Telemetry

What the browser terminal sends, what it never sends, and how to turn it off.

st sends anonymous usage from the browser terminal page. It is on by default, and one line turns it off.

st --no-telemetry          # this run
SOPHONZ_TELEMETRY=off      # every run on this machine

To send to your own collector instead, change where and under what key.

SOPHONZ_TELEMETRY_URL=https://otel.example.com
SOPHONZ_TELEMETRY_KEY=...     # empty means nothing is sent at all

It covers what a signed-in machine reports too. With an account, the heartbeat to the control plane also carries the machine's health (memory, st's own processes, whether the multiplexer answers, how many terminals are in use), its last 30 seconds of CPU, memory and swap, and the coding agents' plan usage (percentages and reset times). The same switch turns those off, and leaves /api/health empty.

Turning it off covers every browser that joins that machine. The page is told by the agent, so nobody you share the link with has to do anything. With no collector and no key the page never loads the SDK at all.

Sent data

Pageloads, Web Vitals, the path (anything after ? or # is cut off)
ErrorsJavaScript exceptions and their stacks
Requestshow long same-origin requests took
Browsername, version, platform, language, mobile or not, screen size
Versionthe st version
Sessiona random 128-bit id (__sophonz_rum_sid cookie, SameSite=Strict)

The session id expires after 15 minutes without activity and never lasts more than four hours. It belongs to one visit rather than to a person or a machine, and it is not tied to an account.

Excluded data

What is in the terminal does not leave the browser. That is fixed in the page's own source (web/src/telemetry.ts in sophonz-tunnel-go) rather than decided by the agent:

  • no session replay, no screen recording
  • no console output
  • no clicks or taps (a click is recorded with the text of what was clicked, and on this page that is the terminal)
  • no request or response bodies, and no WebSocket traffic — the WebSocket is the terminal
  • no page title (the terminal's title is the running command and the working directory)
  • every input and every piece of text masked
  • no trace headers on requests to any other origin

Anything after ? or # is cut off the URL, because that is where a join token would be.

Default setting

A bug that only happens in a phone browser does not happen here. A key bar that breaks on iOS 18, a font that does not attach in one Android WebView — there is no way to know unless someone tells us.

The first time st runs it says so, and says how to turn it off.