Ponti

How Ponti handles your family's information

Ponti is run by Jithin Varghese Prakash.

What Ponti reads

Only what your family connects:

• the emails you forward to your family's address, and what anyone sends to it straight. What it can't confirm who sent, it refuses, and mail from someone new waits for you to say read it, but for an answer to what your family sent them from its address, such as an ask or a check-in, or to an email of yours you copied your family's address on, which it reads and tells you of;
• if you make one on Settings, You, what's sent to your own address on Ponti, as it reads your family's: what's sent to it alone is yours alone, never the other parent's to see, and what's sent to it and your family's address too is your family's;
• the kinds of mail you chose, in a Gmail or Outlook you sign it in to. It reads them there without changing them, and never a message or label you mark Private;
• with Plans from people, one of those kinds, Ponti's own code decides before Claude reads anything. In a Gmail you sign it in to, it looks at who sent each new email in your Primary inbox and to whom, its subject, its first line and its tab, and asks Gmail whether you've written to the sender before. Forwarded, or in an Outlook, it looks at each whole email whose subject has a plan's word, such as party or dinner. It reads the ones from a person that look like a plan or an ask, such as an invitation, what your circle sends, and what someone you forward an email from sends after, which you can take off in What to read. It leaves what looks like your own health, work, money or legal mail, or a surprise, and nothing of what it leaves goes to Claude, or is kept. Its code can mistake one, so what it reads is yours alone until you share it, unless you untick Only me for it;
• the calendars your schools and clubs publish, and the ones you add;
• texts and calls to Ponti's own phone number, and what you share to it from your phone;
• the sites you sign it in to, if you do;
• a child's health record in MyChart, if you link it: their appointments, vaccines, allergies, medications and pediatrician, never messages, notes or test results. Claude never reads it;
• what you say, type or show Ponti, in the app or on the web: words, recordings written out by your phone or browser, photos, PDFs and documents, such as a WhatsApp chat you export to it, which holds everyone's messages in that chat, their phone numbers and what they shared. On your iPhone, a file you add to Ponti's box starts going up at once, so it's ready when you tap Send: until then it's kept sealed, for you alone, and it's deleted when you take it out, or after 24 hours if you never send it;
• someone you pick from your iPhone's Contacts, when you tap From Contacts: only that person's name, phone and email. Ponti never reads the rest of your contacts;
• what people outside your family send back: an answer to something you asked them, a reply to an invitation, an announcement or a check-in, and what they write to your family's address.

It never reads an inbox you haven't connected, and in one you have, only what you chose.

What it keeps

• What it made of each email: events, cards, facts and receipts, each with where it came from and a short quote from it.
• The emails, pages and shares themselves, encrypted, for 90 days. Then it clears them, and keeps only what it made of each and those short quotes. An email a parent marked to teach Ponti what it got wrong is kept for that.
• What your family tells it about each of you and the people close to you, such as birthdays, phone numbers and where they live (and, for the people in your circle, where that is, to about a kilometre, so Plan B asks the nearest first), and what it learned about them from your mail, once a parent adds it. Allergies and other health details stay with your family and the sitter card: they're never in what Claude is given about your family.
• The address you give for home, for your family's parents to see, and where it is, to about a kilometre, for the weather. In co-parent mode, only its town, and where it is for the weather, which it shows to neither parent: each parent's home stays their own.
• Where each of you works, if you give it: the address you typed and where it is, to about a kilometre, for you alone, whatever the mode, for the weather there in your own day on your work days.
• Where your children's schools and activities are, as the map found them or you chose: the address as the map gives it, and where it is, to about a kilometre, for the weather there when it's further than 10 km from home. In co-parent mode nothing is looked up, and only what a parent chose is kept.
• The sign-ins you give it, encrypted and kept apart for your family in Ponti's vault. Ponti keeps a password only where you choose to: an app password for another email, or a site's sign-in you keep. Each is encrypted for your family, used only there, and never sent to an AI.
• Each passkey's public half, if you sign in with passkeys. The passkey itself stays on your device.
• About your children: what you and your family's mail tell it, such as their school, class, activities, sizes and allergies, and what a child tells it about themselves in Kid mode, which waits for a parent to keep or leave, field by field.
• A class list for a child, if you make one: classmates' first names, their families' names, and an email or phone for each family, from mail about your child, the class group or a list you paste. Each email and phone is sealed and never shown again; the list is deleted the day after the school year ends, or at once if your child's class changes.
• The guests of a gathering you host: their names, how to reach them, their answers, how many adults and children come, and the allergies or food needs they give, children's too. Deleted 30 days after its day.
• A wish list you share: who claims a gift, by the name they give, and for someone not on Ponti how to reach them, deleted 30 days after the occasion. A link to a list with no day works for 90 days.
• An announcement you send, such as a save-the-date: each person's name, how to reach them and their answer. For people not on Ponti, deleted 30 days after the day it's about.
• Your family's memories and story: the photos, voices and words you keep, a grandparent's check-ins and voice postcards (kept for your family to hear, and written out by Google's Gemini once every adult in your family has said yes to that), and the few lines Ponti's AI writes about each month for the story and the Life Book. Sealed with the person's own key or your family's. A Life archive you download holds what the parent downloading may see.
• For a helper, such as a nanny: their role, the hours they log and their pay, if you want Ponti to keep count, and their notes to you.
• The phone numbers you give for people you remind or ask by WhatsApp or text, sealed, used only to send what you choose.
• Which AI services each parent said yes to, and when.
• When each of you uses Ponti, which version of the app your iPhone has, and its notification token from Apple. From the app, the answer to each tap for a day, so a tap sent twice is done once.
• What it and each of you did, as your family's history.

Who sees it

• Your family's parents. What a parent keeps to themselves stays theirs alone.
• The people in your circle see only what their page shows, such as the day's pickups, and what you ask them, on a page of their own. Asked in their language, your words are put into it by Claude. Someone you invite to start their own Ponti from it: your family keeps the address they gave until your families are linked, you say not now, they leave your circle, or 30 days pass, and their new family is theirs alone. Other families can ask a parent things by their sign-in address, as someone in their circle; "I don't know them" hides that family's asks.
• Families you link with see your family's name and, unless you turn it off, your children's first names and ages; what else (when you're free, a hosting card for a visit, your contact details) is yours to choose on the link's page. They see what you ask them and what you answer, and nothing more of your family's. Who you trust with pickups or emergencies stays yours: they don't see it.
• An outside assistant a parent adds by its card, such as a school office's or a dentist's, learns only your answer to its own asks: nothing of your family's people, calendar or plans. One that asks to be added is kept with its name, the maker and address it says it has, its key and what it said: two weeks if nobody answers, and a month after an answer. Ponti counts calls by day and by assistant's key for three months, never what they said.
• If a parent lets Ponti ask an outside assistant something, each ask goes only when a parent taps Send. It gets your family's card (your family's name and its assistant's address on Ponti) and what that ask says: its title, the day and times you offer, and a note if you write one. Never your calendar, your address or your children's details. Its answer is kept with the ask, as your family's.
• People you ask who aren't on Ponti, such as a grandparent, a coach or a group of friends at once, get an email, a text or a WhatsApp message with what you ask, who's asking (your name and your family's) and a link only they can use to answer. Asked together, each sees only their own ask; with first yes wins, the others are told it's covered. You can also send the link yourself.
• On a hard day, the people and families you trust see what you ask them; whoever says yes sees it on their page, and the others are told it's not needed.
• A care team you're in, for an elder: everyone in it sees the elder's name, their appointments' titles, times and places and who's taking them, the costs and who paid, whose turn it is, and the team's notes; the team's stewards also see medicines, documents and an appointment's details, which Ponti keeps sealed with the team's own key. A steward's invitation is emailed to the address they give, which can then start its own family's Ponti. The team keeps the elder's email and phone, if given, and their page's words in their language. The elder's own page shows them their week, their medicines and who's looking after them, to whoever has its link; what they say there goes to everyone in the team. Speaking to it uses the phone's or the browser's own speech recognition, which may send the sound to Google or Apple. When a family leaves a team, its first name stays in the team's past so the costs still add up.
• A group you join, such as a class or a team: the families in it see your family's name, what you post, and what you sign up for or answer on its sheets and forms, and you see theirs; a gift's amount you pledge is seen by you and the group's admins only. Its admins can hide a post and see the reasons it was reported, and a post reported as unsafe is seen by Ponti's team too. Posts are kept 180 days, a sheet 30 days after it closes, and invitations 60.
• A helper's day sheet, emailed each morning once a parent turns it on, carries what their role needs, such as the children's plans, their pickups and the children's allergies.
• Whoever your family's assistant writes to sees the email it sends, from your family's address, and the parents copied on it for all to see, as the parent sending it chooses. A parent's own address shows to them only when that parent lets it, on Settings, You. What you write about your own mail goes from your own address on Ponti, if you made one, and its answers come back to you alone.
• An assistant you connect, such as Claude, reads what you chose when you connected it: the whole family, or only some of the children, and what's private to you only if you said so. It can read an email in full, as it was written, names and addresses too: Ponti doesn't mask what it gives an assistant you connect. What it reads goes to your own account with that assistant, under its terms: whether it trains on it is up to your settings there.
• Ponti's team sees your family's name and counts, such as how many families used Ponti this week and what reading your mail cost, and the answers you give when it asks how you'd feel without it. Never what's in your family's mail. If you ask the team to look at something Ponti got wrong, it looks at that alone.

Who helps run it

• Microsoft Azure keeps Ponti and its data, in the United States.
• Anthropic's Claude reads your emails, and what you say, show or ask Ponti, to understand them; reads a message to the other parent over for its tone, when you ask it to in co-parent mode; writes your story's lines; and puts what you ask the people in your circle, and an elder's page, into their language. Before anything goes to it, Ponti puts placeholders in place of the names, addresses, phone numbers and other details it recognises. Under Anthropic's commercial terms, what it reads isn't used to train its models.
• OpenAI or Google's Gemini, only if Ponti turns one on for reading your family's words (for searching by meaning, say), and only once every adult in your family has said yes to it by name: Ponti asks first, before you go on. It's sent what Claude is, masked the same way, and Ponti turns a provider on only once its terms that it doesn't train its models on what Ponti sends are on record.
• Google: Ponti's own Gmail receives what you forward and sends your emails, and Gmail and Google Calendar when you connect them.
• Google's Gemini, only for a family in Ponti's WhatsApp lab, and only once the parent who linked their WhatsApp agrees to it there: it writes out the voice notes in the chats they turned on, everyone's in them, so in a group it hears the other people's voices too. A recording can't be masked, so Gemini hears it as it was said. Ponti deletes the recording once it's written out, or when it can't be: within minutes, or at most 3 days if WhatsApp is paused or off. It keeps only the words. Under Google's terms for Ponti's paid use, Google doesn't use what it hears to train its models, and keeps it only for a limited time, to check for abuse of its service.
• Google's Gemini, for a family with grandparents' voice postcards, and only once every adult in the family has said yes to Google in words that say so: it writes out each voice message a grandparent sends, so the family can read it. A recording can't be masked, so Gemini hears it as it was said. The grandparent isn't asked themselves, so Ponti asks the parents to tell them. Ponti keeps the recording and its words for the family, until a parent forgets it. Under Google's terms for Ponti's paid use, Google doesn't use what it hears to train its models, and keeps it only for a limited time, to check for abuse of its service.
• Amazon Web Services, once your family has its own address on Ponti's mail domain: it receives the mail sent to that address, in the United States, and holds each email, encrypted, only until Ponti has read it, at most 14 days. It also sends Ponti's emails, and your family's assistant's.
• Microsoft, when you connect Outlook.
• Ponti's use of what it receives from Google's APIs, such as your Gmail and Google Calendar, adheres to the Google API Services User Data Policy, including its Limited Use requirements: Ponti uses it only to run Ponti for your family (passing it to the services above, such as Anthropic, only for that), never for ads or to train AI models, never sells it, and no person at Ponti reads it unless you ask, the law requires it, or it's needed for security.
• Apple, which delivers Ponti's notifications to your iPhone, and your browser's own push service (Apple's, Google's or Mozilla's) for notifications on the web: they get the notification's words. Where you tap to talk, your phone's or browser's own speech recognition may send the sound to Apple or Google.
• Epic and your child's health system, if you link MyChart: Ponti signs in to it for you and reads the record.
• Stripe, if you pay for a plan: it takes your card, and Ponti keeps your plan and Stripe's reference to you, never your card number.
• Pushover, only if a parent gives Ponti their own Pushover key, for alerts that sound on silent: it gets the alert's words.
• Twilio, for Ponti's phone number, when your family uses it, and for texts to people in your circle you choose to text: it gets their number and what's asked of them. WhatsApp messages go through Twilio to Meta's WhatsApp. Someone is texted asks only once they've replied YES; message frequency varies with what's asked, and message and data rates may apply. Ponti keeps their yes or their STOP, how and when, with their number kept only as a sealed fingerprint and its last four digits; of a reply, only what kind it was (yes, no, stop), never its words. Mobile information is never shared with anyone for marketing, and anyone texted can reply STOP, or HELP.
• Someone you reach from your own phone: Ponti writes the message for you to send, and you send it with your own WhatsApp or texts, under their terms. Ponti never sends it: it keeps the words it wrote, and whether you said it went, for 90 days.
• OpenStreetMap's place lookup finds the address or the town you give for home or for where you work, and where each person in your circle lives, from the town or the street you give for them, without its house number. It gets what you typed, and the country to look in, never whose it is. It finds your children's schools and activities too, by the school's name or the place you give for each, without a house number, within an area about 120 km across around home that never says exactly where home is. If you tap Use where I am now for home or for where you work, where your device is goes once to name the place: on your iPhone, to Apple's own lookup, which names it there, and Ponti gets that name and where it is to about a kilometre (where Apple has no name for it, Ponti asks OpenStreetMap's lookup to name its neighbourhood); in a browser, where it is goes to Ponti, which asks OpenStreetMap's lookup to name it. The address you choose of what's named is kept as if you'd typed it, and where it is, to about a kilometre; Ponti never follows where you go.
• MET Norway's forecast gets where home is, to about a kilometre, the towns family far away live in, where your children's schools and activities are when they're further than 10 km from home, and the area each of you works in, to about 10 km, for the weather.

Ponti doesn't sell your information, or share it with anyone beyond what's said above and what you choose to share, and shows no ads.

How long it's kept

• While your family uses Ponti, it keeps what it made of your mail, what you keep, and your family's history, until you delete them or your family's account.
• An email's, a page's or a share's own words: 90 days. Mail at Amazon waiting to be read: 14 days at most. A file sent ahead from your iPhone and never sent: 24 hours. The answer to a tap from the app: a day.
• Something you delete waits 30 days in Recently deleted, then it's gone. A message you sent from your own phone: 90 days. Guests, wish-list claimers and announcement people not on Ponti: 30 days after the day. A class list: until its school year ends. Group posts: 180 days.
• Backups: 14 days. Ponti's logs, which never hold what your mail says: 30 days.

Your choices

• Disconnect any account on its page, at any time, and any assistant you connected, under Settings, Claude.
• Keep a kind of mail, an address or a sender to yourself.
• Choose what each linked family sees, and put a link on hold, cut it or block a family, on its page. Stop Ponti asking an outside assistant, under Settings, Your assistant.
• Download everything Ponti keeps about your family, under Settings, Your family's data.
• Delete your family's Ponti account there. Everything goes, its history too: from Ponti within about an hour, and from its backups within 14 days. Ponti also takes its rules out of your Outlook, deletes the calendars it made for you and takes back its access to your Google account; you remove Ponti from your Microsoft account, and your own mail filters and forwarding, yourself.

If something goes wrong

If your family's information is ever exposed, Ponti tells you, by email and in Ponti, as soon as it can and within 60 days at most: what happened, what was involved, and what you can do. While its team looks into something, it may pause your family's Ponti account. It then stops reading and sending, and you can still sign in and see everything.

Children

Ponti is for parents. It keeps what parents give it, and what their mail says about their children. Children don't have accounts.

• A parent can hand their own signed-in phone to a child in Kid mode, on the web: the child sees their own day and to-dos, ticks things off and asks a parent. What a child types or says there is theirs on a parent's phone: what they tell Ponti about themselves is read like anything a parent says, including by Claude, and kept only once a parent keeps it. Talk uses the browser's own speech recognition, which may send the sound to Apple or Google.
• A parent sees everything Ponti keeps about each child, changes it, and deletes a child, or the whole family, at any time.
• A child's details go beyond your family only as a parent chooses: to linked families (first names and ages, unless you turn that off), a helper's day sheet, a gathering's guest list, or a class list's families.
• Health you keep on a child's page, and their MyChart record, never go to an AI.

Changes

A new version gets a new date, and each parent is asked to agree to it before going on.

Questions and requests

Ask the person who invited you to Ponti.

Privacy · Terms · Ponti