Telemetry & Privacy
Privacy-first by design. Transparent by choice.
TL;DR
Opt-Out
Telemetry is enabled by default to help us improve the product. You can easily disable it.
caro config set telemetry.enabled false Opt-In
Telemetry will be disabled by default. We'll ask if you'd like to help by enabling it.
caro config set telemetry.enabled true Why We Collect Telemetry
We're building Caro to be the best AI shell assistant. During beta, anonymous usage data helps us:
- 📊 Understand real-world usage
Which commands are generated most? Which backends perform best? Where do users struggle?
- 🎯 Prioritize our roadmap
Focus engineering effort on features people actually use, not what we assume they want.
- ⚡ Optimize performance
Identify slow inference, errors, and bottlenecks across different platforms.
- 🛡️ Calibrate safety
Are we blocking too many safe commands? Missing dangerous ones? Data helps us tune.
What We Collect
✓ What We Collect
- Session timing (duration, commands generated/executed)
- Performance metrics (inference time, backend used)
- Platform info (OS, architecture, shell type)
- Error categories (not details or stack traces)
- Safety validation events (risk level, action taken)
- Anonymous session ID (rotates daily)
✗ What We NEVER Collect
- Your commands or natural language inputs
- File paths or directory structures
- Environment variables or secrets
- Hostnames, IPs, or usernames
- Any personally identifiable information
- Command output or execution results
Don't trust, verify: Caro is open source (AGPL-3.0).
Check the telemetry code yourself in src/telemetry/.
Your Controls
Disable Telemetry
caro config set telemetry.enabled false Permanently disable all telemetry collection.
Single Session
caro --no-telemetry "your command" Disable for just this invocation.
Environment Variable
export CARO_TELEMETRY_ENABLED=false Disable via environment (great for CI/CD).
View What's Collected
caro telemetry show See exactly what data is queued before sending.
Air-Gapped Environments
We understand many users work in environments without network access. Caro works perfectly offline—that's a core feature.
Our Commitment
Transparency
This page documents exactly what we collect. The code is open source for verification.
Privacy-First
We collect metadata, not content. Your commands and data never leave your machine.
Respect
If you disable telemetry, we respect that completely. No nagging, no degraded features.
Evolution
After beta, telemetry becomes opt-in. We'll ask nicely, but the default is off.
Frequently Asked Questions
Why is telemetry on by default during beta?
Beta is specifically for gathering feedback to improve the product before general availability. Anonymous usage data helps us understand how Caro is used in the real world, identify bugs, and prioritize features. This is standard practice for beta software.
When will telemetry become opt-in?
At general availability (GA) release, telemetry will be disabled by default. We'll prompt new users to optionally enable it, explaining the value exchange: you help us improve the product, we make Caro better for everyone.
Can you identify me from the telemetry data?
No. We use an anonymous session ID that's generated from a hash of your machine ID plus the current date. This means: (1) we can't identify who you are, and (2) the ID rotates daily, so we can't even track the same anonymous user across days.
What happens to my data?
Telemetry is processed by PostHog, a privacy-focused analytics platform. Data is used only for product analytics and is retained for 90 days (raw events) or 2 years (aggregated metrics). You can request deletion by contacting us.
Does disabling telemetry affect functionality?
No. Caro works identically with or without telemetry. All features, all backends, full performance. We believe in earning telemetry through value, not coercing it through feature gates.
I work in a regulated environment. Can I still use Caro?
Yes! Disable telemetry and use Caro with complete confidence. Nothing is sent anywhere. All inference happens locally. You can audit the source code—it's AGPL-3.0 licensed.
Questions?
We're committed to being transparent about telemetry. If you have questions, concerns, or suggestions about our approach, please reach out.