Privacy Policy

Last updated November 2, 2026

Purl is an iPhone and iPad client for tangled, the code forge built on the AT Protocol. It is developed by SparrowTek LLC (“we”, “us”). This policy explains what information the app handles, where it goes, and what stays on your device.

The short version: Purl has no analytics, no ads and no tracking, and we run no server that keeps a copy of your data. Your account lives with your AT Protocol provider and your code lives on tangled. Purl is a window onto both.

Signing in

You sign in with an existing AT Protocol account, for example one on tngl.sh or Bluesky, using OAuth. You enter your password on your provider’s own sign-in page, so Purl never sees it. The app receives tokens that let it act on your behalf, and keeps them, with the cryptographic key that protects them, in the iOS Keychain on your device.

You can also use Purl without signing in. Everything public on tangled can be read without an account.

What you create

Issues, pull requests, comments, reactions, labels, stars, follows, merges, branch deletions and CI actions you take in Purl are sent to your provider (your PDS), to the knot that hosts the repository, or to the repository’s spindle. Records on tangled are public by design and are governed by the policies of tangled, your provider and whoever runs that knot or spindle, not by us.

What stays on your device

• Session credentials: OAuth tokens and keys for each account you sign in with, in the iOS Keychain.
• Recent and pinned repositories, so they are one tap away.
• Pending attestations: a short list of the changes you made on knots, kept until the matching record is written to your PDS.
• Preferences: appearance, code font size, line wrapping, diff layout and your recent searches.

Signing out removes that account’s session from the device. Deleting the app removes everything Purl stored.

Who the app talks to

Purl connects directly from your device to these services. Each one sees your IP address and the requests the app makes to it, under its own privacy policy.

• Your AT Protocol provider (PDS): sign-in, your personal records, and the single-use tokens that authorize each write elsewhere.
• Tangled: its public API (api.tangled.org) for repositories, code, issues, profiles and search, and its notification service (notifs.tangled.network) for your inbox and notification and email-digest preferences.
• Knots and spindles: the servers that host each repository and run its CI. Tangled runs some; others are run by the repository’s owner.
• Identity directories: plc.directory and the domains behind handles, to turn handles into accounts and back.
• Bluesky: when an account has no tangled avatar, Purl loads its Bluesky avatar from Bluesky’s public servers.
• Image hosts: images embedded in READMEs, issues and comments load from wherever their author put them.

Our sign-in service

During sign-in and when your session is renewed, requests pass through our authentication service at auth.sparrowtek.com. It exists only to keep you signed in for longer than a public app can on its own. It signs the request with Purl’s key and forwards it to your provider. It does not store your tokens, your identity or any personal data, and it keeps no user database.

Other apps

If you choose Clone in Working Copy, Purl hands the repository’s clone URL to Working Copy, which handles it under its own policy. Links you open to the web are shown in an in-app Safari view.

What we don’t do

We do not sell, rent or share your personal information. Purl collects no analytics, shows no advertising and embeds no third-party tracking or crash-reporting SDKs. Apple may share crash reports with us if you opt in to sharing them with developers in iOS Settings.

Children

Purl is not directed at children. You must meet the minimum age your AT Protocol provider and tangled require, and the age required by the laws where you live.

Deleting your data

To delete something you published, delete it in Purl or any other tangled client; how deletions spread across the network is up to tangled and your provider. To delete your account, use your provider’s tools, or tangled.org’s settings for a tngl.sh account. To remove everything Purl keeps on your device, sign out or delete the app.

Changes to this policy

If we change this policy, we will update this page and the date at the top. Material changes will also be noted in the app’s release notes.

Contact

Questions about privacy? Email SparrowTek LLC at support@sparrowtek.com.