Anonymous usage reporting

VectorStep and Gateway each send a single anonymous ping when they start. Its only purpose is counting installs — GitHub Release downloads and PyPI downloads are already public for the other two distribution channels, but container/Kubernetes pulls are not, and that’s the channel most deployments actually use.

What gets sent

One POST per process start — no periodic heartbeat, so this tracks installs, not usage or retention:

{
  "event": "start",
  "install_id": "3f2a1c9e-...",
  "component": "service",
  "version": "v0.14.2",
  "os": "linux",
  "arch": "arm64",
  "install_method": "container"
}

• install_id — a random identifier generated once and persisted locally (in your data directory, alongside the database), so restarting or upgrading doesn’t count as a new install. It’s not derived from your hostname, MAC address, or IP, and isn’t tied to a licence or email — there’s no registration flow here.
• component — service or gateway. A combined install shows up as two pings, which is intentional: it separates Gateway adoption from service-only deployments.
• version, os, arch, install_method — self-explanatory; nothing you wouldn’t see in docker inspect or a support request.

Never sent: hostnames, IP addresses beyond what any network request inherently discloses to the receiving server, licence or email, config file contents, pipeline or agent definitions, or any data processed by VectorStep.

Disabling it

Any one of these turns it off completely — checked before anything is sent, so disabling it means zero outbound requests, not just a discarded payload:

• DO_NOT_TRACK=1 — the informal cross-tool standard
• VECTORSTEP_TELEMETRY=false
• telemetry.enabled: false in config.yaml

install.sh prints a reminder of this on every install and upgrade.

Where it goes

The endpoint is a small, purpose-built receiver: it validates the payload strictly (rejecting anything that doesn’t match the shape above), discards the request without reading or logging your source IP, and writes the event as a single anonymous record. There’s no dashboard or account behind it that identifies you or your deployment — it exists purely to produce an aggregate install count.

See the threat model for how this fits into VectorStep’s broader data-handling posture.