Crash Reporting

Companion Intelligence apps can send crash reports to Sentry  so the team can find and fix bugs. This page describes exactly what is sent, what is stripped before sending, and how to turn it off.

The short version

Crash reporting is opt-out: it is on unless you turn it off.

One thing worth understanding, because it is easy to misread: an app only reports if it was built with a reporting address (a Sentry DSN). Release images are. If you build an app yourself from source without one, it initialises no reporting code at all and makes no outbound connection — but that is the absence of configuration, not a privacy setting you have chosen.

What is sent

Only errors — an exception, where it happened, and a short trail of recent activity. No usage analytics, no page views, no metrics, no session recording.

Before anything leaves your machine it passes through a scrubber that removes:

• Credentials — API keys, passwords, bearer tokens, session cookies, Tailscale keys, and usernames and passwords embedded in database connection strings
• Your identity — your username, email address, and the identity headers the appliance passes between its own services. Your machine’s hostname is removed too, since it usually contains your name
• File paths — your home directory is collapsed to ~, so /Users/yourname/… never leaves the machine
• Search terms and URLs — the query part of every web address is stripped. On Companion Memory a search URL contains what you searched your own memories for, so this matters more here than in most software
• Request bodies and cookies — dropped entirely
• Captured variables and source lines around the error, which can contain the content being processed at the time

Anything longer than 8 KB is truncated, so a large document cannot be smuggled out inside an error message.

What is not stripped

Being straight about the limits:

• The name of the file and function where the error happened. This is our code, not your data, and Sentry needs it to group reports.
• Your timezone, which the Sentry SDK attaches by default.
• The app version, operating system and browser.
• Free text you typed that ends up inside an error message can survive if it looks like ordinary prose — no automated filter reliably recognises a sentence as private. The scrubber removes the categories above by pattern, not by meaning.

Turning it off

Three controls, in order of precedence.

1. The app-store switch

Each first-party app has a Share crash reports switch in its settings. Turning it off stops that app reporting, immediately and permanently, even though the app image ships with a reporting address built in.

2. CI_TELEMETRY=off

If you run apps yourself, set CI_TELEMETRY to off (or false, 0, no, disabled) in the app’s environment. This is what the switch above sets, and it overrides a reporting address baked into the image — you never need to rebuild anything to stop reporting.

3. CI_LOCAL_ONLY=true

Local-only mode means zero phone-home and beats every other setting, crash reporting included.

# Either of these stops reporting for a self-hosted app
CI_TELEMETRY=off
CI_LOCAL_ONLY=true

A limitation on the browser apps

Some apps are static web pages with no server of their own — the WebXR apps and Spellbook. When these run inside Companion Hub, the switch reaches them normally. When one is deployed straight to a static host such as Cloudflare Pages, there is no server to ask, so the in-browser opt-out is stored in your browser’s local storage instead. Clearing site data resets it.

Companion Hub

Companion Hub predates the reporting rules described above and behaves differently.

The allowErrorMonitoring switch in Hub’s Settings page does not currently control crash reporting. Hub reports whenever it is configured with a reporting address, regardless of that setting, and it sends more than the apps do — Sentry’s sendDefaultPii is enabled, which includes data the first-party apps deliberately exclude.

We are documenting this rather than leaving the previous, inaccurate description in place. Bringing Hub onto the same contract as the apps is planned work.

Where reports go

Reports go to the companion-intelligence organisation on Sentry, which only the Companion Intelligence team can read. They are not shared with third parties or used for advertising, profiling, or any purpose other than diagnosing faults.