Telemetry¶

photo-tagger sends a single anonymous beacon at the end of each run so development can be guided by how the tool is actually used (which models, platforms, languages, and file formats are common, and typical batch sizes). It is opt-out: on by default, with a one-time notice on the first run, and easy to disable. This page is the full disclosure: exactly what is sent, where it goes, and every way to turn it off.

What is collected¶

The beacon contains these fields, and nothing else:

Field	Example	What it is
`schema_version`	`1`	Payload format version, so the collector can branch.
`install_id`	a UUID	Random id generated once per install (see below).
`app_version`	`0.5.0`	The photo-tagger version.
`interface`	`cli` or `gui`	Which frontend ran the batch.
`provider`	`lmstudio`	The selected backend.
`model`	`qwen/qwen3-vl-30b`	The model identifier.
`batch_size`	`42`	How many photos were in the run.
`duration_seconds`	`183.5`	Wall-clock run duration.
`output_language`	`English`	Language the model writes titles, descriptions, keywords in.
`ui_language`	`pt_BR`	The resolved app interface language.
`file_types`	`cr3,jpg`	Distinct file extensions in the batch (never filenames).
`arch`	`arm64`	CPU architecture.
`os`	`Darwin`	Operating system.
`os_release`	`25.5.0`	OS release string.
`python_version`	`3.14.0`	The Python runtime version.

The install_id is a random UUID generated once and stored in the user state directory. It is not derived from any hardware identifier, so it cannot fingerprint a machine; it only lets repeated runs from the same install count as one active user over time.

What is never collected: file paths, filenames, photo contents, generated tags, titles, descriptions, prompts, API keys, IP addresses, or anything else that identifies you. The exact, closed payload is the build_payload function; there is nothing else to leak.

Where it goes¶

The collector is our own self-hosted Cloudflare Worker at telemetry.tagger.photo. It is write-only, stores no IP addresses, sets no cookies, and involves no third-party analytics service. Its full source (and the queries run against it) lives in the telemetry/ directory of the repository.

Sending happens on a background thread with a short timeout and every failure is swallowed, so telemetry can never crash, slow down, or block a tagging run.

The first-run notice¶

The first time telemetry is active, photo-tagger prints a one-time notice (the GUI shows a dismissible dialog with a one-click "Turn It Off") explaining what is collected and how to disable it. After that, it stays quiet.

How to disable it¶

Any one of these turns telemetry off:

Pass --no-telemetry on the command line.
Set PHOTO_TAGGER_NO_TELEMETRY=1 (or the cross-tool DO_NOT_TRACK=1) in your environment.
Put enabled = false under [telemetry] in your config file.
In the desktop GUI, uncheck Settings > Send Anonymous Telemetry; the choice is remembered for the next launch.

The environment variables win over everything, so exporting PHOTO_TAGGER_NO_TELEMETRY=1 once disables telemetry everywhere, including the GUI.