Repository navigation
Privacy and Data Collection Clarification Request #459
Description
Privacy and Data Collection Clarification Request
Summary
I’d like to request clarification about OpenCode’s privacy practices and data collection policies. While the project appears to be local-first, explicit documentation about privacy would help users make informed decisions.
Background
Many developer tools today collect telemetry, usage analytics, or other forms of data. SST’s main framework has documented telemetry collection (which can be opted out), but OpenCode’s privacy practices are not clearly documented.
Questions
- Does OpenCode collect any telemetry or usage data? (e.g., feature usage, error reporting, analytics)
- Does OpenCode make any network requests beyond direct communication with configured AI providers?
- Are there any plans to add telemetry or data collection in the future?
- Could you add a privacy policy or data collection statement to the documentation?
Why This Matters
- Transparency: Users should know what data (if any) is being collected
- Security compliance: Many organizations require clear privacy documentation
- Trust: Explicit privacy statements help build user confidence
- Informed consent: Users can make educated decisions about tool adoption
Suggested Documentation
Consider adding a section to the README or docs that explicitly states:
- What data (if any) is collected
- How data is used and stored
- Whether data is shared with third parties
- User rights regarding their data
- How to verify the tool’s privacy claims
Context
This appears to be a genuinely local-first tool, which is fantastic! Making that explicit would help distinguish OpenCode from other tools that may collect data and attract privacy-conscious developers.
Thanks for creating such a useful tool, and thanks in advance for the clarification!
Activity
thdxr commentedon Jun 27, 2025
there is no telemetry collected - we do make background requests to fetch updated data from https://models.dev/api.json and checking for updates
aside from that it's just whatever communication with LLMs you're doing
thdxr commentedon Jun 27, 2025
will document this better
yuri-xyz commentedon Oct 31, 2025
@thdxr Hey, I was just curious to ask -- how are you able to determine monthly active users (ex. on the website it says
Fig 3. 250K Monthly Devsif no telemetry is collected?Thanks.
rekram1-node commentedon Oct 31, 2025
@yuri-xyz from models.dev requests
yuri-xyz commentedon Oct 31, 2025
@rekram1-node I see! Follow up question, does models.dev collect IPs from requests in order to determine unique user count? If not, how does it differentiate requests? Or is the monthly users data point an aggregate of all requests?
thdxr commentedon Oct 31, 2025
you can see in the models.dev repo how this is done
https://github.com/sst/models.dev/blob/91a03818a6eb45508d042c91cb4cf21a331296f1/packages/function/src/worker.ts#L16
posthog rolls this up and gives us an estimated unique count
opencode also bundles a snapshot of models.dev data in every release so can disable the fetch to it if you prefer
aymennasri commentedon Jan 23, 2026
@thdxr hey man, love your team's work but i want a clearer message than the one in the privacy policy about the "business partners" with whom you share messages and conversations mentionned in this part:
So far, reading that part conveys the message that you guys can collect, potentially read and use our conversations with whatever model we use and possibly share it with 3rd parties other than the providers themselves.
Also, a clear direct comment about whether you identify privacy as a priority or not would be appreciated.
OpenToInnovate commentedon Jan 30, 2026
My audit of the code base (Using OpenCode) identified the following user data being sent by default:
api.opencode.ai- Session content, promptsopncd.ai- Session sharing dataopencode.ai/zen/v1- Prompts to external LLMmcp.exa.ai- Search queriesapi.honeycomb.io- Telemetry, IP, locationus.i.posthog.com- Usage analyticsA privacy focused install option would ideally disable all of those and potentially give the option to use ddg search instead of mcp.exa.ai
OpenToInnovate commentedon Jan 30, 2026
I'm not concerned about the models.dev call. It is just a GET request, no cookies, no tracking & we have full transparency of what it does and it's clearly very open and community driven : https://github.com/anomalyco/models.dev
TheBaus commentedon Feb 7, 2026
@OpenToInnovate does your audit distinguish between using the default model providers or selecting your own third party provider, I.e: claude, openai, github copilot etc..
Where does the session data get sent to when using another provider? Still to opencodes api?
tredondo commentedon Feb 9, 2026
Are outbound connections documented anywhere to begin with? Today I noticed an out-of-the-blue connection to
gist.github.com, probably the periodic update check. Should be added to @OpenToInnovate's list.nntoan commentedon Mar 23, 2026
Still an issue..
VooDisss commentedon Mar 24, 2026
All of these privacy concerns need to be solved ASAP.
mejobloggs commentedon Apr 26, 2026
Are the deepseek models via OpenCode Go safe for data privacy?
I think it would be nice to add a "Data Privacy Mode" or "Enterprise Mode" toggle that disables all non privacy compliant models or external calls or anything that risks leaks.
In our environment we need to "block" features that risk data privacy not just turn them off.
E.g if "Data Privacy Mode" is enabled, a dev shouldn't be able to manually select Web Search or Deepseek (I'm just using Deepseek as an example, I'm not saying it's a risk).
Data privacy risk features could then have a message that you will need to exit "Data Privacy Mode" to use that feature
Merge pull request anomalyco#459 from different-ai/task/opencode-comp…
hmZa-Sfyn commentedon Jun 2, 2026
I am concerned about DATA-TRANSPARENCY-ACT or something, because then, why is opencode commiting my codebase on a private repo on anomaly github account?
Please, I ask you to clear my suspicion or possible mistake I did here:
https://github.com/anomalyco/opencode/issues/30400Here it shows that it commit-ing my codebase here:
https://github.com/anomalyco/gmaxEither the AI is misleading me, or something else altogather. PLease clear my question, Thanks!
Btw, I was redirected here by some github issue AI or something!
https://github.com/anomalyco/opencode/issues/30400-- original issue!github-actions commentedon Aug 2, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
vladshcherbin commentedon Aug 2, 2026
what a joke!
aharpervc commentedon Aug 3, 2026
Please re-open this issue...