We count six numbers.
We keep nothing else.

No cookies. No fingerprinting. No accounts. No IP logging. No content, ever. This is not a legal shield written to permit collection — it is a description of code that is incapable of collecting more than it states.

Effective 2026-07-23 · applies to the hosted instance at rha.software

Everything we record

Six aggregate counters — integers that only ever go up

Human page views — a visit to a page from a browser.
Bot page views — a visit identified as an automated crawler.
Plugin downloads — the number of times the Chrome extension was downloaded.
Runs executed — how many pipeline runs were started.
Runs succeeded — runs that finished with all frozen tests passing.
Runs failed — runs that terminated in failure.

That is the complete list. Each counter is also kept as a per-calendar-day total so we can see a trend line. A daily total is still only a count — it is attached to a date, never to a person, a session, or a request.

Everything we do not record

None of this is stored, transmitted, or derivable from what we keep

Your IP address — never read into a variable, never written down.
Your prompts or any content you type, generate, or download.
Tokens spent or saved, and any cost figure.
Duration, compute time, or the length of any run.
Which model or provider you used.
Any cookie, device fingerprint, session, or identifier.
Anything idiosyncratic to your system or your query.

To tell a human visit from a crawler, the server inspects the User-Agent header in memory for the duration of a single request and discards it immediately. Only the resulting +1 — to either the human or the bot counter — is ever written to disk. The header itself is never stored.

Where it lives

The counters live in a single file (data/telemetry.json) on the server that hosts this instance. They are never sold, never shared, and never sent to a third party. There is no analytics SDK, no tracking pixel, and no external beacon anywhere in this application.

Your keys

If you use the Provider Vault Chrome extension, your API keys are encrypted (AES-256-GCM, PBKDF2) and stored only inside the extension on your own machine. They never reach this server except as a live request to the provider you configured, and they are never logged.