seo 0.2.5 → 0.2.7

package/PRIVACY.md

@@ -1,6 +1,6 @@
 # Privacy policy
 
-Last updated: 14 July 2026
+Last updated: 16 July 2026
 
 This policy covers the official `seo` command-line tool, library, MCP server,
 and the seoskill.dev website.
@@ -53,9 +53,46 @@ work you request. These can include Google APIs, public pages and sitemaps you
 choose to crawl, and the npm registry for package update checks. Those services
 receive ordinary request data under their own privacy policies.
 
-The CLI does not include project-controlled usage telemetry. Installing the
-package through npm or using GitHub is covered by the policies of those
-services.
+## Anonymous tool usage
+
+Anonymous usage telemetry is enabled by default with a one-time first-run
+notice. It describes use of the tool, not the site or Google data being
+analysed. Events can contain only a fixed event name, public report identifier,
+package version, detected agent category, operating system, architecture, Node
+major version, first-run ISO week, wire schema version, and a fixed error
+category for failed reports.
+
+Telemetry never contains a user ID, machine ID, UUID, fingerprint, audited
+domain, URL, hostname, page content, report content, Search Console or Google
+Analytics response, Google property ID, token, secret, file path, username,
+local hostname, raw error message, IP address, or location. The complete event
+and field catalogue is published at
+[seoskill.dev/telemetry](https://seoskill.dev/telemetry).
+
+Once-only event state stays in a private local file in the existing SEO config
+directory. The telemetry endpoint accepts only the published fixed schema and
+writes those fields to a dedicated Cloudflare D1 table. The server adds only
+the UTC receipt month, such as `2026-07`, so it can publish monthly totals
+without storing an exact request time. The table has no account or identity
+column. It does not use KV, R2, or Analytics Engine. Worker request logging is
+disabled. The ingest code does not read request IP or Cloudflare location
+fields, and neither is written to D1. Cloudflare still handles the ordinary
+network request at its edge.
+
+Disable all telemetry network calls with `seo telemetry disable`,
+`DO_NOT_TRACK=1`, `SEOSKILL_TELEMETRY_DISABLED=1`, or
+`SEO_TELEMETRY_DISABLED=1`. It is automatically disabled in common CI
+environments. Use `seo telemetry status` to inspect the effective setting and
+`seo telemetry enable` to turn the local setting back on. Environment and CI
+overrides always win.
+
+Aggregate event counts are public at
+[seoskill.dev/stats](https://seoskill.dev/stats). They are described as
+installs, active machines, and audits, never users. One person can have several
+installs, and clearing local state creates a new install.
+
+Installing the package through npm or using GitHub is covered by the policies
+of those services.
 
 The seoskill.dev website uses [Clicky](https://clicky.com/terms/privacy) to
 count visits and see which pages people use. Tracking cookies are disabled in

package/README.md

@@ -77,7 +77,7 @@ technical report before connecting Google.
 Running `seo help` shows the shape of the tool:
 
 ```txt
-seo v0.2.5
+seo v0.2.7
 
 Run SEO audits, find what needs fixing, and ship the changes with your agent.
 
@@ -386,8 +386,14 @@ paths, including OAuth testing-mode limits.
 
 Yes. Reports, project profiles, Google tokens, crawls, and caches stay in your
 local config directory. The CLI only makes the network requests needed to fetch
-your site and call the Google APIs you connect. There is no hosted backend,
-account, or telemetry service.
+your site and call the Google APIs you connect.
+
+SEO data never leaves your machine. The CLI sends anonymous usage events such
+as the event name, report id, tool version, agent, OS, architecture, Node major,
+and install week. It never sends URLs, identifiers, report data, or Google data.
+Disable telemetry with `DO_NOT_TRACK=1` or `seo telemetry disable`. Read the
+[full telemetry details](https://seoskill.dev/telemetry) and the
+[public aggregate stats](https://seoskill.dev/stats).
 
 ### Do I need a Google API key?
 
@@ -423,6 +429,8 @@ vulnerabilities privately through the process in [SECURITY.md](SECURITY.md).
 - [MCP and agents](https://seoskill.dev/docs/agents)
 - [AI-search evidence](https://seoskill.dev/docs/ai-search)
 - [Privacy policy](https://seoskill.dev/privacy)
+- [Anonymous telemetry](https://seoskill.dev/telemetry)
+- [Public usage stats](https://seoskill.dev/stats)
 - [Terms of use](https://seoskill.dev/terms)
 - [Security policy](https://seoskill.dev/security)
 - [Contributing](CONTRIBUTING.md)