Privacy and Data Collection Clarification Request

[kennyg]

Privacy and Data Collection Clarification Request

Summary

I’d like to request clarification about OpenCode’s privacy practices and data collection policies. While the project appears to be local-first, explicit documentation about privacy would help users make informed decisions.

Background

Many developer tools today collect telemetry, usage analytics, or other forms of data. SST’s main framework has documented telemetry collection (which can be opted out), but OpenCode’s privacy practices are not clearly documented.

Questions

1. Does OpenCode collect any telemetry or usage data? (e.g., feature usage, error reporting, analytics)
2. Does OpenCode make any network requests beyond direct communication with configured AI providers?
3. Are there any plans to add telemetry or data collection in the future?
4. Could you add a privacy policy or data collection statement to the documentation?

Why This Matters

• Transparency: Users should know what data (if any) is being collected
• Security compliance: Many organizations require clear privacy documentation
• Trust: Explicit privacy statements help build user confidence
• Informed consent: Users can make educated decisions about tool adoption

Suggested Documentation

Consider adding a section to the README or docs that explicitly states:

• What data (if any) is collected
• How data is used and stored
• Whether data is shared with third parties
• User rights regarding their data
• How to verify the tool’s privacy claims

Context

This appears to be a genuinely local-first tool, which is fantastic! Making that explicit would help distinguish OpenCode from other tools that may collect data and attract privacy-conscious developers.

Thanks for creating such a useful tool, and thanks in advance for the clarification!

[thdxr]

there is no telemetry collected - we do make background requests to fetch updated data from https://models.dev/api.json and checking for updates

aside from that it's just whatever communication with LLMs you're doing

[thdxr]

will document this better

[yuri-xyz]

@thdxr Hey, I was just curious to ask -- how are you able to determine monthly active users (ex. on the website it says Fig 3. 250K Monthly Devs if no telemetry is collected?

Thanks.

[rekram1-node]

@yuri-xyz from models.dev requests

[yuri-xyz]

@yuri-xyz from models.dev requests

@rekram1-node I see! Follow up question, does models.dev collect IPs from requests in order to determine unique user count? If not, how does it differentiate requests? Or is the monthly users data point an aggregate of all requests?

[thdxr]

you can see in the models.dev repo how this is done

https://github.com/sst/models.dev/blob/91a03818a6eb45508d042c91cb4cf21a331296f1/packages/function/src/worker.ts#L16

posthog rolls this up and gives us an estimated unique count

opencode also bundles a snapshot of models.dev data in every release so can disable the fetch to it if you prefer

[aymennasri]

@thdxr hey man, love your team's work but i want a clearer message than the one in the privacy policy about the "business partners" with whom you share messages and conversations mentionned in this part:

Other Identifying Information that You Voluntarily Choose to Provide such as information included in conversations or prompts that you submit to AI

Corresponding with You
Service Providers
Business Partners
Parties You Authorize, Access or Authenticate

So far, reading that part conveys the message that you guys can collect, potentially read and use our conversations with whatever model we use and possibly share it with 3rd parties other than the providers themselves.

Also, a clear direct comment about whether you identify privacy as a priority or not would be appreciated.

[OpenToInnovate]

My audit of the code base (Using OpenCode) identified the following user data being sent by default:
api.opencode.ai - Session content, prompts
opncd.ai - Session sharing data
opencode.ai/zen/v1 - Prompts to external LLM
mcp.exa.ai - Search queries
api.honeycomb.io - Telemetry, IP, location
us.i.posthog.com - Usage analytics

A privacy focused install option would ideally disable all of those and potentially give the option to use ddg search instead of mcp.exa.ai

[OpenToInnovate]

I'm not concerned about the models.dev call. It is just a GET request, no cookies, no tracking & we have full transparency of what it does and it's clearly very open and community driven : https://github.com/anomalyco/models.dev