Merge pull request #1181 from rtk-ai/rgpd-telemetry

Author: FlorianBruniaux

Cargo.lock

@@ -28,7 +28,6 @@ chrono = "0.4"
 tempfile = "3"
 sha2 = "0.10"
 ureq = "2"
-hostname = "0.4"
 getrandom = "0.4"
 flate2 = "1.0"
 quick-xml = "0.37"

Cargo.toml

@@ -409,7 +409,7 @@ brew uninstall rtk           # If installed via Homebrew
 
 ## Privacy & Telemetry
 
-RTK collects **anonymous, aggregate usage metrics** once per day, **enabled by default**. This data helps us build a better product: identifying which commands need filters, which filters need improvement, and how much value RTK delivers. For the full list of fields, data handling, and contributor guidelines, see **[docs/TELEMETRY.md](docs/TELEMETRY.md)**.
+RTK can collect **anonymous, aggregate usage metrics** once per day. Telemetry is **disabled by default** and requires **explicit opt-in consent** (GDPR Art. 6, 7) during `rtk init` or via `rtk telemetry enable`. This data helps us build a better product: identifying which commands need filters, which filters need improvement, and how much value RTK delivers. For the full list of fields, data handling, and contributor guidelines, see **[docs/TELEMETRY.md](docs/TELEMETRY.md)**.
 
 **What is collected and why:**
 
@@ -430,14 +430,17 @@ All data is **aggregate counts or anonymized command names** (first 3 words, no
 
 **What is NOT collected:** source code, file paths, command arguments, secrets, environment variables, personal data, or repository contents.
 
-**Opt-out** (any of these):
+**Manage telemetry:**
 ```bash
-# Environment variable
-export RTK_TELEMETRY_DISABLED=1
+rtk telemetry status     # Check current consent state
+rtk telemetry enable     # Give consent (interactive prompt)
+rtk telemetry disable    # Withdraw consent — stops all collection immediately
+rtk telemetry forget     # Withdraw consent + delete all local data + request server-side erasure
+```
 
-# Or in config file (~/.config/rtk/config.toml)
-[telemetry]
-enabled = false
+**Override via environment:**
+```bash
+export RTK_TELEMETRY_DISABLED=1   # Blocks telemetry regardless of consent
 ```
 
 ## Star History

README.md

@@ -1,6 +1,11 @@
 # Telemetry
 
-RTK collects anonymous, aggregate usage metrics once per day to help improve the product. Telemetry is **enabled by default** and can be disabled at any time.
+RTK collects anonymous, aggregate usage metrics once per day to help improve the product. Telemetry is **disabled by default** and requires explicit consent during `rtk init` or `rtk telemetry enable`.
+
+## Data Collector
+
+**Entity**: `RTK AI Labs`
+**Contact**: contact@rtk-ai.app
 
 ## Why we collect telemetry
 
@@ -29,7 +34,7 @@ This data directly drives our roadmap. For example, if telemetry shows that 40%
 
 | Field | Example | Purpose |
 |-------|---------|---------|
-| `device_hash` | `a3f8c9...` (64 hex chars) | Count unique installations. Salted SHA-256 of hostname + username with a per-device random salt stored locally (`~/.local/share/rtk/.device_salt`). Not reversible. |
+| `device_hash` | `a3f8c9...` (64 hex chars) | Count unique installations. SHA-256 of a per-device random salt stored locally (`~/.local/share/rtk/.device_salt`). Not reversible. No hostname or username included. |
 
 ### Environment
 
@@ -109,32 +114,62 @@ This data directly drives our roadmap. For example, if telemetry shows that 40%
 - Secrets, API keys, or environment variable values
 - Repository names or URLs
 - Personally identifiable information
-- IP addresses (not logged server-side)
+- IP addresses (not stored in telemetry pings; stored temporarily in erasure audit log for accountability, anonymized after 6 months)
 
-## Opt-out
+## Consent
 
-Telemetry can be disabled instantly with either method:
+Telemetry requires explicit opt-in consent (GDPR Art. 6, 7). Consent is requested during `rtk init` or via `rtk telemetry enable`. Without consent, no data is sent.
 
 ```bash
-# Environment variable (per-session or in shell profile)
-export RTK_TELEMETRY_DISABLED=1
+rtk telemetry status     # Check current consent state
+rtk telemetry enable     # Give consent (interactive prompt)
+rtk telemetry disable    # Withdraw consent
+rtk telemetry forget     # Withdraw consent + delete local data + request server erasure
+```
 
-# Or permanently in config file
-# ~/.config/rtk/config.toml
-[telemetry]
-enabled = false
+Environment variable override (blocks telemetry regardless of consent):
+```bash
+export RTK_TELEMETRY_DISABLED=1
 ```
 
-When disabled, `rtk init` shows `[info] Anonymous telemetry is disabled`. No data is sent, no background thread is spawned, no network requests are made.
+## Retention Policy
+
+- **Server-side**: telemetry records are retained for a maximum of **12 months**, then automatically purged (periodic task every 24 hours).
+- **Server-side (erasure log)**: IP addresses in the erasure audit log are **anonymized after 6 months** (GDPR — IP is personal data).
+- **Client-side**: the local SQLite database (`~/.local/share/rtk/tracking.db`) retains data for **90 days** by default (configurable via `tracking.history_days` in `config.toml`). Deleted entirely by `rtk telemetry forget`.
 
-## Data handling
+## Your Rights (GDPR)
+
+Under the EU General Data Protection Regulation, you have the right to:
+
+- **Access** your data: `rtk telemetry status` shows your device hash; the telemetry payload is fully documented above.
+- **Rectification**: since data is anonymous and aggregate, rectification is not applicable.
+- **Erasure** (Art. 17): run `rtk telemetry forget` to delete local data and send an erasure request to the server. Alternatively, email contact@rtk-ai.app with your device hash.
+- **Restriction of processing**: `rtk telemetry disable` stops all data collection immediately.
+- **Portability**: the local SQLite database at `~/.local/share/rtk/tracking.db` contains all locally stored data.
+- **Objection**: `rtk telemetry disable` or `export RTK_TELEMETRY_DISABLED=1`.
+
+## Erasure Procedure
+
+1. Run `rtk telemetry forget` — this disables telemetry, deletes your device salt, ping marker, and local tracking database (`history.db`), then sends an erasure request to the server.
+2. If the server is unreachable, the CLI prints your full device hash and fallback instructions to email contact@rtk-ai.app for manual erasure.
+3. You can also email contact@rtk-ai.app directly to request manual erasure.
+
+## Data Handling
 
 - Telemetry endpoint URL and auth token are injected at **compile time** via `option_env!()` — they are not in the source code
-- The server is hosted on GCP Cloud Run with TLS
+- All communications use HTTPS (TLS)
 - Data is used exclusively for RTK product improvement
 - No data is sold or shared with third parties
 - Aggregate statistics may be published (e.g. "70% of RTK users are on macOS")
 
+### Server-side Requirements
+
+The telemetry server must implement:
+- `POST /erasure` endpoint accepting `{"device_hash": "...", "action": "erasure"}`, authenticated via `X-RTK-Token`
+- Automatic periodic purge of telemetry records older than 12 months
+- Audit log for erasure requests (GDPR Art. 17(2) accountability) with IP anonymization after 6 months
+
 ## For contributors
 
 The telemetry implementation lives in `src/core/telemetry.rs`. Key design decisions:

docs/TELEMETRY.md

@@ -1322,7 +1322,9 @@ max_files = 20              # Rotation : garder les N derniers fichiers
 # directory = "/custom/tee/path"  # Chemin personnalise (optionnel)
 
 [telemetry]
-enabled = true              # Telemetrie anonyme (1 ping/jour, opt-out possible)
+enabled = false             # Telemetrie anonyme (1 ping/jour, requiert consentement)
+# consent_given = true      # Defini automatiquement par `rtk init` ou `rtk telemetry enable`
+# consent_date = "..."      # Date du consentement (RFC 3339)
 
 [hooks]
 exclude_commands = []       # Commandes a exclure de la recriture automatique
@@ -1371,21 +1373,26 @@ FAILED: 2/15 tests
 
 ## Telemetrie
 
-RTK envoie un ping anonyme une fois par jour (23h d'intervalle) pour des statistiques d'utilisation.
+RTK peut envoyer un ping anonyme une fois par jour (23h d'intervalle) pour des statistiques d'utilisation. La telemetrie est **desactivee par defaut** et requiert un consentement explicite (RGPD Art. 6, 7).
 
-**Donnees envoyees :** hash de device, version, OS, architecture, nombre de commandes/24h, top commandes, pourcentage d'economies.
+**Donnees envoyees :** hash de device (SHA-256 d'un sel aleatoire), version, OS, architecture, nombre de commandes/24h, top commandes, pourcentage d'economies.
 
-**Desactiver :**
+**Responsable du traitement :** `RTK AI Labs`, contact@rtk-ai.app
+
+**Gerer la telemetrie :**
 ```bash
-# Via variable d'environnement
-export RTK_TELEMETRY_DISABLED=1
+rtk telemetry status     # Voir l'etat du consentement
+rtk telemetry enable     # Donner son consentement (prompt interactif)
+rtk telemetry disable    # Retirer son consentement
+rtk telemetry forget     # Retirer + supprimer donnees locales + demande d'effacement serveur
+```
 
-# Via config.toml
-[telemetry]
-enabled = false
+**Desactiver via variable d'environnement :**
+```bash
+export RTK_TELEMETRY_DISABLED=1
 ```
 
-Aucune donnee personnelle, aucun contenu de commande, aucun chemin de fichier n'est transmis.
+Aucune donnee personnelle, aucun contenu de commande, aucun chemin de fichier n'est transmis. Conservation serveur : 12 mois max. Details : [docs/TELEMETRY.md](../TELEMETRY.md)
 
 ---
 

docs/usage/FEATURES.md

@@ -539,7 +539,7 @@ let _ = conn.execute(
 ## Security & Privacy
 
 - **Local storage only**: Tracking database never leaves the machine
-- **Telemetry enabled by default**: RTK sends a daily anonymous usage ping (version, OS, command counts, token savings). Device identity is a salted SHA-256 hash. Opt out with `RTK_TELEMETRY_DISABLED=1` or `[telemetry] enabled = false` in `~/.config/rtk/config.toml`
+- **Telemetry requires consent**: RTK can send a daily anonymous usage ping (version, OS, command counts, token savings). Disabled by default, requires explicit consent via `rtk init` or `rtk telemetry enable`. Manage with `rtk telemetry status/disable/forget`. Override: `RTK_TELEMETRY_DISABLED=1`
 - **User control**: Users can delete `~/.local/share/rtk/tracking.db` anytime
 - **90-day retention**: Old data automatically purged
 

docs/usage/TRACKING.md

@@ -88,15 +88,13 @@ impl Default for FilterConfig {
     }
 }
 
-#[derive(Debug, Serialize, Deserialize)]
+#[derive(Debug, Default, Serialize, Deserialize)]
 pub struct TelemetryConfig {
     pub enabled: bool,
-}
-
-impl Default for TelemetryConfig {
-    fn default() -> Self {
-        Self { enabled: true }
-    }
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub consent_given: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub consent_date: Option<String>,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -130,11 +128,6 @@ pub fn limits() -> LimitsConfig {
     Config::load().map(|c| c.limits).unwrap_or_default()
 }
 
-/// Check if telemetry is enabled in config. Returns None if config can't be loaded.
-pub fn telemetry_enabled() -> Option<bool> {
-    Config::load().ok().map(|c| c.telemetry.enabled)
-}
-
 impl Config {
     pub fn load() -> Result<Self> {
         let path = get_config_path()?;
@@ -220,4 +213,39 @@ history_days = 90
         let config: Config = toml::from_str(toml).expect("valid toml");
         assert!(config.hooks.exclude_commands.is_empty());
     }
+
+    #[test]
+    fn test_old_toml_without_consent_fields() {
+        let toml = r#"
+[telemetry]
+enabled = true
+"#;
+        let config: Config = toml::from_str(toml).expect("valid toml");
+        assert!(config.telemetry.enabled);
+        assert!(config.telemetry.consent_given.is_none());
+        assert!(config.telemetry.consent_date.is_none());
+    }
+
+    #[test]
+    fn test_telemetry_default_disabled() {
+        let config = Config::default();
+        assert!(!config.telemetry.enabled);
+        assert!(config.telemetry.consent_given.is_none());
+    }
+
+    #[test]
+    fn test_telemetry_consent_roundtrip() {
+        let toml = r#"
+[telemetry]
+enabled = true
+consent_given = true
+consent_date = "2026-04-10T12:00:00Z"
+"#;
+        let config: Config = toml::from_str(toml).expect("valid toml");
+        assert_eq!(config.telemetry.consent_given, Some(true));
+        assert_eq!(
+            config.telemetry.consent_date.as_deref(),
+            Some("2026-04-10T12:00:00Z")
+        );
+    }
 }

src/core/config.rs

@@ -7,6 +7,7 @@ pub mod filter;
 pub mod runner;
 pub mod tee;
 pub mod telemetry;
+pub mod telemetry_cmd;
 pub mod toml_filter;
 pub mod tracking;
 pub mod utils;

src/core/mod.rs

@@ -28,8 +28,20 @@ pub fn maybe_ping() {
         return;
     }
 
+    // Load config once (avoid double disk read)
+    let cfg = match config::Config::load() {
+        Ok(c) => c,
+        Err(_) => return,
+    };
+
+    // RGPD: require explicit consent before any telemetry
+    match cfg.telemetry.consent_given {
+        Some(true) => {}
+        Some(false) | None => return,
+    }
+
     // Check opt-out: config.toml
-    if let Some(false) = config::telemetry_enabled() {
+    if !cfg.telemetry.enabled {
         return;
     }
 
@@ -140,21 +152,10 @@ fn send_ping() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
-fn generate_device_hash() -> String {
+pub fn generate_device_hash() -> String {
     let salt = get_or_create_salt();
-    let hostname = hostname::get()
-        .map(|h| h.to_string_lossy().to_string())
-        .unwrap_or_default();
-    let username = std::env::var("USER")
-        .or_else(|_| std::env::var("USERNAME"))
-        .unwrap_or_default();
-
     let mut hasher = Sha256::new();
     hasher.update(salt.as_bytes());
-    hasher.update(b":");
-    hasher.update(hostname.as_bytes());
-    hasher.update(b":");
-    hasher.update(username.as_bytes());
     format!("{:x}", hasher.finalize())
 }
 
@@ -204,7 +205,7 @@ fn random_salt() -> String {
     })
 }
 
-fn salt_file_path() -> PathBuf {
+pub fn salt_file_path() -> PathBuf {
     dirs::data_local_dir()
         .unwrap_or_else(|| PathBuf::from("/tmp"))
         .join("rtk")
@@ -430,7 +431,7 @@ fn install_method_from_path(path: &str) -> &'static str {
     }
 }
 
-fn telemetry_marker_path() -> PathBuf {
+pub fn telemetry_marker_path() -> PathBuf {
     let data_dir = dirs::data_local_dir()
         .unwrap_or_else(|| PathBuf::from("/tmp"))
         .join(RTK_DATA_DIR);