Skip to content

Anonymous per-instance usage counter (no personal data) #822

Description

@gnacho

Context

NetPulse deliberately has no accounts and no telemetry. That is part of the pitch (self-hosted, no cloud, sovereignty). But it also means there is no way to know how many instances are actually running and updating.

Today the only signals are indirect and weak:

  • GitHub release asset downloads (installs/updates) and repo Insights traffic.
  • The announcement feed request log (netpulse.cloudless.club/announcements.json), which is polluted by bursty clients (hundreds of requests in 2-3 minutes from single IPs) and therefore unusable as a census.

Proposal

An anonymous, aggregate per-instance counter:

  • Each instance generates a random installation id once (UUID, stored in kv) and sends a daily ping with only: the random id, the app version and the OS/arch. Nothing else.
  • The receiver counts distinct ids per day (aggregate only) so it can report "active instances (daily/weekly)".
  • The aggregate can be published on a public stats page, consistent with the project's transparency.

Hard privacy constraints

  • No IPs stored (the receiver must not persist the client IP; use it only for the request, no logging).
  • No personal or network data: never MACs, hostnames, SSIDs, router counts, device counts, geolocation or usernames.
  • No cookies, no fingerprinting; the id is random and local.
  • The ping is fire-and-forget and must never affect app behaviour (fail-silent, like the announcements fetch).
  • Documented in the README, with a single env switch to disable it (e.g. NETPULSE_TELEMETRY=0).
  • Open question: default on (max data, documented opt-out) vs default off (opt-in, low adoption). Decide explicitly and document the choice.

Acceptance criteria

  • Daily anonymous ping with a local random id; aggregate distinct-id count exposed.
  • No IP or personal/network data stored anywhere.
  • Disable via env var; fail-silent.
  • Documented in README (what is sent, why, how to disable).
  • Test covering that the payload contains only id/version/os-arch and that disabling stops the ping.

Notes

This is a product/philosophy decision as much as a technical one; keep the payload minimal and the docs honest. As a lighter alternative, the existing 6h announcement fetch could carry a random id as a query param so the feed host counts unique ids without a new endpoint, but that only counts feed-fetching instances.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions