Privacy-safe telemetry

When enabled, dexgate may record a small set of product signals (for example: that a free risk check ran, or that a paid workspace produced its first governed decision). CLI telemetry is off unless you opt in. We do not collect source code, secrets, claim tokens, shell transcripts, or raw policy evidence.

This page describes what may be sent when site analytics or CLI opt-in is enabled.

Principles

No source code, shell transcripts, secrets, tokens, claim codes, action payloads, raw policy evidence, or customer file paths.
CLI: off unless DEXGATE_TELEMETRY_OPT_IN=1 (or DEXGATE_TELEMETRY=1).
Adapter POSTs require header X-Dexgate-Telemetry-Opt-In: true.
Identifiers are optional anonymous install IDs or hashed tenant/gateway strings — never raw secrets or claim tokens.
Claim tokens are never transmitted to analytics, telemetry, logs, referrer headers, or third-party scripts. Claim pages use an opaque random analytics event_id that cannot be converted back into the claim URL.

Paid-activation funnel (DG-GTM-001)

The commercial funnel is measured end-to-end so activation—not just Stripe starts—drives optimization:

Free risk check completed
Claim result viewed
Workspace created
Plan selected
Stripe checkout started
Purchase completed
Runtime healthy
First governed decision
Second governed decision on another day
30-day retained workspace

Critical commercial metric: percentage of paid workspaces reaching first_governed_decision within 24 hours, 7 days, and 30 days of purchase.

Events we may record (site + CLI)

Event	Where	When	Payload (allowed)
`install` / free start CTA	site	Click free risk check / get started	page_path, utm_*, label
`local-hardening-check` / `local_hardening_check`	CLI	First free assess completes	status, mode, source, anonymous_install_id
`decision_category` (metadata)	CLI	With free check	first_check \| high_risk_blocked \| read \| edit \| shell_readonly
`high-risk-blocked`	CLI	Free mode blocks git push-class action in assess	decision=deny, reasonCode, status, mode, source
`claim_view`	site	Open a claim page	event_id (random), page_type=claim
`workspace_created`	site	Magic-link creates a new workspace	plan (if intended), billing_cycle, org_hash
`plan_selected`	site	Buyer selects Production/Team for checkout	plan, billing_cycle
`checkout_started`	site	Stripe Checkout session created	plan, billing_cycle
`trial_start_click`	site	Paid pilot CTA after free value	label, page_path (claim paths redacted)
`completed_purchase`	site	Checkout success / provisioning	plan, billing_cycle, days_from_free_start
`runtime_downloaded`	site	Console runtime bundle download	plan, source=console_downloads
`runtime_healthy`	runtime / CLI	First healthy machine heartbeat (or CLI signal)	plan, source=heartbeat
`first_governed_decision`	CLI + site	First paid governed check succeeds (opt-in CLI)	governed=true, mode, tenantHash (hashed), status
`second_governed_decision`	CLI	Governed check on a later calendar day	governed=true, mode, tenantHash
`first_evidence_viewed`	site	Console evidence section / export	plan, source=console_evidence
`seven_day_active` / `thirty_day_active`	site	Paid workspace used after 7 / 30 days	window
`pilot_application_started` / `pilot_application_completed`	site	Founding pilot form view / submit	source=founding_teams

CLI opt-in

set DEXGATE_TELEMETRY_OPT_IN=1
npx --yes --package=@dexgate/openclaw-trusted-mode dexgate-assess
# After paid configure: openclaw-trusted-mode-check emits first_governed_decision when ENFORCED_OK

Endpoint: POST https://dexgate.ai/api/telemetry/adapter-events/

What we never collect

Source files, diffs, or repository contents
Environment secrets, API keys, PDP tokens, customer credentials
Claim codes / claim URL path segments (bearer access to free-decision results)
Full shell history or action payloads
Raw policy evidence documents
Personal emails from the free assess CLI

See also Privacy and Compatibility matrix.