Somewhere in the last fifteen years the industry decided that shipping software without a phone-home channel was the eccentric choice, and the decision happened so gradually that most teams now add an analytics SDK before they add a settings screen, not because anyone asked for one but because the checklist says so. We looked at that checklist when we started shipping and asked the only question that matters: what would we actually do with the data, and the honest answer was “look at a dashboard occasionally and feel informed,” which is not a reason to run a surveillance pipe inside somebody else’s machine, so every VisorCraft project, the GPL desktop apps and the closed-source MongrelDB alike, ships with no telemetry, no event hooks, no “anonymous usage stats,” and no opt-out switch, because there is nothing to opt out of.
The opt-out switch is the tell, by the way, because a toggle that defaults to on is not a choice offered to the user, it is a decision made by the vendor with a courtesy knob attached, and the entire industry understands this perfectly well, which is exactly why the defaults are what they are.
What “no telemetry” means in code, not in a policy page
It is easy to say “we respect your privacy” on a landing page, and it means roughly nothing, so let me be concrete about what the constraint looks like in the source. In Mongrel, our database workbench, there is a module literally called telemetryStore, which sounds like exactly the thing this post claims we do not have, until you read it: it is a ring buffer of at most 500 diagnostic events, held in memory, run through a redaction pass, and written to a local log panel so the user can see what the app just did, and there is no fetch, no endpoint constant, no code path that transmits a single byte of it anywhere, because the module exists for the person sitting at the keyboard and not for us. That is the distinction the industry deliberately blurs: a local diagnostic log is a tool the user owns, telemetry is a pipe the vendor owns, and calling the first one by the second one’s name does not make them the same thing.
The same shape holds everywhere else we ship. SpiderTypes, the typing game for kids, keeps its progress in localStorage and has no backend at all, so there is no server that could receive an event even if someone wrote the code to send one. Foxden manages Firefox workspaces through the browser’s own storage and, if you sign into it, Firefox’s own sync service, which is a distinction worth one clause: that data transits Mozilla’s infrastructure under the user’s own account by the user’s own choice, which is user-owned sync, not vendor telemetry, and none of it ever touches a server of ours. MongrelDB, the closed-source engine, has no analytics SDK linked in, no usage beacon in the daemon, and no “phone home on first run” courtesy call. The verification story differs by artifact and it is worth keeping the two separate: for the open-source apps you can read the source and confirm no transmit path exists, which is a code-level proof, while for the closed-source engine the check you can run yourself is behavioral, so put MongrelDB behind a firewall that logs egress and watch what it sends, which is nothing beyond the connections you asked it to make, because a database workbench obviously talks to the databases you point it at and the honest guarantee is not “the network tab stays empty” but “there is no unexplained egress,” and an egress log with no unexplained connections is a much stronger guarantee than any privacy policy paragraph ever written.
This is also why we do not offer the toggle. The moment telemetry exists, it needs a consent banner, a data-retention policy, a subprocessors list, a GDPR story, and a small permanent tax on every user interface and every legal review, and all of that machinery exists to manage a liability we simply declined to create, which turns out to be the cheapest compliance strategy available: you cannot mishandle data you never collected, and you cannot breach a database you never built.
What we gave up, said out loud
The honest cost is that we fly blind in ways our competitors do not, and pretending otherwise is how posts like this turn into marketing. We do not know which features get used daily and which get opened once and abandoned, we do not know where users drop off during onboarding, we cannot tell you our activation funnel conversion to two decimal places, and when someone files a bug we cannot pull up their session and see what they clicked, which means our support process starts with “what did you do” like it is 2003, because it is. Product analytics genuinely answers real questions, and the teams that collect it are not stupid; we just decided the questions were not worth the pipe.
What we get in return is a forcing function that turned out to be worth more than the dashboard. When you cannot measure usage from afar, the only feedback channels left are the loud ones: GitHub issues, direct email, and people telling you a feature is confusing because they cared enough to say so, and that bias toward motivated feedback means we hear from the people the product actually matters to, in their own words, with context no event stream carries. It also means every feature has to justify itself by being good rather than by moving a metric, which sounds like a slogan until you have watched a team keep a bad feature alive for two years because the engagement number went up, and we never have that meeting, because there is no number.
And there is a second return that only shows up at sales time: when a prospective customer asks “what do you collect,” the answer is “nothing, and here is the source for the open parts and the egress log for the closed one,” which ends the conversation in one sentence instead of starting a procurement review, and in 2026, with every IT department running a data-privacy checklist, “we collect nothing” closes faster than “we collect a little, responsibly.”
The modern equivalent of an old default
None of this is new, and that is rather the point. The software I grew up on, the VB6 utilities and the shareware that shipped on magazine cover discs, could not phone home because half the machines it ran on were not connected to anything, and telemetry as a default arrived only when always-on internet made it free, which means it was never a product decision so much as an ambient capability that nobody bothered to refuse. We bothered. The modern equivalent of that old disconnected default is not nostalgia, it is a sizing decision: the failure domain of “software that never talks to us” contains no privacy incident, no consent fatigue, and no moment where a user runs Wireshark and discovers what the app really does, because what it really does is nothing, and in a decade when every week brings another breach notification email, nothing is a feature with a genuinely excellent track record.