[FEATURE]: Revert silent removal of Go privacy wording and provider attribution, and add telemetry + retention to privacy policy #39875

• I have verified this feature I'm about to request hasn't been suggested before.

(It builds on #39860, #39857, #24649, #14281, #35303. Those ask for narrower
things. None got a substantive response.)

Hi folks. I'm a Go subscriber. Two commits in the last two weeks changed
what OpenCode told me about my data, and neither change was announced,
documented in a changelog, or paired with a privacy policy update. The
diffs are factual. The new copy is internally contradictory. The
relevant providers have a documented history of TOS violations that
makes the prior ZDR wording harder to defend quietly than it was when
you first published it.

1. Bring back the per-model provider column on the Go marketing page and
in /zen/go/v1/models.

@fwang, on 2026-07-16 you shipped 5121352 "go: grok 4.5 and kimi k3" and
deleted the [{ name, provider }] array in
packages/console/app/src/routes/go/index.tsx. The page used to show e.g.
GLM-5.2 -> DeepInfra, Fireworks AI, Z.ai. It's a plain string[] now.
The public API stopped returning a provider field at the same time. I
ran curl https://opencode.ai/zen/go/v1/models | jq '.data[0]' just now
and got {"id":"minimax-m3","object":"model","created":1785502284,"owned_by":"opencode"}.
Nothing in the response tells me which upstream serves the model.

@thdxr, in #24649 you said you can't refer to the providers' own TOS
because "every single provider we work with we have custom data retention
and hosting agreements". Fine. Then publish the routing at least, so I
can decide whether to trust your agreements or to point my client at
DeepInfra directly. The 24 models in the API today include ones the
marketing page doesn't show (kimi-k2.5, minimax-m2.5, mimo-v2-pro,
mimo-v2-omni, hy3-preview, glm-5, qwen3.5-plus). That's a
separate cleanup item but worth flagging.

This also unblocks #36270 (V2 TUI provider labels) and #34562 (provider
restore bug). Both are downstream of the same column being deleted.

2. Restore the "zero-retention policy" wording in the FAQ body, or tell
us why it isn't there.

@fwang, on 2026-07-31 you shipped 2df47ee "deepseek v4 flash". It
softened go.faq.a5.body from "Our providers follow a zero-retention
policy and do not use your data for model training" to "Your data
will not be used for model training". The replacement is strictly
weaker. The go.faq.a5.beforeExceptions paragraph right below it still
says "Providers follow a zero-retention policy". The same FAQ
contradicts itself in 17 locales now.

I read it three times before I was sure it wasn't a copy-paste error. It
isn't. git show 2df47ee -- packages/console/app/src/i18n/en.ts shows
both strings were deliberately set this way.

Either put the ZDR wording back, or tell us which provider's contract
changed so the wording had to come out. The 2026-03-29 OpenCode tweet
is still up ("we've signed Zero Data Retention agreements with all
providers for Go", 512K views). Walking it back quietly, with no
changelog entry, is worse than walking it back loudly. A short
contract-status table at the top of the docs would do the job.

3. Tell us in writing whether any Go or Zen paid provider still has
prompt-content storage enabled.

@thdxr, in #14281 (2026-02-19) you confirmed that the dataDumper.ts
path wrote full prompts and responses to Cloudflare R2 (ZenDataNew
bucket) for free-model users, gated by storeModel. You said
"storeModel is only set for free models". The file was deleted on
2026-05-21 (commit 6de584f). Good.

But the storeModel field is still in the model catalog schema
(packages/console/core/src/model.ts:45). grep -r storeModel across
the whole repo returns only that schema definition. Nothing reads it.
The ZenDataNew R2 bucket is still provisioned (infra/console.ts:233)
but no code path writes to it. The internal console-go.* / inf-go.*
provider IDs are referenced only by handler.ts and defined nowhere
in the public repo.

So the maintainers' Feb 19 statement is unverifiable from public
artifacts today. The deployed ZEN_MODELS1..30 secret catalog is not
public. Two options work: publish a sanitized version of the catalog,
or publish an explicit confirmation that no Go or Zen paid provider has
storeModel set.

4. Add the server-side telemetry destination to the privacy policy.

packages/console/function/src/log-processor.ts forwards per-request
metadata to Honeycomb and SST Lake (Firehose, then Iceberg S3 Tables via
Glue, then Athena, with an ECS Fargate front end at
packages/stats/server). The fields per request:

• IP, /32 prefix for IPv4, /64 for IPv6
• cf.continent, cf.country, cf.city, cf.region, cf.latitude, cf.longitude, cf.timezone
• workspace, user_id, API key, session_id
• model, model_tier ("zen" or "go"), model_variant
• source ("anonymous", "free", "byok", "subscription", "lite", or "balance")
• provider and provider_model (real upstream via the x-opencode-endpoint-id pass-through for routes that hit console.*, console-go.*, inf.*, or inf-go.*)
• token counts, cost, latency

No prompt content. Full attribution. The privacy policy at
https://opencode.ai/legal/privacy-policy doesn't mention Honeycomb,
SST Lake, or any of those data categories. Add a section that names
them. Cite retention.

5. Add a binding retention statement to the privacy policy.

The ZDR claim was only ever marketing copy, in the FAQ, the docs page,
and a tweet. The privacy policy makes no commitment about retention,
training, or upstream data handling. If the ZDR promise still applies
to Go, restate it in the privacy policy in language that survives a
marketing-page edit. If it doesn't, say so and link to the per-provider
contract status.

References:

• 2df47ee: 2df47ee
• 5121352: 5121352
• Wayback of the old FAQ (2026-07-25): https://web.archive.org/web/20260725115057/https://opencode.ai/docs/go/
• /zen/go/v1/models live API (no provider field)
• Original ZDR tweet: https://x.com/opencode/status/2038302829517893825
• Anthropic distillation disclosure summary (Feb 2026, DeepSeek, Moonshot, MiniMax): https://rits.shanghai.nyu.edu/ai/anthropic-exposes-industrial-scale-distillation-attacks-by-deepseek-moonshot-and-minimax/
• Privacy concern: All user prompts and responses are stored server-side without disclosure or opt-out #14281 (dataDumper disclosure), OpenCode Go: clarify which models are self-hosted vs. proxied through third-party providers #24649 (self-hosted vs proxied), [FEATURE]: Opt-in to share anonymized conversation data with model providers for improving open-source models #35303 (opt-in data sharing), Removal of zero-data-retention policy #39860 (auto-closed ZDR removal filing), Why was the per-model provider mapping removed from the OpenCode Go page, and can it be restored? #39857 (provider mapping removal question)