Privacy

The Systematic docs site is designed to respect your privacy. This page documents exactly what is and is not collected when you visit.

Analytics

The docs site uses Umami, a self-hosted, open-source analytics platform deployed at metrics.fro.bot. No third-party analytics provider processes your data.

Analytics are only active when the site is built with the UMAMI_WEBSITE_ID environment variable set. In development builds this variable is unset, so no tracking script is loaded at all.

What is collected

• Aggregate pageviews — which pages are visited and how often, with no visitor-level linkage across sessions.
• One named interaction event: click_install_cta — recorded when a visitor clicks an install call-to-action.
• Quick Start page visits are captured as ordinary aggregate pageviews, not as a separate named event.

That is the complete list. Nothing else is collected.

What is not collected

• No cookies. Umami operates without setting any cookies.
• No personally identifiable information (PII). Names, email addresses, and device identifiers are never recorded.
• No cross-site tracking. The tracker is self-hosted and does not participate in any ad network or cross-domain tracking scheme.
• No fingerprinting. Canvas, font, or hardware fingerprinting is not used.
• No URL query strings or fragments. The tracker is configured with data-exclude-search="true" and data-exclude-hash="true", so query parameters and URL fragments are stripped before any pageview is recorded.

Do Not Track

The tracker is configured with data-do-not-track="true". Umami honors the browser Do Not Track signal — when DNT is enabled in your browser, no data is sent.

Self-hosted, no third-party processor

All analytics data stays on infrastructure controlled by this project. No data is shared with, sold to, or processed by any third party.

IP addresses and identifiers

No raw IP addresses or personal identifiers are stored. Visitors are counted using a one-way hash that rotates monthly, so the same visitor cannot be tracked across months and the original IP cannot be recovered. Approximate location (country, region, city) is derived locally from the IP address at collection time, with no third-party calls. Visitors with Do Not Track enabled are not recorded at all.

Plugin runtime

The Systematic plugin itself — the code that runs inside OpenCode on your machine — transmits no telemetry of any kind. It does not phone home, does not report usage, and does not collect or send any data anywhere. Analytics are strictly limited to this documentation website.

Bootstrap text on OpenCode v2

On OpenCode v2, the plugin hands its bootstrap text to OpenCode, which stores it as an instruction entry in OpenCode’s own local session database. The plugin itself sends nothing off your machine; the text reaches your model provider as part of each request, as the bootstrap always has. The entry is part of the session’s stored state, and it stays there after you remove the plugin. If you point bootstrap.file at a file that holds sensitive text, that text is stored the same way, so keep sensitive text out of that file.

External search sources

The optional external sources for search (kind: external) read only local files on your machine: Markdown folders and Deciduous sync folders that you or an allowed project listed. They open no network connection, run no command and write nothing, and they send nothing anywhere. The text of a search hit is returned to the agent that asked for it, so it reaches your model provider like any other tool result. Nothing is redacted from it. The search guide explains how to set sources up and which limits apply.

Connecting your projects

The ce:connect skill reads the learnings and tracked code of projects you list in the connect.allow_projects config field, or of the part of that list you name with a connect.groups group or a projects: pick. Its helper opens no network connection and sends nothing anywhere. Its digest, run record and ledger are written only to a state directory on your machine ($XDG_STATE_HOME/systematic/connect, or ~/.local/state/systematic/connect), with owner-only permissions. Run directories are deleted after 30 days, and ledger clear deletes the ledger. What the researcher reads reaches your model provider like any other tool result, and nothing is redacted from it. Read tools are not limited to the listed projects, and the digest can carry content from those reads.

The one command that reaches GitHub is fetch:<run>, and it runs only when you type it. The skill then runs gh api and gh run download with your own gh login, against the run and artifact of one run of the Systematic repository. The requests carry the run id and your gh token to GitHub, and nothing from your projects. The downloaded record goes to a temporary directory that is removed afterwards, and the candidates that pass the local checks are written to the same state directory as any other run. The helper still opens no connection.

A scheduled run is different, and it exists only where someone sets up Systematic’s ce:connect workflow in a GitHub repository. It reads public repositories only. The text its agent reads reaches the model provider named in that repository’s secrets, and nothing is redacted from it. It then posts a report as an issue in the repository that runs it, which is public when that repository is public. The report quotes excerpts from the repositories it read. The run record is also saved as a workflow artifact for 30 days, readable by anyone who can read the repository’s artifacts. The agent step can read the provider credential and the job’s token, and nothing screens the report or the artifacts for secret values. The connect guide lists the mitigations and says plainly what they do not stop.

The connect guide explains the limits.

Contact

If you have questions about privacy on this site, open an issue on GitHub.