datlechin · Nov 6, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 6, 2026
diff --git a/images/ios-first-run-dark.png b/images/ios-first-run-dark.png
diff --git a/images/ios-first-run.png b/images/ios-first-run.png
diff --git a/ios/index.mdx b/ios/index.mdx
@@ -17,13 +17,13 @@ A welcome sheet lists what the app does. **Continue** leads to at most two quest
 | Question | Shown when | If you swipe the sheet away |
 | --- | --- | --- |
 | **Sync with iCloud** | The device is signed in to iCloud | Sync stays off |
-| **Share Usage Data?** | Always | Nothing is sent |
+| **Share Usage Data?** | Until you answer it | Nothing is sent |
 
 Both answers can change later, under **Settings > iCloud** and **Settings > Privacy**. After an update, a **What's New** sheet lists what changed, once per version.
 
 <Frame caption="Swipe the sheet down to skip both questions">
-  <img className="block dark:hidden" src="/images/ios-first-run.png" alt="Welcome to TablePro sheet with four feature rows, beside the Share Usage Data page listing what the daily report contains" />
-  <img className="hidden dark:block" src="/images/ios-first-run-dark.png" alt="Welcome to TablePro sheet with four feature rows, beside the Share Usage Data page listing what the daily report contains" />
+  <img className="block dark:hidden" src="/images/ios-first-run.png" alt="Welcome to TablePro sheet with four feature rows and a Continue button" />
+  <img className="hidden dark:block" src="/images/ios-first-run-dark.png" alt="Welcome to TablePro sheet with four feature rows and a Continue button" />
 </Frame>
 
 ## Supported databases
@@ -308,7 +308,18 @@ A connection that uses an [SSH profile](/connections/ssh-profiles) on the Mac ar
 
 ## Privacy
 
-**Share Usage Data** under **Settings > Privacy** sends one small report a day: a hashed device identifier, the app and iOS versions, your language, the database types you use, and when you first connected and first ran a query. It is off unless you chose **Share Usage Data** on first launch, and it never carries a hostname, username, password, query, or row.
+Nothing is sent until you choose **Share Usage Data** on first launch, or turn on **Share Usage Data** under **Settings > Privacy**. While it is on, the app sends events to PostHog, the product analytics service, at `https://eu.i.posthog.com` in the EU:
+
+| Event | Sent | Properties |
+| --- | --- | --- |
+| `app_opened` | Once per local day, ten seconds after the app comes to the front | `database_types` and `connection_count` of the connections open at that moment |
+| `connection_attempted`, `connection_succeeded`, `first_query_executed` | Once per install | `database_type`, such as `PostgreSQL` or `SQL Server` |
+
+Events carry a random ID that the library makes on the device, and PostHog builds no profile from it. The library, posthog-ios, adds the device model, screen size, language, time zone, whether the device is on Wi-Fi or cellular, the app's version, build and bundle ID, the iOS version, whether the build came from TestFlight, the library's version, and a random session ID. PostHog sees the IP address of each request and derives an approximate location from it, such as the country and city. While the switch is on, the library also fetches its settings from `eu-assets.i.posthog.com`.
+
+No hostname, username, password, query, or row. With the switch off the app sends PostHog nothing, and a launch with it off never starts the library.
+
+Earlier versions sent one report a day to TablePro's server instead. If you had chosen **Share Usage Data**, it stays on after the update and sends to PostHog, and a device that already reported its first connection and query does not send them again. If you declined, it stays off, and if you never answered, the question comes up on the next launch.
 
 **Settings > About** holds the version, **What's New**, the privacy policy, and **Acknowledgements** for the open source libraries the app ships.
 

diff --git a/security/privacy.mdx b/security/privacy.mdx
@@ -11,7 +11,7 @@ Turn off app usage data in the privacy settings if you do not want to send it. M
 | --- | --- | --- |
 | [Mac usage data](#usage-data), from 0.86.0 (first build 0.86.0-beta.1) | PostHog EU | On; **Settings > General > Privacy > Share usage data** |
 | [Linux usage data](#linux-usage-data), from 0.1.0-beta.1 | PostHog EU | On; **Preferences > General > Privacy > Share Usage Data** |
-| [iOS usage report](#iphone-and-ipad-reports) | `api.tablepro.app` | Off; **Settings > Privacy > Share Usage Data** |
+| [iOS usage data](#iphone-and-ipad-usage-data) | PostHog EU | Off; **Settings > Privacy > Share Usage Data** |
 | [Mac update check](#update-checks) | `updates.tablepro.app` | On; **Settings > General**, under Software Update |
 | [Mac plugin catalog](#the-plugin-catalog) | `updates.tablepro.app` | On; no off switch |
 | [AI provider](#ai-providers) | Your chosen provider | No provider on a fresh install; remove it or turn off **Enable AI Features** |
@@ -69,9 +69,13 @@ Before 0.86.0, the default-on switch controls a `POST` to `https://api.tablepro.
 
 `X-Signature` contains an HMAC-SHA256 of the JSON. The old Mac path does not report the first query. The current server relays the report to PostHog with Cloudflare's country, without an IP address or license key, and without creating a person profile. The machine ID can link reports to account devices. The server no longer keeps a dedicated heartbeat history; processing jobs, logs, backups and the migration archive are separate. Before the November 4, 2026 server cutover, heartbeat records included IP addresses. See [retention](https://tablepro.app/privacy#retention).
 
-### iPhone and iPad reports
+<span id="iphone-and-ipad-reports" />
 
-The shipped app starts its heartbeat only after **Share Usage Data** is enabled at onboarding or in **Settings > Privacy**. It uses the same relay endpoint. Its fields are `machine_id` (SHA-256 of Apple's identifier for vendor), `platform` (`ios`), `app_version`, `os_version`, `architecture`, `locale`, `database_types`, `connection_count`, `has_license` (always false), `connection_attempted_at`, `connection_succeeded_at` and `first_query_executed_at`. It has no update settings and makes no account, license, update or plugin check. See [iOS privacy](https://tablepro.app/privacy#ios-app) for the separate Apple diagnostics route.
+### iPhone and iPad usage data
+
+Nothing is sent until you choose **Share Usage Data** at onboarding or turn it on in **Settings > Privacy**. The app then sends `app_opened`, `connection_attempted`, `connection_succeeded` and `first_query_executed` to PostHog at `https://eu.i.posthog.com`, with a random installation ID and no person profile. [iPhone and iPad](/ios#privacy) lists their properties and what posthog-ios adds. The app makes no account, license, update or plugin check. See [iOS privacy](https://tablepro.app/privacy#ios-app) for the separate Apple diagnostics route.
+
+Earlier versions sent a daily report to the relay endpoint above instead, also only after you chose **Share Usage Data**. Its fields were `machine_id` (SHA-256 of Apple's identifier for vendor), `platform` (`ios`), `app_version`, `os_version`, `architecture`, `locale`, `database_types`, `connection_count`, `has_license` (always false), `connection_attempted_at`, `connection_succeeded_at` and `first_query_executed_at`.
 
 ## AI providers