Telemetry

• By default the Steroid CLI sends aggregate usage counts: whether a recall was answered, a coarse time bucket, which setup or update step failed. The full list of fields is on this page.
• It never sends your code, files, conversations, recall questions or answers, project or repository names, file paths, error messages, hostnames, usernames or email addresses.
• The CLI identifies an install with a random ID created on your machine. It is not derived from your hardware, username, project or account, and Steroid does not link it to an account. Because it stays the same over time, we treat it as pseudonymous data, not anonymous data.
• This website sets no cookies and uses no local storage, session storage or visitor ID for analytics. It counts events, not people.
• You can turn CLI telemetry off at any time with steroid telemetry disable or DO_NOT_TRACK=1, and you can see exactly what would be sent before anything is.

Usage counts are sent over HTTPS to telemetry.steroidkit.com. Events are saved on your machine first and uploaded in batches by the background service, or after a command you run. Telemetry is not sent from source or development builds, or when the CI environment variable is set.

Every CLI event carries these fields:

• Install ID. A random identifier generated on your machine the first time the CLI runs. It is not derived from your hardware, username, project or account, and Steroid does not link it to an account.
• Event name. One of the events listed below.
• Date. The calendar date (UTC). No time of day.
• CLI version. The published version number, for example 0.4.0.
• Operating system. macos, linux or windows.
• Event ID. A random identifier so a retried upload is not counted twice.

The events, and the only fields each one may contain:

Every value above is a number, a true or false flag, a published version number, or one of the fixed words listed. Free text cannot be sent: the CLI rejects anything outside these lists before it is saved, and our server rejects it again on arrival.

The pages of steroidkit.com send the events below. They carry no identifier, so two events from the same browser cannot be linked to each other, and the site stores nothing in your browser to do so. The site honors Do Not Track and Global Privacy Control: if either is on, it sends nothing.

On arrival, a value is reduced before it is stored:

• Where you came from. Your browser reduces the referring page to its domain name and sorts it into one of: direct, search, hn, producthunt, x, reddit, github, other. This is done once, on the first page you open, and the full address and any campaign tags never leave your browser.
• Your browser. The server reduces your user-agent to a browser family and an operating system family, then discards the original.
• Your country. Taken from a header added by Cloudflare. No finer location is stored.
• Pages. Only the page's name from a fixed list, never the address you typed or any query string.
• Forms. We record that a form was started, submitted or failed, never what you typed. The details you choose to submit in a form are stored separately so we can reply to you.

The only thing this site keeps in your browser is, if you join the waitlist, a note of the email you entered so the dialog can tell you that you already joined. It is not used for analytics.

• Your code, files, diffs or conversation text.
• Recall questions or answers.
• Project, repository or folder names, and file paths.
• Error messages or stack traces.
• Hostnames, usernames and email addresses (the CLI never sends them).
• Any value derived from the above, including hashes: a hash of a project name would still let two installs be matched.
• Your IP address. The Steroid application does not read, store or log it. Cloudflare, which delivers traffic to our servers, processes IP addresses to deliver requests and block abuse, under its own retention settings.

Telemetry is stored in Steroid's own database. We do not send it to a third-party analytics service. Access is limited to the admin dashboard, which hides any breakdown that would describe fewer than 10 installs.

• Individual events from the CLI and from this website are deleted after 90 days.
• Daily per-install summaries (counts of active days and recalls, no content) are kept for 13 months, so retention can be measured over time.
• Running totals and monthly counts (for example recalls per month or installs per month) are kept indefinitely. They are plain numbers with no install ID, so they cannot be linked to any install.

Because those totals contain no install ID, an event that has already been counted into one cannot be taken back out when you opt out or delete your install ID. Opting out stops future counting and deletes your install ID and anything not yet uploaded; the individual events and daily per-install summaries tied to it are still deleted on the schedule above. The dashboard still hides any breakdown that would describe fewer than 10 installs, including breakdowns of these totals.

• steroid telemetry disable turns CLI telemetry off for good, deletes the install ID and discards anything not yet uploaded. steroid telemetry status shows the current state and why.
• DO_NOT_TRACK=1 or STEROID_TELEMETRY_DISABLED=1 in the environment turns it off for programs started from that environment. The background service and some editors start without your shell's environment, so use steroid telemetry disable to be certain.
• STEROID_TELEMETRY_DEBUG=1 prints exactly what would be sent and sends nothing.
• After you opt out, nothing is sent, including a note that you did.

When your coding agent asks Steroid for context, the answer is produced by your own coding agent, which sends that context to its own model provider under that provider's terms. That is separate from Steroid telemetry and is not sent to Steroid. See Privacy.

Connected mode is not available in this release. This page will list what it sends before it launches.

Questions about this page: [email protected].