Privacy Policy

Last updated 12 October 2026

It runs on your own computer. Your pages, what your agents put on them, and what you do on them stay there. We never receive them.

This policy says what we do receive: counts of how the software is used, and the ordinary records of people visiting this website. It is written by Aaryan Kapoor, who makes It and is responsible for what is described here. “We” and “us” below mean him.

In short. It sends usage data under a random id for your installation, never what is on a page and never who you are. We keep the country a report came from and not the address. You can turn it off with one command: it telemetry off.

What stays on your machine

It keeps everything it holds in a folder on the computer you installed it on. That includes every page, each page’s contents and history, what you click or type on a page, the names of your displays and machines, and your agents’ conversations. None of it is sent to us, and we have no way to read it. A display reaches your It directly, over your own network.

Usage data the software sends

Unless you turn it off, an installed It reports how it is used to https://itcan.do/api/usage. This begins when It is installed, and the first screen of It’s own site says so, in one line that links here. Versions up to 0.1.6 said it in a line at the terminal instead, and began only once a person had been shown that line.

What a report holds

A report is a short list of events. Each event is a name, the hour it happened in, and a few properties, and every property is one of a fixed list of words or a size band. There is no free text in a report, so nothing you wrote can be in one. The events say things like these:

That It started, its version, and whether it runs on Linux, macOS or Windows.
Which agent apps are connected, such as Claude Code or Codex, and their version numbers.
That a page was published, by which agent app, and roughly how large it was.
That a page was shown on a phone, a tablet, a computer or a television.
That something you did on a page reached your agent, by which path, and how long that took.
Which of It’s commands were run and whether each worked, and never what was typed after the command.
Roughly how many pages, displays and machines your It has, as a band such as “2 to 5”.
That It was set up, upgraded or removed.

The complete list, with every event, every property and every value it can have, is published with the source: Usage reporting. The software refuses to send anything that is not on that list.

What a report never holds

Page contents and titles, what you clicked or typed, prompts, file paths, the names of your projects, displays and machines, the ids of your pages and conversations, your name, your email address, and anything else that says who you are.

How an installation is told apart

Each installation makes a random id the first time it runs, and every report carries a hash of that id. It is made from nothing about you or your computer. It lets us count installations and see that reports belong together, and it does not tell us whose installation it is. Turning reporting off forgets the id, and turning it on again makes a new one.

What we keep

We keep every event we receive, with the hash of the installation id, the version of It that sent it, the time it arrived, and the two-letter code of the country the report came from. We keep these indefinitely, because they are how we see how It is used over time.

Every request on the internet arrives from a network address. Our hosting provider sees that address in order to answer the request, and works out the country from it. We do not write the address down, in the usage data or beside it.

Turning it off

Any one of these stops usage data from being recorded and sent, and discards whatever was waiting to be sent:

Run it telemetry off. it telemetry says whether it is on, and it telemetry on turns it back on.
Set IT_TELEMETRY_ENABLED=false where It runs.
Set DO_NOT_TRACK=1 where It runs.

Run it telemetry off before any other command and no id is ever made.

What this website records

This website has no accounts and no advertising, and it sets no cookies. It has one form, for writing to us.

Visits. We count page views with our hosting provider’s analytics, which uses no cookies and does not follow you from site to site. It records the page, the site that linked to it, the kind of browser and device, and the country.
Installs. When an install script or the install guide is fetched from this site, we note which one, the kind of program that asked (a browser, a terminal tool or an agent, for example), and the country. We do not keep the address it was fetched from.
Messages. When you write to us with the form at the foot of this site, we keep the email address you give, what you wrote, and what you tapped it as being about, so that we can answer you. We keep nothing else with a message, and we use it for nothing but answering you. We delete a message when you ask us to.
Server logs. Our hosting provider keeps short-lived logs of requests, including network addresses, to run and protect the service.

The software itself is downloaded from GitHub, which keeps its own records under its own privacy policy. Unless you turn it off with it updates off, an installed It also asks this site every half hour whether a newer version is out. That request carries no id and nothing about your It.

How we use it

We use usage data and visit counts to learn how many people use It, which features and agent apps are used, where installing or using It fails, and what to build next. We do not sell this data, we do not use it for advertising, and we do not try to work out who is behind an installation.

Where the law asks for a legal basis, ours is our legitimate interest in understanding and improving the software, balanced by how little is collected and by the switch that turns it off.

Who else handles it

We use a small number of providers to run this, and they process data only on our behalf:

Vercel hosts this website and receives the usage reports and the messages sent with its form.
Neon runs the database the usage data and those messages are kept in.
GitHub hosts the source and the downloads.

These providers operate in the United States, so data is processed there. We may share aggregate figures, such as the number of installations, in public. We would disclose data if the law required it, and we would have very little to give.

Your choices and rights

You can turn usage data off at any time, as described above. You can also ask us for a copy of what we hold for your installation, or ask us to delete it. Because we do not know who you are, we need the id of your installation to find it: it is in the file telemetry.json in It’s folder, which is ~/.it unless you chose another. Send it to the address below and we will act on it within thirty days.

Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA, including the right to object and the right to complain to a data protection authority. We do not sell or share personal information as those laws define it.

Children

It is a tool for people who work with software agents. It is not directed at children under 13, and we do not knowingly collect information from them.

Changes

If we change what is collected or how it is used, we will update this page and the date at its top, and the published list of events will change with the software. A change that widens what is collected will also be noted in the release that makes it.

Contact

Questions and requests about this policy go to hello@itcan.do.