mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
Richard Courtman
a70c96c8a3
The setup wizard's telemetry card only ever offered a way out: it led with "enabled by default", gave no reason the data exists, and told the reader to set PULSE_TELEMETRY=false before starting a process that had already sent its first ping two minutes after boot. The payload-update banner paired "we now collect more" with a one-click Disable button, was keyed to schema v2 from July and never re-triggered across fifteen later bumps, and its text was rewritten in August so anyone who had dismissed it never saw the new wording. Nothing on either surface said what the data is for or what it is never used for. No GitHub issue or discussion has ever complained about the default-on posture, so the defensive framing was answering a question nobody asked while quietly nudging people to opt out. Setup now leads with what the daily summary is for (development effort follows real use; the features and platforms the operator relies on get priority), names concrete exclusions (hostnames, credentials, IP addresses), states what it is never used for (not sold or shared, not used for advertising, not linked to a Pulse account or license), and puts a real Usage statistics toggle on the admin-account step. The toggle defaults to on and, when switched off, is applied through the canonical system-settings endpoint once the admin token exists, so there is no setup-only side channel and the account is created either way. Neither setup screen tells the reader how to turn it off; the switch is the control. The env-var instruction moves to PRIVACY.md where a reader can still act on it, alongside a note that the first ping fires about two minutes after start. The payload-update banner is retired along with its telemetryAction deep link that changed the preference on arrival. Payload changes are now disclosed in a dated changelog in PRIVACY.md (back-filled from schema v2 to v17 from the telemetry package's own version notes) and in release notes; an in-app notice is reserved for a change in kind. PRIVACY.md gains a "What it is not used for" section whose statements are facts about the license-server path, which never joins telemetry rows to license or customer records; the contract treats any change to that path as a change in kind. Settings leads with what the data is for and makes Preview payload the primary action, because the exact runtime payload is the disclosure an operator can verify. The security-privacy, deployment-installability, and frontend-primitives contracts record the new rules. Telemetry and i18n proof tests pin the setup choice, the purpose-first and never-sold wording in every locale, and the changelog row for the current schema so a future bump cannot land undisclosed. Demand ledger: repos/pulse-pro FEATURE_REQUESTS.md "Telemetry consent as a real setup choice" (named bet, pulse-pro PR #40). Supersedes the three-commit branch behind Pulse PR #1873, rebuilt on current main.