Privacy Policy

Anonymous installation telemetry

Official npm releases of PolyRouter send minimal anonymous lifecycle telemetry by default to help us understand active installations and release adoption. This is not a count of verified npm downloads.

Telemetry contains a random installation UUID generated and stored only in PolyRouter's local database, the event type, event timestamp, and PolyRouter version.

The only event types are installed, startup, setup_complete, and successful dashboard_login.

What we do not collect

Installation telemetry never includes prompts, messages, gateway API traffic, token counts, model or provider names, API keys, provider credentials, dashboard passwords, cookies, raw IP addresses, machine IDs, hostnames, operating-system usernames, or free-form metadata.

Your controls

You can disable or re-enable anonymous telemetry at any time in Dashboard → Profile → Anonymous Telemetry. Disabling stops future delivery and deletes queued local telemetry events. For unattended installations, set POLYROUTER_PUBLIC_TELEMETRY=false before starting PolyRouter.

Changing this setting cannot delete events that have already been received because they are anonymous and cannot be linked to an account.

Security, retention, and abuse protection

The public endpoint accepts only a strict lifecycle-event schema. It has size limits, timestamp validation, duplicate protection, and per-IP/per-installation rate limits. Rate limiting stores a one-way IP hash for no longer than 48 hours; raw IP addresses are never stored.

Anonymous installation and event records are retained for up to 90 days, then automatically deleted. Access to the telemetry database is restricted to server-side administration; browser and npm clients have no database read credentials.

Dashboard analytics

When configured in an official release, GA4 and PostHog measure dashboard browser page visits and the polyrouter_dashboard_opened event. They use the same opaque local installation UUID as anonymous lifecycle telemetry, so dashboard activity can be associated with an installation without identifying a person. PostHog also records masked UI interaction metadata through autocapture; session recording is disabled and dashboard text and attributes are masked.

They do not receive gateway API traffic such as /v1/*, prompts, messages, model/provider selections, API keys, credentials, passwords, or URL query strings/fragments. Disabling Anonymous Telemetry also prevents the dashboard from exposing the installation UUID to GA4/PostHog or sending the explicit dashboard-open event.