Skip to main content

Telemetry & Privacy

What data nSelf CLI and ɳCloud collect, how long it is kept, and how to opt out.

:::note Short version: your project data, secrets, and database contents never leave your network. Anonymous telemetry is opt-in and off by default. :::

What never gets sent

Category Examples
Project contents source code, migrations, env values, database rows, logs
Identity hostname, directory paths, git remotes, user names, email addresses
Secrets license keys (only a truncated SHA-256 hash is used), env secrets, JWT contents
Traffic requests to your stack, user session data, query results

Opt-in telemetry

All CLI telemetry is off by default. Enable with NSELF_TELEMETRY=1 or nself config set telemetry true.

Fields sent with every event when opt-in is active:

Field Example Purpose
installId UUID generated on first run Dedupe pings from the same install
cliVersion 1.1.0 Version adoption tracking
platform darwin, linux, windows Platform distribution
arch arm64, amd64 Architecture distribution
event event type string Routing
payload event-specific JSON Non-PII structured extras

Server also records request IP (for abuse limits), User-Agent, and a timestamp. Retention: 90 days for raw rows, indefinite aggregates.

v1.1.0 Event Types

install_completed

Emitted once per successful nself install or nself upgrade.

Field Value
cli_version Installed version, e.g. 1.1.0
os darwin, linux, windows
arch arm64, amd64

Not collected: hostname, project name, directory path, user identity.
Opt-out: NSELF_TELEMETRY=false or nself config set telemetry false.

bundle_purchase

Emitted by ping_api when a bundle subscription activates (triggered by Stripe webhook, not the CLI).

Field Value
tenant_id Paying account identifier (UUID, not personal identity)
bundle_name nclaw, nchat, ntv, nfamily, clawde, nsentry
plan monthly, annual, nself_plus

Not collected: payment method, card details, billing address, personal name.
Opt-out: Not applicable, tied to an active paid subscription (GDPR Article 6(1)(b)). Cancel the subscription to stop future events.

clawde_activated

Emitted when a ClawDE desktop client connects to a backend with a valid license.

Field Value
tenant_id Backend account identifier
license_key_hash SHA-256 truncated to 16 chars, not reversible
app_version ClawDE version

Not collected: project files, conversation history, code, hostname.
Opt-out: NSELF_TELEMETRY=false in the backend environment.

nsentry_plugin_install

Emitted when an ɳSentry plugin is installed via nself plugin install.

Field Value
tenant_id Backend account identifier
plugin_name e.g. nself-uptime-monitor
version Plugin version

Not collected: monitored URLs, alert contacts, project config.
Opt-out: NSELF_TELEMETRY=false.

ncloud_provision

Emitted by the ɳCloud provisioning service when a new server is provisioned. Server-side only, not emitted by the CLI.

Field Value
tenant_id Cloud customer account identifier
server_type Hetzner tier selected, e.g. CX23, CAX11
region Datacenter, e.g. fsn1
bundle_scope Bundle that triggered the provision, e.g. nself_plus, ntv

Not collected: hostname chosen by user, SSH keys, project contents, provisioned server IP.
Opt-out: Not applicable, required cloud service action (GDPR Article 6(1)(b)). Cancel the ɳCloud subscription to stop future provisions.

license_validate

Emitted on nself license set, nself plugin install <pro-plugin>, and nself build (when pro plugins are in the manifest). This is a required service call, not optional telemetry.

Field Value
tenant_id Account identifier from license record
license_key_hash SHA-256 truncated to 16 chars
ip_for_geolocation_only Request IP, used solely for geo-distribution dashboards and fraud detection

Not collected: actual license key, project contents, env values.
Retention: 30-day raw (shorter, contains IP), indefinite aggregate counts.
Opt-out: Not applicable, required for license validation (GDPR Article 6(1)(b)).

Opt-in / opt-out matrix

Setting Behaviour
(default, neither set) No telemetry is sent
NSELF_TELEMETRY=1 or =true Telemetry events sent (license_validate always fires regardless)
NSELF_TELEMETRY=false or =0 No telemetry. Wins over any opt-in. license_validate still fires.
NSELF_TELEMETRY_OPT_OUT=1 Alias for NSELF_TELEMETRY=false
nself config set telemetry false Persisted opt-out, survives shell restarts

Requests that reach the endpoint with X-Telemetry-Opt-Out: true or {"optOut": true} are answered 204 and nothing is stored.

Compliance

  • GDPR Article 6(1)(a), consent. Telemetry is opt-in; the default is off.
  • GDPR Article 6(1)(b), contract performance. license_validate, bundle_purchase, and ncloud_provision events are tied to active paid subscriptions.
  • CCPA. No sale of personal information. Telemetry contains no personal information as defined by CCPA §1798.140(o).
  • Deletion requests. Email privacy@nself.org with your installId or tenant_id. Raw rows are deleted within 72 hours. Aggregate statistics cannot be retroactively removed (they contain no personal data).
  • Server schema: web/backend/services/ping_api/PRIVACY.md
  • Endpoint source: web/backend/services/ping_api/src/index.ts
  • Schema validation: web/backend/services/ping_api/src/schema.ts
  • Feature flag registry: .claude/docs/sport/F23-FEATURE-FLAG-REGISTRY.md (NSELF_TELEMETRY flag)