---
title: Privacy
description: Exactly which analytics events Carbon sends and what they carry, what is never sent, how to turn analytics off with `CARBON_NO_ANALYTICS`, and how surveys and the website measure visits.
sidebar:
  order: 3
---

Carbon sends a small set of anonymous usage events, so we can see which builds are in use, which features get used and where the app breaks. Your prompts, code, conversations, file paths, session titles and error messages never leave your machine through analytics. Analytics is on, and Settings has no switch for it.

## Turn analytics off

Set `CARBON_NO_ANALYTICS` to any value in the environment Carbon starts from. Carbon then sends nothing, from the app or from the background server on your Mac, since the app passes the variable on to it. See [Environment variables](/docs/reference/data#environment-variables) for how to start the app with one.

Older versions had a **Share basic analytics** switch in Settings. A choice saved there is no longer read.

## The install id

Events are tied to a random id for this install, not to you. It is created with the first event and stored in `~/.carbon/settings.json`.

## What is sent

Every event carries the same few facts about the build:

| Property | Example |
|---|---|
| `app_version` | `0.28.1` |
| `os`, `arch` | `macos`, `aarch64` |
| `is_debug` | `false` |
| `source` | `app` |

Then each event adds its own:

| Event | When | Adds |
|---|---|---|
| `app_started` | Each launch | Nothing more. |
| `active_day` | At most once a day: on launch, when Carbon comes to the front, when you send a message, or when you use Carbon Island | Nothing more. Messages agents send each other do not count. |
| `session_started` | You create a session | Agent, model, effort, permission mode, whether fast mode is on, whether it uses a worktree, whether another session started it, and where it runs: `local` or `remote` (below). |
| `feature_used` | A feature works | Which feature, from a fixed list (below). |
| `error` | Something breaks | Where it broke, never what it said (below). |

`feature_used` names one of: `dictation` (with the dictation model's id, and where you dictated: `app`, `island` or `phone`), `island_open` (you opened Carbon Island), `island_send` (you sent a message from it), `island_card` (you answered a permission or question card from it), `fork`, `pr_merged`, `linear_connected`, `space_created`, `worktree_deleted`, `settle`, `unsettle`, `pin`, `unpin`, `set_aside`, `unset_aside`, `handoff_commit`, `handoff_pr`, `handoff_runServer`, `remote_access`, `share`, `server_added` and `server_connected`. The last three add how: `app` or `cli` for a share, `ssh` or `address` for a server. Never the port, the address or the server's name. `server_connected` is sent at most once a day per kind.

## What is never sent

- Your prompts, the agent's replies, and anything else in a transcript.
- Code, file names and file paths.
- Session titles, project names, branch names, issue titles.
- Server names and addresses, ports and links.
- The text of any error message.
- Screens or recordings. Session recording and click tracking are off.

## Error reports

When Carbon breaks, the `error` event says where, in a form that cannot carry your data:

- **A crash in the app's core:** the file and line in Carbon's own source code, and the thread's name. Not the crash message, since that can contain a path.
- **An agent line Carbon could not read:** which agent, and at which step. Not the line itself. Sent once per agent and step per run. The full line stays on your machine in `~/.carbon/parse_failures.jsonl`.
- **A failed update install:** which step failed.
- **A screen that crashed:** React's error code and up to eight locations in Carbon's own code. Not the message.

Other errors in the app's interface are not reported.

## Surveys

Now and then Carbon may show a short survey card from PostHog, the analytics service it uses. With `CARBON_NO_ANALYTICS` set, no survey is loaded. A survey can be aimed at installs by the facts above and by how many sessions this install has. Answering is optional, and your answer goes to PostHog. Dismiss the card to skip it.

## Linux servers

A Carbon server you install on Linux sends no analytics. The Mac app counts `server_added` and `server_connected` when you add or connect one, as described above.

When you start a session on another machine from the Mac app, the app sends that `session_started`, under your own install id, with `location` set to `remote` and `remote_os` set to `macos`, `linux` or `other`. The server's name, address and hostname are never sent. A Carbon app on that other Mac does not count the session a second time. Sessions an agent starts there on its own are counted by that machine, or not at all on Linux.

## The website and these docs

When analytics is configured, carbonhq.sh and these docs count page views and download clicks in the same PostHog project. They set a PostHog cookie holding a random id, so repeat visits and moves between pages count as one visitor. Nothing ties that id to who you are. Click tracking and session recording are off.

## Other connections Carbon makes

Besides analytics, Carbon connects to the network for:

- **Your agents.** Each agent CLI talks to its own provider, as it does in a terminal. Carbon also asks the session's own agent, on its cheapest model, to write each session's title from your first prompt. For fx, Carbon reads Vercel's public model list to know each model's effort levels.
- **Updates.** Checking for and downloading new versions of the app and the `carbon` CLI.
- **The changelog.** Reading what's new from carbonhq.sh.
- **Downloads you trigger or need:** the Chromium framework for Carbon's browser (from Spotify's CEF build server), dictation models (from Hugging Face).
- **GitHub and Linear,** when you use pull requests or issues, through `gh` or your Linear key.
- **OpenTunnel,** only while [Remote access](/docs/reference/remote-access#remote-access) is on or a [public link](/docs/reference/remote-access#share-a-dev-server) is live.

Dictation runs on your Mac. Your voice is never sent anywhere.

## Limits

- There is no switch in Settings. `CARBON_NO_ANALYTICS` is the only way to turn analytics off.
- Surveys are drawn by PostHog and look like PostHog's, not like Carbon.