PostHog Cloud US
The app sends events to us.i.posthog.com. PostHog stores them under the project's configured retention settings and publishes its privacy notice.
Privacy
Secrets stay local. Product metrics leave the Mac.
Automic Vault stores Secrets and Authorization History on your Mac. Release builds send a small set of product metrics to PostHog, and this website uses Google Analytics.
Last updated: August 9, 2026
The app does not send Secrets, Secret Names, commands, paths, Findings, or Authorization History. It does send pseudonymous usage events and Mac characteristics so we can see which parts of the product people use and which systems we need to support.
Mac app
Release builds send product metrics to PostHog.
The app creates a random installation identifier and stores it in the app's preferences. PostHog uses that identifier to connect events from the same installation. We do not connect it to a name, email address, or Automic Vault account.
| Metric | Data sent |
|---|---|
| Usage | Main window opened, number of triggered Detectors when that count changes, and whether the user approved a request. |
| Installation | A random identifier stored in app preferences and reused across events from that installation. |
| Software | App, build, protocol, and helper versions. |
| Mac | macOS version, architecture, Mac model, processor counts, and rounded physical memory. |
| Network | PostHog receives connection metadata such as the source IP address when the app sends an event. |
Excluded data
Security data stays inside the local boundary.
The telemetry payload has a fixed, public implementation. It does not include the data Automic Vault protects or the details of an Authorization Request.
| Local data | Telemetry behavior |
|---|---|
| Secrets | No Secret values, Credential values, or Secret Names. |
| Requests | No commands, arguments, working directories, Launcher identities, or Target identities. |
| Findings | No Finding names, file paths, configuration contents, or detected Secret material. |
| History | No Authorization History records or Approval details beyond the fact that an approval occurred. |
Purpose and processor
We use the metrics to make product decisions.
We use event counts and technical characteristics to measure feature use, investigate compatibility gaps, and decide where to spend development time. We do not sell this data, use it for advertising, or combine the installation identifier with account data.
No PostHog person profile
Each event tells PostHog not to create a person profile. The persistent installation identifier still makes the event stream pseudonymous rather than anonymous.
No ad tracking
Automic Vault does not use these metrics for advertising, data brokerage, or tracking across other products.
Inspect the payload
The telemetry implementation is public.
Website
The website uses Google Analytics.
The public site provides documentation, downloads, and source links without an account or hosted vault login. Google Analytics receives page-view, browser, device, referrer, and network data when you visit. The website never receives the Secrets stored by the Mac app.
No hosted login
You do not create an Automic Vault account to read documentation, download releases, or inspect source.
Static artifacts
The site and repository link to signed release files. Download providers receive the network requests needed to serve those files.
Google Analytics
Google processes website traffic data under its privacy policy. No product telemetry flows through Google Analytics.
Public repository
Product source, releases, and issue tracking live in the public GitHub repository.
Control
The current Mac app has no telemetry switch.
Blocking us.i.posthog.com in a network filter stops app telemetry. Deleting the app's preferences removes the installation identifier, but the app creates a new identifier when it next sends an event.
Find your installation identifier
Run defaults read com.automicvault PostHogAnonymousInstallID. Send that value to mxcl@me.com if you want the matching PostHog events deleted.
Project retention
PostHog keeps events until the project owner deletes them or the configured retention period expires.
References
Verify the privacy boundary.
Practical rule
Do not make AI transcripts a secret store.
Automic Vault targets local over-sharing: dotenv files, shell profiles, cloud credentials, package tokens, and debug output can all become model-visible text. The product reduces those text surfaces before an agent run starts.
Move ambient secrets
Replace readable local secret files with named values stored behind the local runtime boundary.
Apply to the Target
Let an authorized Target receive credentials without placing them in the Launcher's ambient environment.
Review exposure
Use local scanning to find files that still contain credentials before future agent sessions.
Keep reports sanitized
Use synthetic examples when reporting privacy or security behavior in public repositories.