your Mac and discards them, and keeps aggregate numbers locally. It also sends anonymous usage analytics unless you switch that off — which matters, because it is on by default.
This website's live demo
Runs the same model inside your browser tab. No frame, feature or number from the demo is transmitted anywhere, and this site sets no cookies, stores nothing in your browser and runs no analytics of any kind.
The MCP server
Off by default. When on, the app writes your current reading to a private file on your Mac so a local AI client can read it. The server opens no port and makes no network request of its own.
What exists, and where
| Data | Status | Detail |
|---|---|---|
| Camera images and video | Never stored | Held in memory for a single frame, then discarded. Nothing is written to disk, so there is nothing to upload, sync or leak. |
| Derived angles and load | Stored on your Mac | Numbers only — tilt, estimated load, confidence. |
| History (day stats, 5-minute buckets) | Stored on your Mac | Aggregates only. Retention is a setting; “Delete all data” erases it. |
| Settings and calibration baseline | Stored on your Mac | Local. Monitoring never requires an account. |
| Usage analytics | Sent unless you opt out | On by default. Anonymous event names and parameters — never images or frame data. See the section below. |
| MCP snapshot | Written only while MCP is on | A single current reading in a private file, deleted when you switch MCP off. Never uploaded. |
| This website | Nothing | No cookies, no browser storage, no analytics, no account, no email. |
Usage analytics, precisely
The Mac app sends anonymous usage analytics to our analytics provider, PostHog, hosted in the United States. It is on by default, and you can switch it off in Settings → Privacy & Data.
Events are anonymous names and parameters — which surfaces were used, when a nudge fired, whether a calibration succeeded. They never contain images, video or frame-level sequences. There is no advertising identifier and no cross-site tracking.
Two details worth stating plainly rather than glossing. Switching analytics off sends one final event recording that you switched it off, and then nothing further is sent. And the app keeps writing a local analytics log on your Mac either way — that log never leaves your machine, and “Delete all data” erases it along with everything else.
The MCP snapshot
Pelion ships a local Model Context Protocol server so AI clients on your Mac can read your posture context. It is off by default; everything below applies only while you have switched it on.
- While enabled: the app writes your current reading to
~/Library/Application Support/PelionPosture/mcp/snapshot.json, no more than once a second, with file permissions0600— readable only by your macOS user. - What it holds: one instant. A tilt, a load estimate, gated head angles. No images, no raw sensor values and no history — each write replaces the last.
- When it goes stale: a reading older than ten seconds is treated as absent, and the server reports that the app is not running rather than handing back an old number.
- When you switch MCP off: the app stops writing and deletes the file, leaving only a marker saying the server is disabled. No reading remains on disk.
- When you quit Pelion: the final write contains no readings at all — only the fact that the app has quit.
The server makes no network request of any kind and listens on no port; it talks over stdio to the client that launched it, and we never upload the snapshot. Once your own AI client has read it, what that client does with the data is governed by that client rather than by Pelion.
Exporting and deleting your data
Settings → Privacy & Data has both. Export my data writes out your numbers in the same shape the app stores them. Delete all data erases your baseline, history, statistics and the local analytics log. There is no undo — and no copy on our side to delete, because there is no account and no server-side store of your posture data.
This website
Downloading the app is a direct file download: no sign-up, no email, no waitlist. The site sets no cookies, stores nothing in your browser and runs no analytics. The “try it live” demo asks for the camera only after you click, runs the model inside your browser tab and sends nothing anywhere; stopping it releases the camera and keeps nothing.
Children
Pelion Posture is not directed at children under 16, and we do not knowingly collect their information.
Changes to this policy
If the way Pelion handles your data changes, this page and the effective date above change with it.
Contact
Questions about this policy or your data? Email support@pelionai.co.