Privacy Considerations for Cherry Studio's Analytics Service: Implementation and Safeguards

Cherry Studio implements a privacy-first analytics architecture that allows users to completely opt out, anonymizes all collected data through UUID-based identifiers, and transmits only minimal token usage metrics without conversation content or personal identifiers.

Cherry Studio, an open-source AI desktop application developed by cherryhq, includes an analytics subsystem designed with strict privacy considerations for the analytics service. The implementation prioritizes user control and data minimization, ensuring that telemetry is optional, anonymous, and limited strictly to operational metrics. This article examines the technical safeguards implemented across the main and renderer processes.

User-Controlled Opt-Out Mechanism

The foundation of Cherry Studio's privacy model is the user-controlled opt-out capability. Users can completely disable analytics through a configuration flag that prevents any telemetry client from being instantiated.

The enableDataCollection Configuration Flag

In src/main/services/ConfigManager.ts, the getEnableDataCollection() method (lines 88-94) retrieves the user's preference. When this flag returns false, the analytics subsystem is bypassed entirely during application startup.

// In the main process
if (!configManager.getEnableDataCollection()) {
  logger.info('Data collection is disabled, skipping analytics initialization')
  return
}

This check occurs early in the initialization flow, ensuring that no analytics client is created when the user has opted out.

Conditional Analytics Initialization

The AnalyticsService implements conditional initialization to ensure that telemetry only activates when explicitly permitted by the user.

AnalyticsService.ts Implementation

Located in src/main/services/AnalyticsService.ts (lines 20-31), the init() method constructs the AnalyticsClient only when enableDataCollection is true. If disabled, the service logs a confirmation message and skips all further analytics activity.

this.client = new AnalyticsClient({
  clientId: configManager.getClientId(),
  channel: 'cherry-studio',
  onError: (error) => logger.error('Analytics error:', error),
})

This architecture ensures that disabled analytics leave no residual client instances or background processes running.

Anonymous Data Collection Practices

When analytics are enabled, Cherry Studio implements strict data anonymization and minimal payload principles to protect user privacy.

UUID-Based Client Identification

Instead of using personally identifiable information, Cherry Studio generates a random UUID for each installation. The getClientId() method in src/main/services/ConfigManager.ts (lines 75-84) retrieves an existing UUID or generates a new one if none exists, ensuring persistent but anonymous identification across sessions.

No email addresses, usernames, or hardware identifiers are ever transmitted or stored for analytics purposes.

Minimal Telemetry Payload

The analytics system collects only essential operational metrics. In src/renderer/src/utils/analytics.ts (lines 54-68), the trackTokenUsage function constructs payloads containing only:

• Provider identifier: Derived from the provider ID or hostname (never user email)
• Model ID: The specific AI model used
• Token counts: input_tokens and output_tokens only

export function trackTokenUsage({ usage, model }: TokenUsageParams): void {
  if (!usage || !model?.provider || !model?.id) return

  const [input, output] = isAiSdkUsage(usage)
    ? [usage.inputTokens ?? 0, usage.outputTokens ?? 0]
    : [usage.prompt_tokens ?? 0, usage.completion_tokens ?? 0]

  if (input > 0 || output > 0) {
    window.api.analytics.trackTokenUsage({
      provider: getProviderTrackId(model.provider),
      model: model.id,
      input_tokens: input,
      output_tokens: output,
    })
  }
}

No conversation text, file paths, system metadata, or personal identifiers are included in the payload.

Secure Inter-Process Communication

Cherry Studio uses a dedicated IPC channel to securely transmit analytics data from the renderer to the main process, ensuring controlled data flow.

IPC Channel Architecture

The renderer process invokes analytics tracking through window.api.analytics.trackTokenUsage, which maps to the Analytics_TrackTokenUsage IPC channel. In src/preload/index.ts (lines 700-702), this exposure is strictly limited to the specific analytics function:

// preload/index.ts
trackTokenUsage: (data: TokenUsageData) =>
  ipcRenderer.invoke(IpcChannel.Analytics_TrackTokenUsage, data)

The main process receives these invocations in src/main/ipc.ts (lines 1170-1178), routing them exclusively to AnalyticsService.trackTokenUsage. This architecture prevents arbitrary data transmission and ensures analytics data undergoes validation at a single, controlled entry point.

Summary

Cherry Studio's analytics service implements comprehensive privacy considerations through:

• Complete user opt-out via the enableDataCollection configuration flag, which prevents any analytics client initialization when disabled
• Anonymous identification using randomly generated UUIDs rather than personal information
• Minimal data collection restricted to provider identifiers, model IDs, and token counts—excluding all conversation content and file paths
• Secure IPC architecture utilizing dedicated channels with controlled entry points between renderer and main processes
• Transparent logging that confirms when analytics are disabled, ensuring no background telemetry occurs

Frequently Asked Questions

Can I completely disable analytics in Cherry Studio?

Yes. Cherry Studio provides a user-controlled opt-out mechanism through the enableDataCollection setting in src/main/services/ConfigManager.ts. When set to false, the application logs "Data collection is disabled, skipping analytics initialization" and prevents the AnalyticsClient from being instantiated entirely, ensuring zero telemetry data is transmitted.

What data does Cherry Studio collect when analytics are enabled?

When enabled, Cherry Studio collects only minimal operational metrics: the provider identifier (derived from hostname or provider ID, never email), the AI model ID, and token usage counts (input_tokens and output_tokens). This data is assembled in src/renderer/src/utils/analytics.ts and contains no conversation text, file paths, or system metadata.

Is my conversation content sent to analytics servers?

No. The trackTokenUsage function in src/renderer/src/utils/analytics.ts explicitly excludes all conversation content from analytics payloads. Only numerical token counts and model identifiers are transmitted. The payload construction includes no parameters for message text, conversation history, or file content, ensuring complete privacy of user communications.

How does Cherry Studio identify my device for analytics?

Cherry Studio uses an anonymous UUID (Universally Unique Identifier) generated during first startup rather than hardware identifiers or personal information. The getClientId() method in src/main/services/ConfigManager.ts retrieves an existing UUID from storage or generates a new random one, ensuring persistent but completely anonymous identification across application sessions.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}