​

Telemetry

npx claude-mem telemetry disable

​

How instrumentation works

• The local logger — always, at full fidelity. Logging keeps working with telemetry off, and the local log never goes through the scrubber. This is where the complete, unredacted detail lives — on your machine.
• Telemetry — only when consent passes. The telemetry copy is scrubbed (the whitelist for structured properties; allow-then-redact for error text) and, for high-volume events, rolled up into per-session/per-window aggregates before anything is sent.

​

What is collected

• observer_turn_rollup — a per-session accumulator. Every compression in a session folds into one running rollup that is emitted once, at session end (instead of one session_compressed event per turn). It carries a rollup_reason explaining why it flushed (session_end | worker_shutdown | safety_flush) and a window_seq partial-flush counter (0 for a normal one-shot session; 0,1,2,… only when a long-lived session trips the periodic safety sweep).
• context_injected_rollup — a 5-minute time-window accumulator for context injections.

​

Events

​

Error tracking

• The error type (constructor name, e.g. TypeError), capped to 100 chars.
• The error message, redacted and capped to 500 chars.
• The stack trace — only the top 10 frames, each redacted, capped to ~2KB total.
• An occurrence_count (how many times this error fingerprint fired in the current window).

• Home directory (/Users/you → ~) — first, so a username embedded in the home path never survives.
• Absolute filesystem paths → collapsed to basename (POSIX, Windows drive, and UNC paths) — keeps “which file” without the directory tree.
• URL / connection-string credentials and query strings — userinfo (user:pass@) and ?…/#… are stripped from any scheme://… (http, ws, postgres, redis, mongodb+srv, amqp, …), so DB connection-string creds and signed-URL tokens die.
• Emails.
• API tokens and keys: provider-prefixed keys (sk-, phc_, ghp_, xoxb-, …), Bearer tokens, AWS access key IDs (AKIA…), JWTs, UUIDs, long hex blobs (24+ chars), and generic high-entropy tokens.
• IPv4 addresses (internal IPs/hostnames that leak in network errors).

​

Historical backfill

• It runs once. A completion marker (backfill.json in the claude-mem data directory) is written after a successful send and prevents the backfill from ever running again. Until a run succeeds, no marker is written, so a failed attempt simply retries on the next worker start.
• It honors the exact same consent gates as live telemetry — DO_NOT_TRACK, CLAUDE_MEM_TELEMETRY=0, and enabled: false in telemetry.json all block it, and debug mode prints the would-be payload without sending.
• Opting out before the first worker start after upgrading prevents it entirely. Nothing is sent and no marker is written while you are opted out — though if you opt back in later, the backfill will then run.
• Location is upload-time, not historical. The coarse location PostHog derives at ingestion (see above) reflects where the events were uploaded from, not where you were on the historical dates they describe.

​

What is NEVER collected

​

How to opt out (four ways)

1. DO_NOT_TRACK — the universal opt-out. Set DO_NOT_TRACK=1 and telemetry is forced off, overriding everything else.
2. CLAUDE_MEM_TELEMETRY=0 (also false / off) — environment override. (CLAUDE_MEM_TELEMETRY=1 conversely forces it on.)
3. Telemetry config file — enabled: false in telemetry.json (see below).
4. CLI command:
   npx claude-mem telemetry disable
   

​

Error tracking opt-out (independent)

CLAUDE_MEM_TELEMETRY_ERRORS=0   # also accepts 'false' / 'off'

npx claude-mem telemetry status

​

Debug mode

CLAUDE_MEM_TELEMETRY_DEBUG=1

​

Where the config lives

• Default: ~/.claude-mem/telemetry.json
• Or $CLAUDE_MEM_DATA_DIR/telemetry.json if you’ve overridden the data dir

{
  "enabled": false,
  "installId": "<random UUID>",
  "decidedAt": "2026-06-09T21:00:00.000Z"
}