Telemetry & Privacy
What never gets sent
Section titled “What never gets sent”| Category | Examples |
|---|---|
| Project contents | source code, migrations, env values, database rows, logs |
| Identity | hostname, directory paths, git remotes, user names, email addresses |
| Secrets | license keys (only a truncated SHA-256 hash is used), env secrets, JWT contents |
| Traffic | requests to your stack, user session data, query results |
Opt-in telemetry
Section titled “Opt-in telemetry”All CLI telemetry is off by default. Enable with NSELF_TELEMETRY=1 or nself config set telemetry true.
Fields sent with every event when opt-in is active:
| Field | Example | Purpose |
|---|---|---|
installId | UUID generated on first run | Dedupe pings from the same install |
cliVersion | 1.1.0 | Version adoption tracking |
platform | darwin, linux, windows | Platform distribution |
arch | arm64, amd64 | Architecture distribution |
event | event type string | Routing |
payload | event-specific JSON | Non-PII structured extras |
Server also records request IP (for abuse limits), User-Agent, and a timestamp. Retention: 90 days for raw rows, indefinite aggregates.
v1.1.0 Event Types
Section titled “v1.1.0 Event Types”install_completed
Section titled “install_completed”Emitted once per successful nself install or nself upgrade.
| Field | Value |
|---|---|
cli_version | Installed version, e.g. 1.1.0 |
os | darwin, linux, windows |
arch | arm64, amd64 |
Not collected: hostname, project name, directory path, user identity.
Opt-out: NSELF_TELEMETRY=false or nself config set telemetry false.
bundle_purchase
Section titled “bundle_purchase”Emitted by ping_api when a bundle subscription activates (triggered by Stripe webhook — not the CLI).
| Field | Value |
|---|---|
tenant_id | Paying account identifier (UUID, not personal identity) |
bundle_name | nclaw, nchat, ntv, nfamily, clawde, nsentry |
plan | monthly, annual, nself_plus |
Not collected: payment method, card details, billing address, personal name.
Opt-out: Not applicable — tied to an active paid subscription (GDPR Article 6(1)(b)). Cancel the subscription to stop future events.
clawde_activated
Section titled “clawde_activated”Emitted when a ClawDE desktop client connects to a backend with a valid license.
| Field | Value |
|---|---|
tenant_id | Backend account identifier |
license_key_hash | SHA-256 truncated to 16 chars — not reversible |
app_version | ClawDE version |
Not collected: project files, conversation history, code, hostname.
Opt-out: NSELF_TELEMETRY=false in the backend environment.
nsentry_plugin_install
Section titled “nsentry_plugin_install”Emitted when an ɳSentry plugin is installed via nself plugin install.
| Field | Value |
|---|---|
tenant_id | Backend account identifier |
plugin_name | e.g. nself-uptime-monitor |
version | Plugin version |
Not collected: monitored URLs, alert contacts, project config.
Opt-out: NSELF_TELEMETRY=false.
ncloud_provision
Section titled “ncloud_provision”Emitted by the ɳCloud provisioning service when a new server is provisioned. Server-side only — not emitted by the CLI.
| Field | Value |
|---|---|
tenant_id | Cloud customer account identifier |
server_type | Hetzner tier selected, e.g. CX23, CAX11 |
region | Datacenter, e.g. fsn1 |
bundle_scope | Bundle that triggered the provision, e.g. nself_plus, ntv |
Not collected: hostname chosen by user, SSH keys, project contents, provisioned server IP.
Opt-out: Not applicable — required cloud service action (GDPR Article 6(1)(b)). Cancel the ɳCloud subscription to stop future provisions.
license_validate
Section titled “license_validate”Emitted on nself license set, nself plugin install <pro-plugin>, and nself build (when pro plugins are in the manifest). This is a required service call, not optional telemetry.
| Field | Value |
|---|---|
tenant_id | Account identifier from license record |
license_key_hash | SHA-256 truncated to 16 chars |
ip_for_geolocation_only | Request IP — used solely for geo-distribution dashboards and fraud detection |
Not collected: actual license key, project contents, env values.
Retention: 30-day raw (shorter — contains IP), indefinite aggregate counts.
Opt-out: Not applicable — required for license validation (GDPR Article 6(1)(b)).
Opt-in / opt-out matrix
Section titled “Opt-in / opt-out matrix”| Setting | Behaviour |
|---|---|
| (default, neither set) | No telemetry is sent |
NSELF_TELEMETRY=1 or =true | Telemetry events sent (license_validate always fires regardless) |
NSELF_TELEMETRY=false or =0 | No telemetry. Wins over any opt-in. license_validate still fires. |
NSELF_TELEMETRY_OPT_OUT=1 | Alias for NSELF_TELEMETRY=false |
nself config set telemetry false | Persisted opt-out, survives shell restarts |
Requests that reach the endpoint with X-Telemetry-Opt-Out: true or {"optOut": true} are answered 204 and nothing is stored.
Compliance
Section titled “Compliance”- GDPR Article 6(1)(a) — consent. Telemetry is opt-in; the default is off.
- GDPR Article 6(1)(b) — contract performance.
license_validate,bundle_purchase, andncloud_provisionevents are tied to active paid subscriptions. - CCPA. No sale of personal information. Telemetry contains no personal information as defined by CCPA §1798.140(o).
- Deletion requests. Email
privacy@nself.orgwith yourinstallIdortenant_id. Raw rows are deleted within 72 hours. Aggregate statistics cannot be retroactively removed (they contain no personal data).
Related
Section titled “Related”- Server schema:
web/backend/services/ping_api/PRIVACY.md - Endpoint source:
web/backend/services/ping_api/src/index.ts - Schema validation:
web/backend/services/ping_api/src/schema.ts - Feature flag registry:
.claude/docs/sport/F23-FEATURE-FLAG-REGISTRY.md(NSELF_TELEMETRY flag)