Privacy

Your code and documents stay local.

DevSpecs is local-first. The CLI indexes files on your machine and stores its SQLite database locally unless you explicitly point it elsewhere.

What never leaves through CLI telemetry

repository names

file paths

git remotes

artifact titles

document text

source code

raw search queries

What the CLI can send

DevSpecs sends minimal anonymous CLI telemetry to improve install, init, scan, query, map, recent, and apply flows. Events use a random local anonymous ID stored under `DEVSPECS_HOME`; there are no user accounts.

Group	Examples
`Environment`	CLI version, OS, architecture, install method.
`Outcome`	Command name, success, coarse error class, duration bucket.
`Counts`	Bucketed artifact, source, result, and update counts.
`Flags`	Boolean command-shape fields such as --json, --quiet, or --rebuild.

Allowed events

install_completedinit_completedscan_completedfind_completedmap_completedrecent_completedapply_completed

Controls

DEVSPECS_TELEMETRY=0
DS_TELEMETRY=0
DEVSPECS_TELEMETRY=debug

`DEVSPECS_TELEMETRY=debug` prints the would-send event to stderr instead of sending it.

Server-side handling

When telemetry is enabled, server-side handling rejects unknown event names, drops unknown properties, truncates allowed string fields, and stores only allowlisted event rows.

The CLI telemetry client is public in internal/telemetry.