> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/policy-control-and-incident-response/privacy-safe-product-telemetry.md). # Privacy-safe product telemetry ## Purpose and authority boundary NYTSHIFT records coarse product-flow and browser-failure aggregates only after the customer enables product telemetry in Settings. Telemetry is diagnostic and advisory. It cannot submit, confirm, cancel, reconcile or establish the finality of an order, transfer or signature. ## Accepted schema The browser may send only schema version `1`, one fixed event name, coarse route group, capability, venue, result, fixed uppercase reason code, build release and client occurrence time. The server groups accepted events into hourly counters. Unknown fields or invalid enum values fail closed. Accepted event names are `route_view`, `capability_blocked`, `client_error`, `reconcile_opened` and `paper_review_started`. ## Prohibited data Wallet addresses, account IDs, order IDs, client order IDs, proposal text, credentials, secrets, tokens, session or user identifiers, URLs, query strings, free-form messages, stack traces, request or response bodies and raw provider data are prohibited. The exact-field parser rejects additions instead of attempting best-effort redaction. ## Consent, retention and deletion Telemetry is disabled by default. The consent toggle is stored only in the bounded versioned browser preference store and can be revoked or reset from Settings. Server aggregates are retained for seven days, pruned on read/write, capped at 2,048 aggregate keys and contain no customer identifier, so an aggregate cannot be selectively attributed to a person. Revoking consent prevents new browser events; existing anonymous counters age out under the seven-day policy. ## Operator dashboard Authenticated operators can inspect `/ops/observability`. The dashboard validates the response contract before rendering and shows 24-hour execution outcomes, operation-level counts and latency, provider freshness, incident-delivery backlog and at most 200 consented aggregate rows. It never renders raw recent event details. ## Incident response If a prohibited field is discovered, disable product telemetry collection, preserve the fixed reason code and release only, rotate any credential that may have appeared, delete the affected telemetry store or process state, and open a security incident. Do not copy the sensitive value into tickets, chat or the incident summary. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://nytshift.gitbook.io/nytshift-docs/policy-control-and-incident-response/privacy-safe-product-telemetry.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.