anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Privacy and Data Collection Clarification Request #336

New Issue
Open
opened 2026-02-16 17:26:17 -05:00 by yindo · 11 comments
yindo commented 2026-02-16 17:26:17 -05:00
Owner
Copy Link
Copy Source

Originally created by @kennyg on GitHub (Jun 27, 2025).

Originally assigned to: @thdxr on GitHub.

Privacy and Data Collection Clarification Request

Summary

I’d like to request clarification about OpenCode’s privacy practices and data collection policies. While the project appears to be local-first, explicit documentation about privacy would help users make informed decisions.

Background

Many developer tools today collect telemetry, usage analytics, or other forms of data. SST’s main framework has documented telemetry collection (which can be opted out), but OpenCode’s privacy practices are not clearly documented.

Questions

  1. Does OpenCode collect any telemetry or usage data? (e.g., feature usage, error reporting, analytics)
  2. Does OpenCode make any network requests beyond direct communication with configured AI providers?
  3. Are there any plans to add telemetry or data collection in the future?
  4. Could you add a privacy policy or data collection statement to the documentation?

Why This Matters

  • Transparency: Users should know what data (if any) is being collected
  • Security compliance: Many organizations require clear privacy documentation
  • Trust: Explicit privacy statements help build user confidence
  • Informed consent: Users can make educated decisions about tool adoption

Suggested Documentation

Consider adding a section to the README or docs that explicitly states:

  • What data (if any) is collected
  • How data is used and stored
  • Whether data is shared with third parties
  • User rights regarding their data
  • How to verify the tool’s privacy claims

Context

This appears to be a genuinely local-first tool, which is fantastic! Making that explicit would help distinguish OpenCode from other tools that may collect data and attract privacy-conscious developers.

Thanks for creating such a useful tool, and thanks in advance for the clarification!

Originally created by @kennyg on GitHub (Jun 27, 2025). Originally assigned to: @thdxr on GitHub. # Privacy and Data Collection Clarification Request ## Summary I’d like to request clarification about OpenCode’s privacy practices and data collection policies. While the project appears to be local-first, explicit documentation about privacy would help users make informed decisions. ## Background Many developer tools today collect telemetry, usage analytics, or other forms of data. SST’s main framework has documented telemetry collection (which can be opted out), but OpenCode’s privacy practices are not clearly documented. ## Questions 1. **Does OpenCode collect any telemetry or usage data?** (e.g., feature usage, error reporting, analytics) 1. **Does OpenCode make any network requests beyond direct communication with configured AI providers?** 1. **Are there any plans to add telemetry or data collection in the future?** 1. **Could you add a privacy policy or data collection statement to the documentation?** ## Why This Matters - **Transparency**: Users should know what data (if any) is being collected - **Security compliance**: Many organizations require clear privacy documentation - **Trust**: Explicit privacy statements help build user confidence - **Informed consent**: Users can make educated decisions about tool adoption ## Suggested Documentation Consider adding a section to the README or docs that explicitly states: - What data (if any) is collected - How data is used and stored - Whether data is shared with third parties - User rights regarding their data - How to verify the tool’s privacy claims ## Context This appears to be a genuinely local-first tool, which is fantastic! Making that explicit would help distinguish OpenCode from other tools that may collect data and attract privacy-conscious developers. Thanks for creating such a useful tool, and thanks in advance for the clarification!
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jun 27, 2025):

there is no telemetry collected - we do make background requests to fetch updated data from https://models.dev/api.json and checking for updates

aside from that it's just whatever communication with LLMs you're doing

@thdxr commented on GitHub (Jun 27, 2025): there is no telemetry collected - we do make background requests to fetch updated data from[ https://models.dev/api.json](https://models.dev/api.json) and checking for updates<br><br>aside from that it's just whatever communication with LLMs you're doing
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jun 27, 2025):

will document this better

@thdxr commented on GitHub (Jun 27, 2025): will document this better
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@yuri-xyz commented on GitHub (Oct 31, 2025):

@thdxr Hey, I was just curious to ask -- how are you able to determine monthly active users (ex. on the website it says Fig 3. 250K Monthly Devs if no telemetry is collected?

Thanks.

@yuri-xyz commented on GitHub (Oct 31, 2025): @thdxr Hey, I was just curious to ask -- how are you able to determine monthly active users (ex. on the website it says `Fig 3. 250K Monthly Devs` if no telemetry is collected? Thanks.
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Oct 31, 2025):

@yuri-xyz from models.dev requests

@rekram1-node commented on GitHub (Oct 31, 2025): @yuri-xyz from models.dev requests
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@yuri-xyz commented on GitHub (Oct 31, 2025):

@yuri-xyz from models.dev requests

@rekram1-node I see! Follow up question, does models.dev collect IPs from requests in order to determine unique user count? If not, how does it differentiate requests? Or is the monthly users data point an aggregate of all requests?

@yuri-xyz commented on GitHub (Oct 31, 2025): > @yuri-xyz from models.dev requests @rekram1-node I see! Follow up question, does models.dev collect IPs from requests in order to determine unique user count? If not, how does it differentiate requests? Or is the monthly users data point an aggregate of all requests?
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Oct 31, 2025):

you can see in the models.dev repo how this is done

https://github.com/sst/models.dev/blob/91a03818a6eb45508d042c91cb4cf21a331296f1/packages/function/src/worker.ts#L16

posthog rolls this up and gives us an estimated unique count

opencode also bundles a snapshot of models.dev data in every release so can disable the fetch to it if you prefer

@thdxr commented on GitHub (Oct 31, 2025): you can see in the models.dev repo how this is done https://github.com/sst/models.dev/blob/91a03818a6eb45508d042c91cb4cf21a331296f1/packages/function/src/worker.ts#L16 posthog rolls this up and gives us an estimated unique count opencode also bundles a snapshot of models.dev data in every release so can disable the fetch to it if you prefer
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@aymennasri commented on GitHub (Jan 22, 2026):

@thdxr hey man, love your team's work but i want a clearer message than the one in the privacy policy about the "business partners" with whom you share messages and conversations mentionned in this part:

Other Identifying Information that You Voluntarily Choose to Provide such as information included in conversations or prompts that you submit to AI

Corresponding with You
Service Providers
Business Partners
Parties You Authorize, Access or Authenticate

So far, reading that part conveys the message that you guys can collect, potentially read and use our conversations with whatever model we use and possibly share it with 3rd parties other than the providers themselves.

Also, a clear direct comment about whether you identify privacy as a priority or not would be appreciated.

@aymennasri commented on GitHub (Jan 22, 2026): @thdxr hey man, love your team's work but i want a clearer message than the one in the privacy policy about the "business partners" with whom you share messages and conversations mentionned in this part: > Other Identifying Information that You Voluntarily Choose to Provide such as information included in conversations or prompts that you submit to AI > Corresponding with You Service Providers Business Partners Parties You Authorize, Access or Authenticate So far, reading that part conveys the message that you guys can collect, potentially read and use our conversations with whatever model we use and possibly share it with 3rd parties other than the providers themselves. Also, a clear direct comment about whether you identify privacy as a priority or not would be appreciated.
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@OpenToInnovate commented on GitHub (Jan 30, 2026):

My audit of the code base (Using OpenCode) identified the following user data being sent by default:
api.opencode.ai - Session content, prompts
opncd.ai - Session sharing data
opencode.ai/zen/v1 - Prompts to external LLM
mcp.exa.ai - Search queries
api.honeycomb.io - Telemetry, IP, location
us.i.posthog.com - Usage analytics

A privacy focused install option would ideally disable all of those and potentially give the option to use ddg search instead of mcp.exa.ai

@OpenToInnovate commented on GitHub (Jan 30, 2026): My audit of the code base (Using OpenCode) identified the following user data being sent by default: `api.opencode.ai` - Session content, prompts `opncd.ai` - Session sharing data `opencode.ai/zen/v1` - Prompts to external LLM `mcp.exa.ai` - Search queries `api.honeycomb.io` - Telemetry, IP, location `us.i.posthog.com` - Usage analytics A privacy focused install option would ideally disable all of those and potentially give the option to use ddg search instead of mcp.exa.ai
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@OpenToInnovate commented on GitHub (Jan 30, 2026):

I'm not concerned about the models.dev call. It is just a GET request, no cookies, no tracking & we have full transparency of what it does and it's clearly very open and community driven : https://github.com/anomalyco/models.dev

@OpenToInnovate commented on GitHub (Jan 30, 2026): I'm not concerned about the models.dev call. It is just a GET request, no cookies, no tracking & we have full transparency of what it does and it's clearly very open and community driven : https://github.com/anomalyco/models.dev
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@TheBaus commented on GitHub (Feb 7, 2026):

My audit of the code base (Using OpenCode) identified the following user data being sent by default:
api.opencode.ai - Session content, prompts
opncd.ai - Session sharing data
opencode.ai/zen/v1 - Prompts to external LLM
mcp.exa.ai - Search queries
api.honeycomb.io - Telemetry, IP, location
us.i.posthog.com - Usage analytics

A privacy focused install option would ideally disable all of those and potentially give the option to use ddg search instead of mcp.exa.ai

@OpenToInnovate does your audit distinguish between using the default model providers or selecting your own third party provider, I.e: claude, openai, github copilot etc..

Where does the session data get sent to when using another provider? Still to opencodes api?

@TheBaus commented on GitHub (Feb 7, 2026): > My audit of the code base (Using OpenCode) identified the following user data being sent by default: > `api.opencode.ai` - Session content, prompts > `opncd.ai` - Session sharing data > `opencode.ai/zen/v1` - Prompts to external LLM > `mcp.exa.ai` - Search queries > `api.honeycomb.io` - Telemetry, IP, location > `us.i.posthog.com` - Usage analytics > > A privacy focused install option would ideally disable all of those and potentially give the option to use ddg search instead of mcp.exa.ai @OpenToInnovate does your audit distinguish between using the default model providers or selecting your own third party provider, I.e: claude, openai, github copilot etc.. Where does the session data get sent to when using another provider? Still to opencodes api?
yindo commented 2026-02-16 17:26:18 -05:00
Author
Owner
Copy Link
Copy Source

@tredondo commented on GitHub (Feb 8, 2026):

will document this better

Are outbound connections documented anywhere to begin with? Today I noticed an out-of-the-blue connection to gist.github.com, probably the periodic update check. Should be added to @OpenToInnovate's list.

Image
@tredondo commented on GitHub (Feb 8, 2026): > will document this **better** Are outbound connections documented anywhere to begin with? Today I noticed an out-of-the-blue connection to `gist.github.com`, probably the periodic update check. Should be added to @OpenToInnovate's list. <img width="710" height="436" alt="Image" src="https://github.com/user-attachments/assets/e44545f1-9cdd-4dd1-ab49-4895b809853d" />
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#336
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?