Our Telemetry Practices

1. Introduction

Rediacc software products collect anonymized usage telemetry to help us improve product quality, diagnose issues, and understand how our tools are used. This Telemetry Policy describes exactly what data is collected, why, how it is processed, and how you can opt out.

This policy covers two products: the Rediacc CLI and the Rediacc Renet Agent. Website analytics (Plausible) are covered separately in our Privacy Policy and Cookie Policy.

2. Our Telemetry Principles

All telemetry collection at Rediacc follows these principles:

• Privacy by design: Personal identifiers are anonymized before transmission. Email addresses are reduced to domain only, user IDs are hashed (SHA-256) and truncated, passwords and secrets are never collected.
• Minimal collection: We collect only what is necessary to improve product quality and diagnose issues. We do not collect file contents, database contents, query results, or business data.
• Transparency: This policy lists every category of data collected by each product. There are no hidden data flows.
• User control: Every product provides a mechanism to disable telemetry entirely. Opt-out is respected immediately and completely.
• Aggregation: Telemetry data is analyzed in aggregate. We do not build individual user profiles from telemetry.

3. Legal Basis for Collection

Under the EU General Data Protection Regulation (GDPR) and the ePrivacy Directive, our legal basis for telemetry collection depends on the product context:

For the CLI and Renet Agent (installed on your infrastructure): telemetry is collected under legitimate interest (GDPR Art. 6(1)(f)) with clear opt-out mechanisms provided. You can disable telemetry before any data is sent.

For users in jurisdictions requiring explicit consent (e.g., South Korea under PIPA), telemetry should be opted into explicitly through the product configuration before any data is transmitted.

4. CLI Telemetry

The Rediacc CLI uses the OpenTelemetry Node SDK. Telemetry is transmitted to rediacc.com.

4.1 Data Collected

The CLI collects the following categories of data:

• Command usage: command name, CLI version, exit code, success or failure status
• Anonymized arguments: command options with sensitive values redacted — passwords, tokens, secrets, API keys, and credentials are replaced with [REDACTED]
• Environment: operating system type, Node.js runtime version, deployment environment
• Error information: error type, error message, and limited stack trace when commands fail
• API interactions: HTTP method, URL path, response status code, request duration
• Session: randomly generated session ID, command execution duration
• Performance profiling: CPU usage samples and memory allocation profiles, collected automatically and sent to our profiling endpoint

4.2 How to Opt Out

You can disable CLI telemetry (including profiling) using any of these methods:

• Set the environment variable REDIACC_TELEMETRY_DISABLED=1
• Set telemetryEnabled: false in your CLI configuration file
• Telemetry is automatically disabled in CI environments (detected via the CI environment variable)

5. Renet Agent Telemetry

The Rediacc Renet Agent uses OpenTelemetry with gzip-compressed OTLP export. Telemetry is transmitted to rediacc.com in batches (maximum 10 spans, flushed every 5 seconds).

5.1 Data Collected

The Renet Agent collects the following categories of data:

• Queue operations: task ID, priority level, operation type, execution duration, success or failure status
• SSH operations: target host, username, port number, exit code, execution duration (no command content or output is collected)
• API calls: procedure name, request duration
• Vault operations: operation type and duration (no secret values, keys, or vault contents are collected)
• Renet Agent lifecycle: startup, shutdown, and reconnection events
• Performance profiling: CPU usage samples and memory allocation profiles, collected automatically and sent to our profiling endpoint

5.2 How to Opt Out

Set the environment variable REDIACC_TELEMETRY_DISABLED=1 to disable Renet Agent telemetry (including profiling).

6. Data Processing and Storage

All telemetry data is transmitted over encrypted connections (TLS 1.2+) to our telemetry endpoint. Data is processed and stored as follows:

• Encryption: All data is encrypted in transit using TLS. The Renet Agent additionally uses gzip compression.
• Retention: Raw telemetry traces are stored for up to 90 days for debugging and incident investigation. Aggregated metrics are retained for up to 12 months and then deleted.
• Access: Telemetry data is accessible only to Rediacc engineering and operations staff on a need-to-know basis.
• No third-party sharing: Telemetry data is not shared with, sold to, or accessible by any third party.
• Infrastructure: All telemetry data is processed and stored on infrastructure located within the European Union.

7. International Data Transfers

Telemetry data is processed and stored exclusively on servers within the European Union. In the unlikely event that telemetry data needs to be transferred outside the EU/EEA (e.g., for disaster recovery), appropriate safeguards will be in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.

8. Your Rights

Because our telemetry data is anonymized and aggregated, it generally does not constitute personal data under GDPR. However, to the extent that any telemetry data can be linked to you personally, you have the right to:

• Access: Request information about what telemetry data we hold that may relate to you
• Deletion: Request deletion of any telemetry data that can be linked to you
• Opt-out: Disable telemetry at any time using the product-specific mechanisms described above
• Complaint: Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority

To exercise any of these rights, contact us at contact@rediacc.com. We will respond within 30 days.

9. California Residents (CCPA/CPRA)

If you are a California resident, the following additional disclosures apply under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Categories of information collected: Internet or electronic network activity information (browser type, interaction data, error logs), device identifiers (anonymized), geolocation data (country-level only, derived from IP address which is not stored)
• Purpose: Improving and maintaining service quality, debugging, performance monitoring, and security
• Sale/Sharing: We do not sell or share telemetry data as defined by the CCPA/CPRA
• Right to opt out: Use the product-specific opt-out mechanisms described in sections 4 and 5 above.

10. Changes to This Policy

We may update this Telemetry Policy when we add new products, change what data is collected, or modify our processing practices. Changes will be posted on this page with an updated effective date. We will notify users of material changes through our product release notes and website.