Telemetry

Telemetry

In short

• Usage telemetry is opt-in. The first time you launch a telemetry-aware version, you are asked what you want; no usage event is sent before you answer.
• There are two independent switches. You can turn on one, both, or neither.
• Data is processed by a Cloudflare Worker, D1 and Analytics Engine. Resend is used only for operational alert emails.
• You can change your mind anytime in Settings > Privacy. Mode B has an install-scoped delete request, subject to the Analytics Engine limitation described below.

The rest of this page goes into what each switch does and what happens behind the scenes.

---

accshift collects optional usage data to measure feature adoption and performance regressions. Telemetry is split into two independent modes.

When both switches are on, events are sent once under Mode B; they are not duplicated under Mode A. Turning Mode B off while leaving Mode A on falls back to the Mode A identifiers.

The two modes

Mode A: anonymous counters

• Generates a random local anonymous_id after opt-in. The server stores only an HMAC of it to avoid counting the same installation repeatedly; regular usage events keep a daily rotating hash.
• Reports: app version, OS family and version, locale, country derived by Cloudflare, event name, optional platform, duration and count.
• Default state at install: prompted during onboarding, on by default if accepted.
• Toggle anytime in Settings > Privacy.

Mode B: install-scoped data

• Generates a random install_id on opt-in. Tied to your install only, never to your account or hardware.
• Lets accshift correlate events from the same install to measure repeat use and feature adoption across days.
• Default state at install: off, you must explicitly enable it during onboarding.
• Disabling Mode B clears the active local id, stops Mode B collection and moves the old id into a machine-local deletion queue before requesting /forget cleanup. If the request fails, Settings keeps Retry deletion and Export my data available after a restart. The queued id is removed locally only after the Worker confirms deletion. Re-enabling Mode B creates a new id without discarding older pending cleanup requests. Analytics Engine cannot delete individual rows and may retain residual events for up to 90 days after a successful request.

What gets counted

Every event carries the app version, OS family and version, locale, and a country code derived at the Cloudflare edge. The full list:

Event	Extra fields	Notes
ping	none	daily active-install counter
app_launched	launch duration
platform_switch	platform id, duration, success	never the account
persona_switch	platform count, success count	never the persona name
account_added	platform id	never the account
streamer_mode_activated	none	streaming software was detected
deep_link_used	none	never the link itself (it contains account ids)
session_ended	session duration
accounts_snapshot	platform id, account count	Mode B only

No event carries an account name, an account id, a persona name, or a URL.

The Worker reads the request IP address in memory for rate limiting and to derive the country. For Mode A usage events it also computes a daily HMAC over the date, IP address and User-Agent. The raw IP address is not written to D1 or Analytics Engine. Rate-limit alert emails contain only a masked /24 IPv4 or /48 IPv6 prefix.

Onboarding

On first launch after upgrading to a telemetry-aware version, the GUI shows a one-time onboarding dialog explaining both modes. You pick what you want; the choice is saved and the dialog never reappears unless the underlying config is reset.

The selected button also increments one aggregate refused, basic, or enhanced counter. This counter stores no installation or request identifier, including when you refuse usage telemetry.

Export my data

When Mode B is enabled, or when a disabled installation still has a deletion request pending, Settings > Privacy shows Export my data. This calls the server for every active or pending install_id and copies the associated D1 daily_pings and accounts_snapshot rows into your clipboard. Multiple ids are grouped under installations. This is a partial export: high-frequency events in Analytics Engine cannot be retrieved per install by the Worker and are not included.

What the server stores

• Mode A: daily pings keyed by an irreversible installation HMAC; ordinary usage events use the daily IP + User-Agent HMAC above. Both include country.
• Onboarding: aggregate counts by date, app version and choice, with no identifier.
• Mode B: D1 pings and account-count snapshots plus Analytics Engine events keyed by install_id.

Analytics Engine has a fixed 90-day retention period. A successful /forget request immediately deletes Mode B rows from D1 and writes a suppression marker, but Cloudflare does not offer row-level deletion from Analytics Engine. Those residual events expire within 90 days. D1 aggregate counters and anonymous Mode A pings are not part of an install-scoped Mode B export or deletion.

Cloudflare hosts the Worker, D1 and Analytics Engine. Resend receives only internal budget or rate-limit alert emails, not telemetry event payloads. See the Privacy Policy for legal basis, retention and rights.

Legal basis and rights

Mode A and Mode B use explicit consent (GDPR Article 6(1)(a)). You can withdraw that consent at any time in Settings > Privacy. Depending on your jurisdiction, you may also have rights of information, access, rectification, erasure, restriction, objection, portability and complaint to a data-protection authority.

The identifier-free onboarding-choice aggregate and abuse-prevention controls rely on the project's legitimate interests (GDPR Article 6(1)(f)) in evaluating the consent screen and protecting the telemetry endpoint. No usage event is enabled by a refusal.

Mode B access and portability use the partial D1 export described above. A successful deletion request removes its D1 rows and records a suppression marker, subject to the 90-day Analytics Engine limitation. Mode A events cannot be retrieved for one person because the service does not keep the raw IP, local anonymous_id, or a stable identifier for ordinary events. Use the project's GitHub Issues for a privacy request the app cannot handle.

Disabling everything

Settings > Privacy:

• Toggle Mode A off.
• Toggle Mode B off (triggers /forget). If Settings reports a pending deletion, use Retry deletion when the service is reachable.

No further usage event is sent after both modes are disabled. The one aggregate onboarding-choice counter was already recorded when the original choice was made and cannot be tied back to an installation.