Telemetry policy

STH is in Alpha. To drive improvement, the CLI can send minimal telemetry — but only if you explicitly accepted at your first `sth init`.

Why we collect

The Alpha exists to validate the tool and prioritise what comes next. Knowing which commands are used, how often, and on which CLI version helps us invest where it matters. Without this data, we guess — and guesswork ages badly.

Three modes

Telemetry is an explicit choice, made at your first `sth init` and changeable any time via `sth telemetry`. What gets sent depends on the active mode:

off — nothing is sent — no request, no record.
anonymous — only the three local fields below, with no key or identifier. Nothing is tied to an organisation or a person; records live in a dedicated table, separate from accounts.
connected — the same three fields, plus `org_id` derived server-side from your API key. Usage is then grouped by organisation and visible on your Usage page.

What we collect

The payload sent by the CLI is intentionally minimal: three local fields, identical in every mode. In connected mode only, the server adds your organisation (`org_id`), derived from your API key; in anonymous mode nothing is added.

Field	Example	Why
`ts`	`2026-05-11T10:30:00Z`	UTC timestamp of the command — lets us see activity peaks and recency.
`cli_version`	`v0.1.2`	Binary version — identifies who is still on older builds, informs release notes.
`command_name`	`install`	Name of the command, no arguments. Shows which features are most used.
`org_id (connected mode only)`	`uuid`	Derived server-side from your API key, and only in connected mode — used to group usage by organisation, never by individual. In anonymous mode it is not sent.

What we do NOT collect

These never leave your machine, by construction of the payload:

Command arguments (`sth install acme/secret-skill` only sends `install`).
No file paths, absolute or relative.
No file contents, ever.
Not the contents, names, or sources of the skills you install.
No tokens, keys, or secrets.
We don't store IP addresses explicitly — server logs keep them at most 12 months (see the privacy policy).

Anonymity

In anonymous mode the data is genuinely anonymous: no key, no org_id, nothing that could link it to you or your organisation. In connected mode it is pseudo-anonymous — linked to an organisation via your API key, but with no identifying information on the CLI side.

Under strict GDPR terms, connected mode produces pseudonymous (not fully anonymous) data: an STH superadmin with access to both tables could link a usage record to an organisation. That's why access is restricted (see next section). Anonymous mode carries no such link.

Who sees the data

Only STH superadmins access the raw records, via the production Supabase tools. Other dashboard roles (owner, admin, member) only see their own organisation's usage via the Usage page.

Retention

Records are kept for a rolling 30 days. Past that window they are deleted. This matches the product-wide privacy policy.

Opt out at any time

Consent is asked once, at first `sth init`. The decision is persisted in your user settings. To change your mind at any time:

sth telemetry off
sth telemetry status

Inspect your own data

To see exactly what the server has on file about your CLI activity, run:

sth telemetry output --limit=20