Privacy

What a report holds

• The place in Ruimte's code where the error happened, and the first line of its message.
• The Ruimte version, the operating system and its version, and the processor type.
• For a connection problem, whether it was this computer or another one, how they were connected, and the type of request. Never what the request carried.
• The last steps before the report: on the iPhone when the app came to the front or went to the background and when a connection to a machine opened or closed, on the machine when it started, served or stopped and when an app or another machine connected or left.

Before a report leaves your computer, Ruimte strips paths, names, addresses and anything that looks like a secret from every line of text in it. The same error goes out at most once a day.

What Ruimte never collects

Ruimte does not collect your prompts and chats, the contents of your files, terminal output, the text of database queries, passwords, tokens and keys, the names and folders of your projects, your home folder, your username, the name of your computer, or IP addresses. Observatory does not store the IP address a report arrives from.

There are no breadcrumbs of what you clicked, no session recordings and no performance tracing. Of the logs only the warnings of the machine go along, scrubbed the same way as a report.

Crash reports are always on

Crash reports are on in every release of the desktop app, of the machine it runs your terminals and agents on, of the web app at station.ruimte.app, of the model comparison at bench.ruimte.app and of the iPhone app. There is no switch. A build from the source code on your own computer sends nothing.

Two things go with the crash reports, and are on and off with them:

• A session for each run of the desktop app, the machine, the web app, the model comparison and the iPhone app: the Ruimte version, what it runs in (the browser and its version for the web app and the model comparison), how the run ended (fine or crashed) and how long it lasted. No user and no id of your install, so a session only tells me how many runs of a version crashed. The crash library of the iPhone app does add an id of the install; the crash service throws it away on arrival, before anything is stored.
• A few measurements of how quickly things work: how long a connection to a machine took to open or to fail and which way it went (this computer, the local network, a direct connection or a relay), why a connection had to be opened again, how long a request to the machine waited for its answer by the way it went, and how long a project took to appear after you opened it. The machine adds how long it took to handle a request by its kind, how far its work ran behind, how much memory it used and how many apps and machines were connected. The apps gather these measurements for a quarter of an hour and send what that quarter came to. Of each kind it then sends a count, or for a duration the median and the slowest one.

Usage statistics

The machine that runs your terminals and agents counts how often you used a few features each day. Once a day is over, it sends that day's totals, once. They tell me which parts of Ruimte people actually use, which is where my time should go. A day holds:

• The date, the Ruimte version, the operating system, the processor type, and whether the machine runs as a background service, beside the desktop app or on its own.
• Whether the machine is on an account, whether the day is its first of the week or the month, and the week it first ran Ruimte.
• How many projects you opened and which kinds of views, how many terminals and launches started, and how many worktree merges landed.
• How many chats and agent turns started per AI provider, per model family (such as Opus or GPT, with "other" for any model outside Ruimte's list) and per permission mode, how often a provider's limit was reached, and how often work resumed after it.
• How often agents used each of Ruimte's commands, and how many connections came from the desktop app, the iPhone app, the web app or another machine.
• How many connections opened per path (this computer, the local network, a direct connection or a relay), and how many failed per reason.
• How many voice sessions and dictations there were, and how many files you opened and saved.
• How many git commits, pushes and pulls there were and how many conflicts you resolved, and how many plans, visuals, pull request watches, database queries, started devices and tasks handed to other machines.
• A few timings, each as the day's median: how long the desktop app took to start, how long each AI provider took to its first answer, how long a terminal took to attach, and how long a connection to a machine elsewhere took.

The desktop app keeps a day of its own and sends it the same way, once the day is over. It counts what the machine never sees: which of the app's commands you gave and whether you used the menu, a keyboard shortcut or the command palette, which panels you opened, how often you opened Settings and which sections you looked at, how often the app started and opened a window, and whether it installed an update. Its day has the same date, version, operating system and processor type as the machine's, and says whether the app is signed in. A command that exists once per view, launch or agent counts under one name for all of them, so the name of your view or launch never goes out.

The iPhone app keeps a day of its own too, and sends it the same way. It counts which of its main screens you opened (such as Now, Projects, a chat, a canvas, Voice or Settings), and how many messages you sent, approvals and questions you answered, chats you started and attachments you added from the phone. Its day has the same date and version as the machine's. It also says whether it came from an iPhone or an iPad, and whether the app is signed in.

A day carries no identifier. There is no account, no install id and no key of the machine in it, and no names, paths, prompts, file contents or anything you typed. A model outside Ruimte's list is counted as "other", so its name is never sent. Observatory does not store the address a day comes from. Versions before 0.22 send their days through Ruimte's own server on Cloudflare first, which does not log the address and does not pass it on.

Usage statistics are on by default. To turn them off, open Settings in the desktop app on the computer that runs the machine, go to Account, pick the machine and switch off Usage statistics. Ruimte then deletes the days it has not sent yet. The desktop app follows the same switch, so it stops counting and deletes its own unsent days too. A desktop app that only connects to machines elsewhere has no machine of its own and sends nothing. The iPhone app counts only while every machine on your account it has heard from has the switch on. Once one of them says off, it stops and deletes its unsent days. Before it has heard from any machine it counts nothing. A build from the source code on your own computer sends nothing.