Privacy, telemetry & the community pulse

No personally-identifiable information is ever collected — region-only, and the IP is dropped at the edge. That is the whole promise, and everything below is just detail on how it is kept.

One exception is worth stating up front: if you opt into browser peer-to-peer sharing on the website, peers exchange IP addresses directly with each other, as any peer-to-peer connection does. We never collect or store them, but we cannot hide them from your peers. This is off unless you turn it on, and revocable from the footer toggle on any page. See P2P distribution.

By default, a solnix machine phones home to no one. Participation in the community pulse is something you turn on deliberately; the default is silence.

What is and isn’t collected

Nothing is collected unless you opt in (see the master switch below). When you do, every event carries only: the event kind, the package attribute(s) and architecture, a coarse region (country + admin area + postal-prefix, roughly ZIP-equivalent), a day-bucket timestamp, and a rotating anonymous nonce (explained below).

The event kinds are:

Platform census — active-machine count by host kind (arch, illumos flavor, VM / bare-metal / zone), by region. “How many people, on what kind of host.”
Packages in daily use — the set of packages a machine actively uses (hashed attr set + arch + region), reported once per day.
Package installed — install events (package + arch + region).
Package seeding — a machine offering its built solnix packages to the BitTorrent swarm reports what it can seed (package + arch + region), so the swarm view is real.

What is never collected: no name, no phone number, no IP address, no MAC address, no hostname, no machine ID. No raw events are ever exposed — only aggregates (see k-anonymity below).

The `solnix.privacy.enable` master switch

One switch governs everything. It defaults to true, which means fully private — no phone-home:

Note the inversion — this reads backwards. solnix.privacy.enable = true (the default) means NO data is sent. To join the community pulse you set it to false. Setting enable = false turns telemetry on, not off. We know this is a footgun; a positively-named solnix.telemetry.enable (default false) is planned to replace it.

solnix.privacy.enable = true;   # DEFAULT: fully private, phone-home OFF

A machine whose config never touches this stays completely private. Nothing is sent, nothing is shared.

To opt into the community pulse, set it to false. The individual features then default on, and you can pare any of them back:

solnix.privacy.enable = false;        # opt into the community pulse

# with privacy off, these default true — override any individually:
solnix.telemetry.enable          = true;   # group: all phone-home
solnix.telemetry.census.enable   = true;   #   platform / active-user census
solnix.telemetry.packages.enable = true;   #   transferred / installed / in-use
solnix.cache.seed.enable         = true;   # P2P: seed built packages (BitTorrent)
solnix.site.p2p.enable           = true;   # P2P: browser WebRTC site sharing

The effective rule, in plain language: a feature is active only when the master switch is off and its group is on and the feature itself is on — (not privacy.enable) && telemetry.enable && <feature>.enable. The master switch always wins. Someone who never touches config is fully private; someone who opts in gets everything, then can turn off any piece.

See Peer-to-peer distribution for cache.seed and site.p2p.

How the anonymity works

Region at the edge, IP dropped. The ingest service resolves your IP to a coarse region and then discards the IP immediately. The IP never touches storage or logs.
Rotating per-day nonce. Same-day duplicate events are collapsed using a nonce that rotates every day and is not persisted beyond that day’s dedup. It is never a stable identifier — there is nothing to correlate you across days.
k-anonymity. Every public aggregate suppresses any bucket smaller than k = 5. If a region or host kind has too few machines to be anonymous, it simply isn’t shown.
Aggregates only. The public views are Datalog aggregate counts. No raw event is ever exposed.

The wire format is EDN, posted to https://search.solnix.io/telemetry.

Why opt in

The default is private, and that is respected — no one is defaulted in silently. But there is an honest reason to participate: a visible, growing, active community is the return solnix gives back to the people who run it. Census data is what makes the pulse real — it shows that solnix is alive, which packages people actually use, and where the project is growing. That signal is self-reinforcing: a community that can see itself attracts more people, more builders, more architectures. Opting in is how you add yourself to that picture. Staying private is entirely fine too.

Where to see the results

The community dashboard: solnix.io/pulse.html — active machines, a coarse regional heatmap, top packages, swarm size, and growth over time.
Package popularity surfaces in search: search.solnix.io.

Keyboard shortcuts