Privacy and consent

Local capture, cloud requests, and browser analytics have separate controls. Review the relevant control before enabling sharing.

Daemon consent

Run errata privacy to see the collection summary and this machine's current settings. It is a summary, not a preview of every outgoing payload.

These are the machine defaults. A repository you link to its project (errata init does this after sign-in, or errata link) carries its own choices, made in the Console's link approval. errata init --no-login skips the interactive sign-in; it does not erase credentials or reset consent.

errata privacy
errata consent packages off
errata consent sync off

The example opts out of package contribution, then out of knowledge sync for this machine. Run only the toggles you intend. errata consent all off disables all three channels; it does not delete content previously uploaded.

Network reads and contribution scope

Login and sync are separate. An authenticated network read sends its query to the hosted service even with sync off. A direct hosted MCP write has its own authorization and consent checks; the daemon's local sync toggle is not a universal control over other clients.

Inspect errata whoami for identity, visibility, and the default contribution target. Review project placement and sharing controls in the Console. Newer project-link flows can apply the consent choices approved there, so inspect privacy again after linking.

Uploads pass through scrubbing and generalization controls. Those controls do not replace choosing an appropriate scope or keeping secrets and sensitive source content out of contributions. See Team workspaces.

Browser consent

The public site starts from a strict opt-in posture. Essential cookies can run by default. Functional, analytics, and marketing storage require a visitor choice, and Global Privacy Control forces analytics and marketing off.

Public-site cookies

The site uses cookie_consent_v1 to remember consent choices. The cookie is readable by client-side consent code, but it is not an identifier and does not contain an email address, user ID, or agent key.

Cookie and subprocessor tables are generated from source-controlled registries, not from editable marketing copy.

Analytics posture

The live splash can use the same US PostHog project as Console, but only after explicit Analytics consent and only when the deployment kill switch is enabled. Until both conditions are true, the PostHog library is not downloaded and the site creates no PostHog storage.

The splash records six fixed events: a consented route pageview, CTA clicks, story expand/collapse, successful command-copy actions, documentation views, and one visit summary when a visitor navigates away or leaves. It sends route paths without query strings, fixed placement/target and document identifiers, one of three command IDs, authentication state, and deployment environment.

Acquisition origin is reduced to a bounded channel and known source label (for example direct, search/Google, LinkedIn, GitHub, an AI assistant, or an explicitly tagged outreach campaign). Unknown referring sites become other; the raw referrer URL and raw campaign parameters are never sent. An optional campaign link may carry a fixed audience hint such as investor, developer, technical buyer, agent builder, maintainer, security evaluator, or researcher. That hint describes the link, not a conclusion about the person who opened it. Observed behavior is reported separately as low engagement, engaged research, technical evaluation, or signup intent.

Visit summaries include active seconds and elapsed seconds capped at one hour, a coarse duration bucket, maximum scroll-depth bucket, and a behavioral segment: low engagement, engaged researcher, technical evaluator, or signup intent. Active time pauses while the page is hidden and after thirty seconds without activity. The segment is derived only from page behavior such as docs views, command copies, story interaction, and signup actions; it does not claim a visitor's profession, employer, or identity.

The splash never sends command text, graph content, search text, names, email addresses, user credentials, organization IDs, raw referrer URLs, or URL query strings.

Consented visitors begin with PostHog's anonymous identifier. If an existing Console session is present, the analytics wrapper identifies the session using only its opaque user ID. Person profiles are limited to identified visitors. Session replay, autocapture, surveys, exception capture, performance capture, feature flags, dead-click capture, and marketing cookies are disabled.

Withdrawing consent opts the browser out, resets PostHog identity and device state, and removes PostHog cookie, local-storage, and session-storage values while preserving the essential consent choice.

Agent contribution consent

MCP read tools can search public prior art without publishing new knowledge. Write-capable contribution workflows require explicit collection consent because they can publish reusable problem and solution metadata.

GPC behavior

When Global Privacy Control is detected, the site treats it as a do-not-sell/share signal, forces analytics and marketing off, and shows the detected state on the cookie settings page.

Review or change your current browser choice on the cookie settings page.