What we collect, and what we can't
Anonymous counts of which features get used, so we know what to build next. Scrubbed before it leaves your machine, and there is no key on our side that ties any of it to you. Our analytics run on PostHog, and we keep no copy of our own — we don't share or sell any of it to anyone else. Our plan retains events for up to seven years, which sounds like a lot until you look at what an event actually contains: there's no person in it to remember.
Every event we send
This is the complete list, not a summary. Interface events are filtered against a fixed allowlist before anything is published, so a property that isn't named here doesn't get through.
| APPLICATION EVENT | PROPERTIES SENT |
|---|---|
| server_started | device_count, drivers_loaded |
| driver_loaded | driver_name, hashed_driver_uid, device_count, usb_vid, usb_pid, usb_product, usb_manufacturer, has_serial_number |
| client_connected | num_clients — host, port and client id are deliberately excluded |
| recipe_fired | event_type, action_types, action_count, cooldown_ms, fire_offset_ms, success, triggered_by_recipe |
| recipe_failed | the same fields, plus failed_action_index, failed_action_type |
| recipe_activity_summary | window_seconds, plus per-shape fire, success and failure counts, first and last fire offsets, inter-fire stats, chained_count |
| mcp_usage_summary | window_seconds, session_count, per-tool call counts, tool_errors, distinct_tools_used |
| assistant.query.started | hashed_conversation_id, provider_id, model_id |
| assistant.query.completed | hashed_conversation_id, provider_id, model_id, iterations, ok, stop_reason, input_tokens, output_tokens, cached_input_tokens, wall_clock_ms, tool_use_count, tools_used, tool_errors |
| assistant.provider.switched | hashed_conversation_id, the provider and model ids moved from and to, mid_conversation |
| INTERFACE EVENT | PROPERTIES ALLOWED THROUGH |
|---|---|
| page_viewed | page_name |
| widget_added / widget_removed | widget_type, dashboard_id |
| channel_added | channel_type |
| widget_sources_summary | widget_type, source_types (count map), total_sources |
| widget_interaction_summary | widget_type, interactions (count map) |
| project_switched | project_count |
| settings_changed | setting_category |
| feature_toggled | feature, enabled |
Every event also carries deployment_mode, a UTC timestamp, event_schema_version, and distinct_id — the machine id put through a salted SHA-256, so the PostHog identity is anonymous. Interface summaries accumulate locally and flush every five minutes.
What is never sent
- Your files, or any of their contents
- File names, folder paths, or your machine name
- Captured data — no log lines, bus payloads or measurements, only counts and timings
- Anything you typed to the assistant, or anything it replied
- Name, email, or licence key
- Your IP address — like any HTTPS request it's visible in transit, and IP storage is switched off in PostHog, so it's discarded on arrival and never recorded against an event
- Connection details — host, port and client id are excluded by hand
A whole event, verbatim
This is a real recipe_fired event, exactly as it leaves the app.
{
"event": "recipe_fired",
"distinct_id": "9f4c1e…a72b",
"properties": {
"event_type": "gpio_edge",
"action_types": ["i2c_write", "gpio_set"],
"action_count": 2,
"cooldown_ms": 500,
"fire_offset_ms": 18432,
"success": true,
"triggered_by_recipe": false,
"deployment_mode": "desktop",
"event_schema_version": 1
}
}Nothing about which device, which register, or what value — only that a GPIO edge fired a two-action recipe and it worked.
Anything that could identify hardware or a person is hashed at the subscriber boundary, before it enters the queue — driver UIDs, which may contain USB serials, conversation ids, and the machine id itself. Salted SHA-256, one way, so we can count returning machines without ever knowing which machine.
You're asked on first run, before anything is sent, and the answer lives on the config page — change it whenever. Say no and the app works exactly the same; we simply learn nothing about how you use it.
The tables above are the whole list. Anything sent that isn't on them is a bug, not a policy — tell us and we'll fix it and say so here.
This website
Separate from the app: this site counts visits — pages viewed and downloads started — using PostHog, with no cookies and nothing tied to you. In the EU/UK we ask before counting anything, and saying no changes nothing about how the site works.
Asking for a beta invitation sends your email address, and any answers you chose, to our own server and to us as an email. It doesn't add you to any mailing list. If you're admitted, we add your address to the beta list, which sends new releases and what changed in them.
Signing up for email updates puts your address on our updates list. The signup form in that popup is MailerLite's own, and its code loads only when you open the popup, never on its own. Nothing is added until you click the link in the confirmation email it sends. If you buy Scryglass and tick the marketing box at checkout, we add you to our customer list.
Our lists are kept by MailerLite, which sends our email. We use them only for what you signed up for, and we never sell or share them. Every email has an unsubscribe link, and unsubscribing deletes your details.
Questions about any of this, or want something removed? Write to us — we'll answer specifically.
privacy[at]protosorcery.com