Privacy
Exactly which analytics events Carbon sends and what they carry, what is never sent, how to turn analytics off with `CARBON_NO_ANALYTICS`, and how surveys and the website measure visits.
Carbon sends a small set of anonymous usage events, so we can see which builds are in use, which features get used and where the app breaks. Your prompts, code, conversations, file paths, session titles and error messages never leave your machine through analytics. Analytics is on, and Settings has no switch for it.
Turn analytics off
Set CARBON_NO_ANALYTICS to any value in the environment Carbon starts from. Carbon then sends nothing, from the app or from the background server on your Mac, since the app passes the variable on to it. See Environment variables for how to start the app with one.
Older versions had a Share basic analytics switch in Settings. A choice saved there is no longer read.
The install id
Events are tied to a random id for this install, not to you. It is created with the first event and stored in ~/.carbon/settings.json.
What is sent
Every event carries the same few facts about the build:
| Property | Example |
|---|---|
app_version |
0.28.1 |
os, arch |
macos, aarch64 |
is_debug |
false |
source |
app |
Then each event adds its own:
| Event | When | Adds |
|---|---|---|
app_started |
Each launch | Nothing more. |
active_day |
At most once a day: on launch, when Carbon comes to the front, when you send a message, or when you use Carbon Island | Nothing more. Messages agents send each other do not count. |
session_started |
You create a session | Agent, model, effort, permission mode, whether fast mode is on, whether it uses a worktree, whether another session started it, and where it runs: local or remote (below). |
feature_used |
A feature works | Which feature, from a fixed list (below). |
error |
Something breaks | Where it broke, never what it said (below). |
feature_used names one of: dictation (with the dictation model’s id, and where you dictated: app, island or phone), island_open (you opened Carbon Island), island_send (you sent a message from it), island_card (you answered a permission or question card from it), fork, pr_merged, linear_connected, space_created, worktree_deleted, settle, unsettle, pin, unpin, set_aside, unset_aside, handoff_commit, handoff_pr, handoff_runServer, remote_access, share, server_added and server_connected. The last three add how: app or cli for a share, ssh or address for a server. Never the port, the address or the server’s name. server_connected is sent at most once a day per kind.
What is never sent
- Your prompts, the agent’s replies, and anything else in a transcript.
- Code, file names and file paths.
- Session titles, project names, branch names, issue titles.
- Server names and addresses, ports and links.
- The text of any error message.
- Screens or recordings. Session recording and click tracking are off.
Error reports
When Carbon breaks, the error event says where, in a form that cannot carry your data:
- A crash in the app’s core: the file and line in Carbon’s own source code, and the thread’s name. Not the crash message, since that can contain a path.
- An agent line Carbon could not read: which agent, and at which step. Not the line itself. Sent once per agent and step per run. The full line stays on your machine in
~/.carbon/parse_failures.jsonl. - A failed update install: which step failed.
- A screen that crashed: React’s error code and up to eight locations in Carbon’s own code. Not the message.
Other errors in the app’s interface are not reported.
Surveys
Now and then Carbon may show a short survey card from PostHog, the analytics service it uses. With CARBON_NO_ANALYTICS set, no survey is loaded. A survey can be aimed at installs by the facts above and by how many sessions this install has. Answering is optional, and your answer goes to PostHog. Dismiss the card to skip it.
Linux servers
A Carbon server you install on Linux sends no analytics. The Mac app counts server_added and server_connected when you add or connect one, as described above.
When you start a session on another machine from the Mac app, the app sends that session_started, under your own install id, with location set to remote and remote_os set to macos, linux or other. The server’s name, address and hostname are never sent. A Carbon app on that other Mac does not count the session a second time. Sessions an agent starts there on its own are counted by that machine, or not at all on Linux.
The website and these docs
When analytics is configured, carbonhq.sh and these docs count page views and download clicks in the same PostHog project. They set a PostHog cookie holding a random id, so repeat visits and moves between pages count as one visitor. Nothing ties that id to who you are. Click tracking and session recording are off.
Other connections Carbon makes
Besides analytics, Carbon connects to the network for:
- Your agents. Each agent CLI talks to its own provider, as it does in a terminal. Carbon also asks the session’s own agent, on its cheapest model, to write each session’s title from your first prompt. For fx, Carbon reads Vercel’s public model list to know each model’s effort levels.
- Updates. Checking for and downloading new versions of the app and the
carbonCLI. - The changelog. Reading what’s new from carbonhq.sh.
- Downloads you trigger or need: the Chromium framework for Carbon’s browser (from Spotify’s CEF build server), dictation models (from Hugging Face).
- GitHub and Linear, when you use pull requests or issues, through
ghor your Linear key. - OpenTunnel, only while Remote access is on or a public link is live.
Dictation runs on your Mac. Your voice is never sent anywhere.
Limits
- There is no switch in Settings.
CARBON_NO_ANALYTICSis the only way to turn analytics off. - Surveys are drawn by PostHog and look like PostHog’s, not like Carbon.