orchestra Privacy & usage data
Optional anonymous usage sharing, approximate city and country, and every collected event.
On this page
Your choice, off by defaultRandom identity and approximate locationEvery event and propertyWhat is never collectedEnvironment controls and local inspectionYour choice, off by default
Orchestra sends no usage data until you choose Share Anonymous Usage in the first-launch banner or turn on Settings → Privacy → Share anonymous usage data. No Thanks is remembered and the banner does not return after either choice.
Sharing helps us understand which features and agents are used. It includes approximate city and country, with IPs discarded. Turning it off cancels pending requests, discards queued events, and deletes the installation ID. Events already delivered remain in PostHog.
Random identity and approximate location
A random installation UUID is created only when you opt in. It is never derived from accounts, GitHub, email, hostnames, or paths. Opting in again after opting out creates a new UUID. Events use $process_person_profile: false, so no person profiles are created.
PostHog estimates city and country from the network connection, then discards the IP before storing the event. The location may be inaccurate or reflect a VPN. Only $geoip_city_name, $geoip_country_name, and $geoip_country_code are retained. Coordinates, postal code, region, and timezone are removed. The existing Orchestra project is hosted in PostHog US.
Every event and property
This inventory is generated directly from the app’s allowlist. Unknown events and properties are dropped in Go, including requests from the webview.
| Event | Properties and allowed values |
|---|---|
app_opened | version: release version; os: darwin, linux; arch: amd64, arm64, other; theme_kind: built-in, custom; arc_mode: boolean |
project_added | has_github_repository: boolean |
session_started | agent: claude, codex, pi, vibe, opencode, antigravity, grok, terminal; worktree: boolean; from_github_item: boolean |
session_ended | agent: claude, codex, pi, vibe, opencode, antigravity, grok, terminal; exit_kind: normal, error, killed; duration_bucket: under_1m, 1-5m, 5-30m, 30m+ |
feature_used | feature: scratchpad_read, scratchpad_cli, inbox_execute, inbox_auto_delivery, diff_view, command_bar, emoji_picker |
github_action | action: work_on, review, edit_metadata |
update_installed | from_version: release version; to_version: release version |
error_shown | code: operation_failed, session_start_failed, session_exit_error |
Every event also includes its event name, timestamp, and random installation UUID (distinct_id). Go adds fixed transport properties $process_person_profile: false, $geoip_disable: false, and $lib: orchestra. PostHog adds the three city/country properties above. The project token authenticates the batch without identifying a user.
update_installed is sent when quitting replaces the app with an update you chose to install. Session durations are buckets rather than exact times.
What is never collected
Prompts, code, terminal input/output, Scratchpad text, inbox bodies, file names or paths, project/session/repository/branch names, GitHub item titles or numbers, error messages, credentials, and anything typed by the user are never collected. Orchestra does not use autocapture, session replay, or person identification.
Local logs stay on your machine. Analytics never reads them.
Environment controls and local inspection
DO_NOT_TRACK=1, ORCHESTRA_TELEMETRY_DISABLED=1, CI environment variables, and builds without official release configuration disable analytics regardless of the preference. Settings explains why. Contributor builds, make build, and wails dev contain no PostHog token.
ORCHESTRA_TELEMETRY_DEBUG=1 prints validated, consented events to the local Orchestra log instead of sending them. It does not bypass consent or environment controls. Location enrichment happens in PostHog and is absent in local debug output.
The memory-only queue holds at most 256 events, flushes every 60 seconds or on quit, retries at most three times, and then drops failed events. Each event name is limited to 20 events per minute. There is no analytics file on disk.