Privacy and telemetry
The short version: your code, your sessions and your tracked time never leave the machine. Three things do go out, all of them listed here.
What stays local
Everything that is not in the next section. Concretely: source, terminal output, agent conversations, worktree state, tracked time, notes, and every credential you connect.
The server binds loopback only. It is not reachable from your network even if you want it to be, and there is no upload path for any of the above.
What leaves the machine
The integrations you connect
Jira, Linear, GitHub and GitLab calls go to those services, using the tokens you gave Strado. Nothing else is attached to them.
Heads up
Those tokens live in plain-text files under ~/.strado — not in your
operating system's keychain. If you have read otherwise, the files are what
ships. Strado creates them mode 0600, but only at creation: an older file
keeps the permissions it had. See
files and locations.
The local server makes every one of these calls. A token is never handed to the browser; the interface can only ask whether one exists.
A sign-in check
A packaged build verifies its sign-in against Strado's API — the token it was issued, and nothing else. A failed check is tolerated: the app keeps working offline, and only an explicit revocation locks it.
Anonymous usage counts
Packaged builds send counters. This is the complete list of events, and there are no others:
| Event | When |
|---|---|
app_launched | The app started |
hub_opened | A worktree hub was opened — with which kind of tab |
diff_opened | The diff was opened |
mr_review_opened | A merge request review was opened |
worktree_created | A worktree was created locally |
worktree_created_remote | A worktree was created on a runner |
dev_server_started | A dev server was started |
palette_used | The command palette was opened |
switcher_used | The tab switcher was used — with which kind |
jira_connected | Jira was connected |
settings_saved | Settings were saved |
Each carries a name, a timestamp, and at most a fixed keyword like tabs or
browser. There are no free-text fields to leak into: no paths, no branch
names, no ticket ids, no URLs, and nothing from a terminal. They are batched
and sent on a 30-second timer, sooner if 20 events queue up, and once more when
the page goes away.
Turning it off
Two ways, and either is enough:
| Method | Effect |
|---|---|
| Settings, then Privacy — untick "Send anonymous usage counts" | Takes effect at the next launch |
STRADO_TELEMETRY=0 | Takes effect immediately at startup |
The setting is stored in ~/.strado/profile.json on your machine.
Note
Counters are only ever sent by a packaged, signed-in build. A build run from source sends none at all, regardless of these settings — there is no license token for them to ride on.
Turning counters off does not affect the sign-in check, which is what keeps a packaged build working, or your integrations, which are yours.
Time tracking is local measurement
Worth saying here as well as on its own page: tracked time is a file on your machine. It is not uploaded, there is no dashboard anywhere that sees it, the file watcher records that something changed and never what or where, and the numbers are per worktree rather than per person. See time tracking.