Privacy & terms

Privacy

Short version: there are no accounts, no cookies, no advertising and no analytics or tracking services on this site, and what you type into Ponder here never leaves your device.

What the site itself records

Two numbers in the footer. The visit counter adds one each time a page is loaded and stores nothing about who loaded it. The “people here now” figure works by your browser sending a random id, made fresh each time a page opens and kept only in memory (not in a cookie or in your browser's storage), every twenty seconds while the page is open. The server keeps that id and a timestamp for about 45 seconds and then forgets it. It does not record your IP address.

What the hosting provider sees

The site is served by Netlify. Like any web host, Netlify processes technical request data such as your IP address and browser type to deliver pages and keep them secure, under Netlify's own privacy policy. This site does not use that data.

What is stored on your device

Your light/dark choice, if you make one, is saved in your browser so the site remembers it. On the Ponder page, the task list and notes you ask it to keep are saved in your browser too. Both stay on your device; clearing this site's data in your browser removes them.

The Ponder page

Ponder here runs entirely in your browser, on your own graphics card. Your messages, your tasks and any folder you choose to scan are processed on your device and are never sent to me or to anyone else; a chosen folder is only read, not uploaded or changed. The one thing that does travel is the model itself: the first time you press start, your browser downloads the model from Hugging Face (and a small program that runs it from GitHub). Those services can see that your address requested those files, under their own privacy policies, but not what you then say to Ponder.

The Chrome extension

The extension reads a page only when you summon it on that page, and only the text you selected (or the text and a picture of a part of the screen you chose). That text goes to a model that runs on your own computer, either the one built into Chrome or Ollama, and is never sent to me or to anyone else; the extension is not permitted to connect to any address except your own computer, and Chrome enforces that. What it keeps (your settings, your own commands, a licence if you have one, and a history only if you turn it on) is stored on your device, encrypted, and can be exported or erased from its Options page. It has no account, no analytics and no tracking. The one download involved is Chrome's own model, which Chrome fetches from Google under Google's policies; Ponder does not see it.

The Windows app

The app runs on your computer and answers with a model that also runs on your computer, so what you ask is not sent to me or to anyone else. It keeps your chats, what it remembers, your task list, a record of what it changed (so you can undo it) and your settings as plain files in its own folder, on your device. Settings can save your chats as one file or clear them, and the memory can be erased there too. Nothing is uploaded unless you share something yourself, connect an account (such as Google, which then sees what an app connected to it normally sees), or add your own Anthropic key, in which case the text it reads for you is sent to Anthropic to be answered. The only downloads are the model and the programs that run it, from their own publishers.

Updates. Once a day (you can turn this off in Settings, General) the app asks this site for one small file that says whether a newer version of Ponder exists, and the signature that proves it is mine. Nothing is sent but the request itself: no identifier, no version number, no list of anything. My host sees an address asking for a file, as it does for any page. Nothing is installed unless you press Update; the signature and a checksum of every file are checked first, your chats and settings are not touched, and the old files are kept in case they have to be put back. A copy run from a source checkout never asks. Settings, About lists every place the app can reach.

Voice chat and the microphone. Talking to the app uses the microphone only after you press the microphone button, and only for the app's own window. The realistic voices and the listening that understands what you say are optional downloads (about 0.4 GB and 150 MB) that you start yourself, fetched from nodejs.org, the npm registry and GitHub and checked against checksums written into the app. After that, speaking and listening happen on your computer: the sound is understood as it arrives, is never written down, and is sent nowhere. In a browser (not the app's own window) voice chat uses that browser's own speech recognition instead, which is a service the browser's maker runs.

Getting back into an account. If you turn it on for an account with a passcode, a recovery code is saved as a draft in your own Gmail (to yourself, never sent) and a copy of the account's key, locked so that only that code opens it, stays beside the account. Getting back in needs both the files on your computer and a fresh sign-in to that Gmail. I never see any of it.

The Mac version and the Chromebook demo

Ponder for Mac is the same app, and everything above applies to it, with its files in ~/Library/Application Support/Ponder and the Trash in place of the Recycle Bin. Its installer contacts nodejs.org once to fetch Node.js (the small program Ponder runs on) and checks it against a checksum written into the installer; the engine and the model come from their publishers, as on Windows. The Mac package is not signed or notarized by Apple, so macOS asks you to open it deliberately. It is a first release that has not been tested on many real Macs.

The Chromebook demo is not the app and has no AI in it: every answer is written in advance, and it cannot read what you type. It makes no network request, has no microphone, and stores nothing you type (the browser may keep small display choices, such as whether a panel is open). Its computer and calendar are made up. If you ask it to read an answer aloud, your browser uses its own speech voices, which in some browsers are provided by an online service; the demo itself sends nothing.

Accounts, incognito and sharing in the Windows app

An account is a folder on your own computer, not an account with me or with anyone: there is no sign-up and no server. Each account has its own chats, memory, tasks and settings. If you give an account a passcode, those files are encrypted with a key made from it; I cannot recover a forgotten passcode, because I never have it. Without a passcode the files are as readable as anything else in your Windows user folder. An incognito chat is not saved, does not read what is remembered and cannot be remembered, though anything it changes on your computer is still recorded so you can undo it. A chat can be shared only with an account: it is encrypted to that account's public key and signed by yours, so only that account can open it. Between accounts on one computer it goes into the other account's inbox; for an account on another computer it becomes a file that you send yourself, and the app uploads nothing. Anyone who is sent such a file by mistake cannot open it.

If you email me

I receive your address and message and use them to reply. I don't add you to a mailing list or share your details. To ask what I have or to have it deleted, write to ethan.ai.ganz@gmail.com.

The site is not aimed at children, and it does not knowingly collect personal information from anyone.

Terms of use

The site

The writing, research and design on this site are © Ethan Ganz. You're welcome to quote short passages with a link back; for anything more, ask. The site and its contents are provided as they are, for information only, and may contain mistakes. The research pages describe a small pilot study and make no claim beyond what they say.

Ponder in your browser

It's a small AI model, and small models are often wrong, incomplete or oddly worded. Don't rely on it for medical, legal, financial, safety or any other decision that matters; check anything important yourself. It knows about Ponder and what you tell it, and nothing else.

Ponder in Chrome

The same cautions apply: a small model can be wrong, so check anything that matters. Replace changes text on a page only when you press it, and Ctrl+Z undoes it. A paid plan, when one is on sale, is a licence key checked on your device; it unlocks features and does not change what the extension does with your data. Prices, refunds and the full licence terms will be stated here before anything is sold, and nothing is sold today.

Ponder for Windows (the free download)

The software is open source under the MIT License, which lets you use, change and share it and says plainly that it comes without warranty of any kind. It is a personal project, not audited or commercial software. Please read this before running it, because it can act on your computer and accounts:

• The installer is a program (LingLong-Setup.exe) with the app and its own engine (Electron and Node.js, so it does not use Edge or Chrome) inside it, so it downloads nothing and makes no network connection; its source is in the download, and the same file is offered in a zip with its checksum beside it. It adds the program and two icons in your own user folder, never asks for administrator rights, and starts nothing at sign-in unless you ask. It is not signed with a paid certificate yet, so Windows and your browser may warn about it: that warning is about who published it, not about what it does, and the Ponder page says how to check the file is the one that was published.
• It can move files, and send files to the Recycle Bin, after showing you a preview. Keep backups of anything you can't afford to lose; you are responsible for what you approve.
• You choose how much of your computer it may touch (see how much it can do). At the higher levels it can open files, links and apps, type and press keys in the window in front, and run PowerShell commands on your behalf. Those levels are off unless you turn them on, they time out, each step is shown to you first and recorded in a log, and some things are never done, but an AI can still misunderstand you or be misled by what it reads. You are responsible for what you allow and what you approve, and should not raise the level while you have unsaved work or anything open that you can't afford to disturb.
• If you connect Gmail or Calendar, you do it with a Google Cloud project that you create, so you are the developer of that project and responsible for following Google's API Services User Data Policy and terms. Ponder saves drafts for you to send yourself; it has no code that sends mail.
• If you use an Anthropic API key, Anthropic bills the key's owner, the text Ponder reads for you is sent to Anthropic to be answered, and Anthropic's terms apply to you. Ponder does not use, and does not support, Claude.ai subscription logins. A model running on your own computer sends nothing anywhere.
• The optional phone-calling feature is yours to use lawfully. It needs your own Twilio account, tells the person they are speaking to an AI, and refuses emergency and premium numbers, but the law about automated and AI-voiced calls and about recording calls differs by country and by state (in the United States, for example, the Telephone Consumer Protection Act and state recording-consent laws). Don't use it for marketing, robocalls, harassment or to mislead anyone, and follow Twilio's acceptable-use rules. You are responsible for every call it places on your account.
• You are responsible for following the laws and the terms of every service you connect it to, and for how you configure and use it.

Limits

To the fullest extent the law allows, I'm not liable for loss or damage of any kind arising from using this site, the Ponder page or the downloadable software, including lost files, lost data, charges on accounts you connect, or decisions made on the strength of an AI's answer. Nothing here limits any right you have that can't legally be limited.

Copyright

Ponder, the app, the extension, the installer, this site and its writing are © 2026 Ethan Ganz. The software is released under the MIT License, which lets you use, change and share it as long as you keep the copyright notice and the license text with it. The name Ponder and its logo are mine too; the license does not make them anyone else's.

Names and affiliation

Ponder is an independent project. It is not affiliated with, endorsed by or sponsored by Anthropic, Google, Microsoft, Twilio, Netlify, Hugging Face, GitHub or Alibaba Cloud. Their names and products are trademarks of their owners and appear only to say what a feature works with.

Changes

I may update this page; the date at the top shows when it last changed. Questions: ethan.ai.ganz@gmail.com.

Open-source licenses

This site is built on open-source software, and the Ponder page runs models released under open licenses: Qwen2.5 by Alibaba Cloud (Apache License 2.0), run in your browser with WebLLM by the MLC team (Apache License 2.0). Only models with permissive licenses are offered. The full license text for every package and font the site ships is in THIRD-PARTY-NOTICES.txt. The Ponder for Windows source is under the MIT License, included in the download. The Windows app is built on Electron (MIT), Chromium (BSD-3-Clause and others) and Node.js (MIT), whose license texts are installed with it and shown in Settings, About. The optional voices and listening use Kokoro-82M (Apache License 2.0), sherpa-onnx (Apache License 2.0) and a NeMo speech model by NVIDIA (CC-BY-4.0, attribution: NVIDIA NeMo); the pronunciation data that comes with the voices is espeak-ng data (GPL-3.0-or-later), used as data and not modified.