Privacy

Rust Doctor's local-first telemetry and stateless sharing guarantees.

Rust Doctor observability is off by default. Without explicit stored consent, CLI, GitHub Action, MCP, and LSP invocations send no telemetry request.

This guarantee covers observability. Some analysis passes can access the network for their own data unless you use --offline.

#Explicit consent

# Inspect the effective state
rust-doctor telemetry status

# Opt in to one collector
rust-doctor telemetry enable --endpoint https://example.com/events

# Revoke consent
rust-doctor telemetry disable

Enabling telemetry validates the endpoint and asks for confirmation unless --yes is supplied. Rust Doctor stores only the consent schema version, enabled state, and endpoint in the user configuration directory. It creates no persistent cross-project client identifier.

Missing, unreadable, or incompatible consent fails closed. The following invocation-level controls always override stored consent:

• --no-telemetry
• --offline
• RUST_DOCTOR_TELEMETRY=0, false, or off

The environment variable can disable telemetry but cannot enable it.

#Event contract

Events are limited to schema and event IDs, event kind, tool version, operating system, architecture, invocation surface, bucketed duration, completeness, aggregate diagnostic and file counts, aggregate check states, and suppression count.

The event schema has no field for source text, raw paths, repository names, diagnostic messages, Git remotes, environment values, or command arguments. Crash events never transmit the panic payload.

#Delivery behavior

Each event gets at most one delivery attempt. Failed requests and non-success responses are discarded without retry, and no event queue is persisted to disk. Telemetry failures do not alter scan output or exit status.

Production collectors must use HTTPS. Loopback HTTP is accepted for local development. Endpoint credentials, query strings, fragments, and redirects are rejected. The collector still receives normal network metadata such as client IP and request timing, and it controls server-side retention.

#Stateless sharing

rust-doctor --share . builds the complete public summary locally in a versioned query string. Rust Doctor uploads and stores no report. Shared values contain aggregate scores, counts, completeness, file coverage, and canonical unavailable-check names, never repository or diagnostic content.

Share URLs are self-reported, editable, and not cryptographically signed. They are useful as progress snapshots, not as independent verification.