--- title: "Security & Permissions: Read-Only PostHog | MobileHog" description: "How MobileHog connects to PostHog: read-only OAuth scopes, PKCE sign-in, tokens in the Keychain or Keystore, no MobileHog servers, and no background queries." url: https://mobilehog.app/security --- [mobilehog](https://mobilehog.app/) security # Read-only by design MobileHog can only read from PostHog: it requests 12 permissions, all ending in ":read", and never a write scope. Your phone talks to PostHog directly, credentials stay in the iOS Keychain or Android Keystore, and there is no MobileHog server your data could pass through. Updated September 24, 2026 // on this page 1. [Where your data goes](#data-flow) 2. [Every permission, explained](#permissions) 3. [How sign-in works](#sign-in) 4. [What is stored on your phone](#storage) 5. [Your query quota](#quota) 6. [Reporting a security issue](#report) ## Where your data goes The app sends every request straight to PostHog: `us.posthog.com`, `eu.posthog.com`, or the address of your self-hosted instance. Nothing is proxied, mirrored or logged by us. The app contains no analytics, crash-reporting or advertising SDKs. The only thing it ever fetches from `mobilehog.app` is a small public file that PostHog needs for sign-in. ## Every permission, explained 5 permissions are required: without them there is nothing to show. The other 7 each unlock exactly one screen. If you leave one out, that screen tells you which permission it is missing and everything else keeps working. Signing in with a PostHog Cloud account also requests `openid profile email` so the app can show which account you are using. | Permission | Needed | What it’s for | API it calls | | --- | --- | --- | --- | | user:read | Required | Confirms who you are when you connect. | GET /api/users/@me/ | | project:read | Required | Lists the organizations and projects you granted access to. | GET /api/organizations/, /api/organizations/:id/projects/ | | dashboard:read | Required | Reads your dashboards and their tiles. | GET /api/projects/:id/dashboards/ | | insight:read | Required | Reads your saved insights. | GET /api/projects/:id/insights/ | | query:read | Required | Runs the read-only queries behind every number: tile results, web analytics, recent events. | POST /api/projects/:id/query/ | | error_tracking:read | Optional · Errors | Lists error tracking issues with occurrences and affected users. | POST /api/projects/:id/query/ (ErrorTrackingQuery) | | feature_flag:read | Optional · Feature flags | Lists feature flags and their rollout. | GET /api/projects/:id/feature_flags/ | | experiment:read | Optional · Experiments | Lists experiments. | GET /api/projects/:id/experiments/ | | survey:read | Optional · Surveys | Lists surveys. | GET /api/projects/:id/surveys/ | | session_recording:read | Optional · Session replays | Lists recent session recordings. Playback opens in your browser. | GET /api/projects/:id/session_recordings/ | | cohort:read | Optional · Cohorts | Lists cohorts. | GET /api/projects/:id/cohorts/ | | annotation:read | Optional · Annotations | Lists annotations. | GET /api/projects/:id/annotations/ | This table is generated from the list the app itself uses when it signs in, so it can’t fall behind the app. ## How sign-in works - **OAuth 2.0 with PKCE.** You sign in on PostHog’s own page, in your phone’s system browser. The app never sees your password, and it is a public client without a secret that could leak. - **You choose the scope of access.** PostHog’s consent screen lets you grant all organizations, specific organizations or specific projects. MobileHog shows exactly what the token covers. - **Registered by URL, not by us.** PostHog identifies MobileHog through a public client document at `mobilehog.app/oauth-client.json`, which lists the only address a sign-in may return to. - **Self-hosted PostHog** connects with a personal API key you create yourself, with only the permissions you tick. ## What is stored on your phone - **Tokens and API keys** live in the iOS Keychain or Android Keystore. Access tokens expire after about ten hours; refresh tokens rotate on every use, so an old one stops working as soon as a new one is issued. - **Recent results** are cached on the device so the app opens instantly. They never leave the phone. - **“Remove connection”** in Settings deletes the credentials and every cached value, and revokes the sign-in token with PostHog. ## Your query quota PostHog meters queries per project. MobileHog reads PostHog’s cached results first and only asks for a fresh calculation when you pull to refresh. Nothing runs in the background: the app only talks to PostHog while you’re looking at it. Settings shows how much of your project’s query budget is left. ## Reporting a security issue Email [klaus@7eicher.net](mailto:klaus@7eicher.net?subject=Security) with “Security” in the subject. Please don’t include tokens or keys. We answer every report. See also our [security.txt](https://mobilehog.app/.well-known/security.txt) and the[privacy policy](https://mobilehog.app/privacy). Your PostHog dashboards, on your phone. Free to download. Read-only. No subscription. - For iPhoneComing soon - For AndroidComing soon