Skip to main content

​
Anonymous telemetry

Overdeck sends anonymous product-usage and error telemetry to PostHog. It helps the maintainers understand which dashboard and CLI surfaces are used, where issues stop in the delivery pipeline, and which exceptions occur on real installations. Telemetry is enabled by default. Session replay is disabled, and Overdeck does not send code, prompts, terminal content, issue or repository identifiers, file paths, branch names, email addresses, or credentials.

​
Disable telemetry

The fastest control is Settings → Telemetry → Share anonymous usage data. The setting autosaves and applies on the next dashboard load. You can make the same change in ~/.overdeck/config.yaml:
For process-level control, set:
OVERDECK_TELEMETRY=false is equivalent. The environment variable takes precedence over the YAML setting, so it can enforce opt-out for services, containers, or CI without changing a user’s configuration file. When telemetry is disabled, Overdeck does not initialize PostHog in the browser, server, or CLI. Event capture, exception capture, and feature-flag reads make no PostHog network requests.

​
Anonymous install ID

Overdeck creates a random UUIDv4 at ~/.overdeck/telemetry-id. If you set OVERDECK_HOME, the file lives at ${OVERDECK_HOME}/telemetry-id. Its file mode is 0600, and it remains local except when used as the anonymous PostHog distinct_id. If the file is empty, partial, or not a UUIDv4, Overdeck repairs it under an exclusive process lock with stale-lock expiry, re-reads the durable winner, and restores mode 0600. The ID is generated independently. Overdeck does not read Claude Code, Codex, GitHub, Git, or other credential files to identify an installation.

​
Group my installs (opt-in)

If you run Overdeck on more than one machine with the same GitHub account, Settings → Telemetry → Group my installs (pseudonymous) adds an operatorHash to every event so those installs can be grouped. It is off by default. The equivalent configuration is:
The hash is a salted one-way HMAC of your GitHub numeric user ID, read once with gh api user --jq .id. Only the 16-character hash is stored (in ~/.overdeck/telemetry-operator-hash) and sent; your GitHub login, email and raw user ID never are. The salt ships in the Overdeck source, so the hash is pseudonymous rather than secret. With grouping on, pan doctor github-quota can also list your other installs seen in the last 48 hours. That view needs a PostHog personal API key with query access and the project ID:
OVERDECK_POSTHOG_READ_KEY and OVERDECK_POSTHOG_PROJECT_ID override the file. The key is never shown in the Settings UI.

​
What is sent

  • Dashboard tab and action categories
  • Allowlisted CLI verbs, success state, and coarse duration buckets
  • Coarse project and active-agent count buckets
  • Pipeline stage, harness, and model-family enums
  • Platform, architecture, Overdeck version, and client type
  • Hourly, bucketed GitHub API points per Overdeck subsystem and the lowest remaining GitHub budget (github_quota_sample), a throttled notice when GitHub rate-limits a call (github_rate_limited), and a daily instance_heartbeat with bucketed project and agent counts
  • With operator grouping on, the pseudonymous operatorHash
  • Sanitized categorical browser and server exceptions for error grouping
Raw counts and durations are replaced by coarse buckets. The complete, mechanically checked event and property list is in Anonymous telemetry schema.

​
Commands that send nothing

pan vault commands send no telemetry at all: no event is captured, no PostHog client is created and the daily instance heartbeat is skipped for them. The vault talks only to the backend you configured with pan vault setup.

​
What is never sent

  • Source code or file contents
  • Prompts, completions, or terminal output
  • Issue IDs, titles, or descriptions
  • Repository, branch, workspace, or file-path names
  • Email addresses, account IDs, GitHub logins, or credentials
  • Session replay recordings
Feature-flag support currently exposes a read door for future rollouts, but no production Overdeck feature is controlled remotely. Disabled or offline flag reads always use the local fallback.