Telemetry & Privacy

o4 runs on your machine, with your keys. Model and tool traffic goes only to the providers you configure. This page documents exactly what else leaves your machine — which is very little — and how to turn it off.

What is collected

o4 includes anonymous telemetry, enabled by default, with a one-setting opt-out. Two things happen when it is enabled:

1. Local events are written to ~/.o4/telemetry/events.jsonl and stay on your machine: session started (provider, model), tool used (name, success/failure), errors (category only — no messages or paths), and session ended (duration, turns). Inspect them any time with /stats.
2. A daily ping is sent to Open4rena containing exactly four fields: a random install id (not derived from your machine), the o4 version, OS, and CPU architecture. At most once per day, fire-and-forget, nothing else.

What is never collected

Code content, prompts, file paths, file names, API keys, error messages, or any personally identifiable information. The ping payload is pinned by a test in the codebase — widening it requires changing this disclosure first.

Turning it off

Any of these works:

• Toggle the telemetry row under /config > General
• Set { "telemetry_enabled": false } in ~/.o4/settings.json
• Export O4_TELEMETRY=0 for a single process

For self-hosters

O4_PING_ENDPOINT overrides where the daily ping is sent — useful for air-gapped mirrors that want their own install counts. If O4_TELEMETRY_ENDPOINT is set, local events are also POSTed there in batches every 5 minutes; otherwise they never leave the machine.

Licensing

The o4 binary is proprietary software distributed under the license in the releases repository, which also documents the telemetry above. Third-party attributions ship in THIRD-PARTY-NOTICES.