Telemetry & Privacy

OrchStep performs a lightweight update check so it can tell you when a newer version is available or when your version has a known security advisory. It is designed to respect your privacy: it does not track you.

What it does

After a command finishes successfully, and at most once every 48 hours (throttled by a local cache file at ~/.orchstep/update_check.json), OrchStep makes one short HTTPS request to orchstep.dev/api/pulse. The response tells it the latest version and any security advisories, which it uses to print a notice:

• A newer version is available → it prints the install link so you can update however you prefer. OrchStep never updates itself and never blocks you from running an older version.
• Your version has a security advisory → it prints a louder notice with a link.

If you are up to date and unaffected, it prints nothing.

What it sends

Only non-identifying information:

• the OrchStep version,
• the operating system and architecture (e.g. darwin/arm64),
• a flag indicating whether it is running in CI.

That's it. It sends no personal data, no install/device id, no MAC or hardware id, no username, and no workflow content. The server derives a coarse country from the network connection for aggregate counts and does not store your IP address. There is nothing that identifies you or correlates your runs over time.

What it does NOT do

• It does not track individual users.
• It does not auto-update or replace the binary.
• It does not block, disable, or "deprecate" old versions. If it can't reach the server, your command runs normally (fail-open).
• It does not run on un-released/development builds, and it never prints into CI logs or pipes.

Turning it off

Set either environment variable and OrchStep will never contact the server:

export ORCHSTEP_NO_UPDATE_CHECK=1
# OrchStep also honors the cross-tool convention:
export DO_NOT_TRACK=1

In CI you'll usually want this in your environment if you'd rather OrchStep make no outbound request at all.