How usage reports help us improve our tools
We want to understand which commands, versions, and platforms matter in everyday use. Optional usage reports help us decide what to maintain and improve.
We run app-tracking at Sebastian Software GmbH in Mainz, Germany. Usage reports require your explicit permission. You can decline and still use the tool and its separately configurable update checks.
What a report contains
This overview covers the invocation and unified-client reporting contracts. Your tool’s release and privacy notice specify which metrics and controls are available.
What a report can contain
After opt-in, the tool counts locally and normally sends daily batches over HTTPS while you use it. Reports help us compare participating installations and repositories; they do not count people or everyone who uses a tool.
| Category | Details |
|---|---|
| Usage | Tool and version, UTC day, command or registered event category, and count. Dalo and Palamedes register command categories. Ferriki’s catalog registers download kind, language category, and explicit/dependency source. Catalog registration does not mean the consumer has enabled reporting. |
| System | The unified client’s current catalog selects OS family/version, executable architecture, and CPU family. Linux context can include distribution/version and kernel version. Raw hardware model strings are excluded. Legacy invocation reports have no system context. |
| Identifiers | Tool- and profile-scoped installation ID, batch ID, local/CI context, and consent metadata. Legacy IDs encode creation time and use a consent revision. Unified-client IDs are random hexadecimal values; the explicit grant timestamp is sent separately. |
| Repository | When reliable metadata exists, a SHA-256 hash of the normalized repository URL, calculated locally. The original URL is never sent. Different clones and developers share the same hash, including across our tools; forks have different hashes. |
Reports are pseudonymous rather than anonymous. A known or guessed repository URL can be used to calculate and match its hash. Installation IDs connect reports within one tool.
Reports exclude source code, file contents, command arguments, local paths, repository URLs, usernames, machine names, session IDs, and skill names or content.
Exact definitions: metric catalog, unified events, and legacy invocations.
Your controls
Each integrating tool must provide the controls below. See its documentation for the exact commands. The unified SDK supplies the permission dialog and saved choice; a software update does not count as consent. CI reporting requires separate explicit authorization and isolated state.
- Inspect
- Check the effective setting and preview queued payloads locally without sending them. Preview is not a server-side access export.
- Disable
- Stop new collection and uploads and discard unsent usage. Previously received reports remain until deletion or expiry. Update checks keep their own settings.
- Delete
- Request deletion of retained active contributions using the tool’s locally held credential. Offline deletion is not confirmed until the tool reconnects and receives acknowledgement. The legacy invocation client marks deletion unverified after 90 days without confirmation; explicitly forgetting its local state can end retries earlier. If the credential is lost, contact us for assistance.
Integrations must honor either shared off switch below, even with an existing opt-in. These local settings do not request deletion of received reports.
export DO_NOT_TRACK=1
# or
export APP_TRACKING_TELEMETRY=offHow we handle reporting data
Privacy notice for tool usage reports
We design reporting around the GDPR’s requirements for clear purposes, limited data and retention, and control over consent. Our policies make these requirements concrete through documented fields, explicit opt-in, access restrictions, and deletion controls.
Data lifetime. Usage expires from active reporting after at most 90 days, with physical cleanup within another 24 hours. Receipts last 90 days from receipt. Legacy revocation records last 90 days after revocation, without usage or repository hashes. Generic-event receipts and inactive identity state separately expire after 90 days.
Backups. The ordinary database backup policy is at most seven days. Backups are not queried for reporting. Deleting active data does not edit existing backups, and restoring a backup can roll back later deletions. The recovery policy describes this boundary.
Hosting and access. Bunny hosts the API; PlanetScale stores reporting data. Reporting views are private to authorized maintainers; no public usage export or durable historical summaries are enabled. Providers process network metadata, including IP addresses. Processing and subprocessors can involve international transfers; an EU database region does not mean EU-only processing.
Logs and verification. Application and CDN request logging are disabled by policy. Provider transport and security records are separate; we do not assert a universal maximum retention for them. The activation runbook requires verification of actual settings and a released privacy notice before real reporting is enabled.
Further details: retention and provider records, Bunny processor information, and PlanetScale DPA.
For questions about access, deletion, correction, restriction, objection where applicable, or portability, write to info@sebastian-software.de. You can also contact a supervisory authority. The released tool notice must explain applicable rights, legal bases, processors, and transfer safeguards. Please keep credentials, private repository URLs, and real payloads out of public issues.
Further information
Update checks use a separate public endpoint and work when reporting is declined or unavailable. They expose transport metadata like any network request. Version API documentation.
Future metrics. All shipped product definitions currently require opt-in. The API supports a baseline route without an installation ID, but no production baseline metric is registered. Node support, consumer adoption, and the new reporting interface remain follow-up work. Proposed direction.
This website does not opt you in or access your tool’s local state. It adds no analytics, cookies, or browser storage. Our font and image CDNs serve shared brand assets. Bunny processes request metadata to deliver and secure the page. Website privacy notice.
The source code and contracts are public. app-tracking is a focused service for our tools, separate from the OpenTelemetry framework.