Install ping privacy
The Sottos Desktop app sends a single aggregate ping when it starts so we can count installs and measure version adoption. This page documents every field that ping touches, what we explicitly do not collect, and how to turn it off.
What the desktop client sends
When CodeNova's Sottos Desktop app starts it sends one small JSON payload to a Cloudflare Worker we operate. The payload is the same shape across every install and contains a randomly generated install identifier (a UUID created once on first launch, never re-derived from your hardware, account, or any other personally identifying signal), the app channel ("sottos"), the desktop version, and the operating-system family ("darwin", "win32", or "linux"). Optional fields are the OS architecture, release string, and kernel type — these are submitted by the desktop client only when present and are truncated to 96 characters server-side.
What the server records
The receiver, a Cloudflare Worker, also records server-side metadata about the request: the country, region, city, timezone, and Cloudflare data-center identifier that Cloudflare's edge derived for the connection. The raw client IP address is never persisted — only Cloudflare's already-derived location strings are stored. Each row carries the timestamps of the first and most recent ping for that install identifier, a counter of how many pings have been seen, and the environment (production or development) of the receiver that wrote the row.
How the install identifier is stored
The install identifier is stored in the database only as a SHA-256 hash, so the raw UUID never reaches durable storage. This means duplicate pings from the same install update the same row idempotently without us being able to reconstruct the original identifier from the database alone.
What we do not collect
We do not collect or store: your IP address, your user agent, browser, MAC address, disk identifier, machine name, account or login state, email address, file contents, clipboard contents, screen contents, prompt or transcription data, keystrokes, mouse activity, behavioral events, error reports, or any other telemetry beyond the fields described above. Sottos Desktop sends nothing else to this endpoint, and the Worker rejects payloads that don't match the documented shape.
How we use the data
We use these counts only to understand install volume, version-adoption rates, and the rough geographic distribution of desktop installs so we can plan releases, support timezones, and reliability. The data is never used for advertising, profiling, automated decisions about you, or any decision affecting an individual user. We do not sell, share, or rent any of this data, and we do not link it with other CodeNova systems such as billing or authentication — there is no identifier in common between this dataset and your account.
Processors
Cloudflare, Inc. is the sole processor for this dataset. Pings are received by a Cloudflare Worker, persisted in a Cloudflare D1 database, and rolled up daily into a Cloudflare KV namespace used to serve aggregate counts. Cloudflare's edge briefly sees the client IP to route the request, but our Worker only ever reads the derived geographic fields from the request — we never copy the raw IP into our storage. Cloudflare's own privacy notice covers transient network metadata they handle as a service provider.
Lawful basis
For users in the European Economic Area, the United Kingdom, and Switzerland, processing is performed under Article 6(1)(f) of the GDPR (legitimate interests in maintaining and improving the desktop product) and is limited to pseudonymous aggregate analytics. For California residents under the CCPA, this dataset does not constitute a sale or sharing of personal information.
Your choices and opt-out
Because the install identifier is pseudonymized into a one-way hash before storage, we cannot match a request to a specific row on your behalf, and we cannot delete a single user's data without deleting all install rows. If you want to stop your desktop client from sending the ping entirely, set the environment variable `SOTTOS_DISABLE_INSTALL_PING=1` before launching the app — when that variable is set, the desktop client resolves no endpoint and writes nothing. For other privacy requests, including a request that we stop processing the install-ping dataset in aggregate, contact [email protected].
Retention
Aggregate install rows are kept indefinitely so we can compute long-running install counts. Daily rollups stored in Cloudflare KV are overwritten by the next scheduled aggregation. We will publish a change-log entry here if we ever shorten or formally cap that retention window.
Contact
If you have questions about the install-ping dataset, want a copy of the live database schema, or want to verify what the Worker is storing, contact [email protected]. The Worker source and database schema are open inside the Sottos org so the data contract can be audited end-to-end.