> ## Documentation Index
> Fetch the complete documentation index at: https://panopticon-cli.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Anonymous telemetry

> What Overdeck sends to PostHog and how to disable it

# Anonymous telemetry

Overdeck sends anonymous product-usage and error telemetry to PostHog. It helps
the maintainers understand which dashboard and CLI surfaces are used, where
issues stop in the delivery pipeline, and which exceptions occur on real
installations.

Telemetry is enabled by default. Session replay is disabled, and Overdeck does
not send code, prompts, terminal content, issue or repository identifiers, file
paths, branch names, email addresses, or credentials.

## Disable telemetry

The fastest control is **Settings → Telemetry → Share anonymous usage data**.
The setting autosaves and applies on the next dashboard load.

You can make the same change in `~/.overdeck/config.yaml`:

```yaml theme={null}
telemetry:
  enabled: false
```

For process-level control, set:

```bash theme={null}
OVERDECK_TELEMETRY=0
```

`OVERDECK_TELEMETRY=false` is equivalent. The environment variable takes
precedence over the YAML setting, so it can enforce opt-out for services,
containers, or CI without changing a user's configuration file.

When telemetry is disabled, Overdeck does not initialize PostHog in the
browser, server, or CLI. Event capture, exception capture, and feature-flag
reads make no PostHog network requests.

## Anonymous install ID

Overdeck creates a random UUIDv4 at `~/.overdeck/telemetry-id`. If you set
`OVERDECK_HOME`, the file lives at `${OVERDECK_HOME}/telemetry-id`. Its file
mode is `0600`, and it remains local except when used as the anonymous PostHog
`distinct_id`. If the file is empty, partial, or not a UUIDv4, Overdeck repairs
it under an exclusive process lock with stale-lock expiry, re-reads the durable
winner, and restores mode `0600`.

The ID is generated independently. Overdeck does not read Claude Code, Codex,
GitHub, Git, or other credential files to identify an installation.

## Group my installs (opt-in)

If you run Overdeck on more than one machine with the same GitHub account,
**Settings → Telemetry → Group my installs (pseudonymous)** adds an
`operatorHash` to every event so those installs can be grouped. It is off by
default. The equivalent configuration is:

```yaml theme={null}
telemetry:
  operator_grouping: true
```

The hash is a salted one-way HMAC of your GitHub numeric user ID, read once
with `gh api user --jq .id`. Only the 16-character hash is stored (in
`~/.overdeck/telemetry-operator-hash`) and sent; your GitHub login, email and
raw user ID never are. The salt ships in the Overdeck source, so the hash is
pseudonymous rather than secret.

With grouping on, `pan doctor github-quota` can also list your other installs
seen in the last 48 hours. That view needs a PostHog personal API key with
query access and the project ID:

```yaml theme={null}
telemetry:
  operator_grouping: true
  posthog_read_key: phx_...
  posthog_project_id: "12345"
```

`OVERDECK_POSTHOG_READ_KEY` and `OVERDECK_POSTHOG_PROJECT_ID` override the
file. The key is never shown in the Settings UI.

## What is sent

* Dashboard tab and action categories
* Allowlisted CLI verbs, success state, and coarse duration buckets
* Coarse project and active-agent count buckets
* Pipeline stage, harness, and model-family enums
* Platform, architecture, Overdeck version, and client type
* Hourly, bucketed GitHub API points per Overdeck subsystem and the lowest
  remaining GitHub budget (`github_quota_sample`), a throttled notice when
  GitHub rate-limits a call (`github_rate_limited`), and a daily
  `instance_heartbeat` with bucketed project and agent counts
* With operator grouping on, the pseudonymous `operatorHash`
* Sanitized categorical browser and server exceptions for error grouping

Raw counts and durations are replaced by coarse buckets. The complete,
mechanically checked event and property list is in
[Anonymous telemetry schema](https://github.com/eltmon/overdeck/blob/main/docs/TELEMETRY.md).

## Commands that send nothing

`pan vault` commands send no telemetry at all: no event is captured, no PostHog client is
created and the daily instance heartbeat is skipped for them. The vault talks only to the
backend you configured with `pan vault setup`.

## What is never sent

* Source code or file contents
* Prompts, completions, or terminal output
* Issue IDs, titles, or descriptions
* Repository, branch, workspace, or file-path names
* Email addresses, account IDs, GitHub logins, or credentials
* Session replay recordings

<Info>
  Feature-flag support currently exposes a read door for future rollouts, but no
  production Overdeck feature is controlled remotely. Disabled or offline flag
  reads always use the local fallback.
</Info>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.