What the server sends

1. When

Only the server sends anything. The agent that runs on your machines sends nothing to anyone. The server sends at three moments:

• When lnkstart server setup finishes, successfully or not: a notice with the step it reached and how it ended (section 3). It is the only thing we know about someone who tries to install and cannot.
• Once a day, the first 1–5 minutes after starting: the report below, which is what your account panel shows. An unregistered server sends the same report without a license, identified only by the random number of its installation.
• When renewing its license, during its last month of validity and at most every 6 hours if a renewal fails.

Besides, once a day the server looks for a version that fixes a serious bug and was published as forced, the only one that installs by itself: it downloads the signed manifest of the latest version and sends nothing, like lnkstart update --check. It is stopped with sudo lnkstart server forced-fixes off.

How to turn it off. lnkstart server setup --no-telemetry writes telemetry = "off": neither the install notice nor the daily report is sent, with or without a license. The license still renews on its own, and the renewal carries only the fields in section 4. With license.auto_renew = false nothing is ever sent, not even the renewal, and it does not look for forced fixes: the license then expires and the server keeps serving traffic; it only stops receiving updates. If the server already has a configuration, setup reads it before the first step: with either of the two it sends no install notice, even if it stops before reaching that step, and if it cannot read it, it does not send one either.

What is received is kept for 90 days, install notices and unregistered reports included; older data is deleted daily.

You can see exactly what would be sent, on your own server, with lnkstart server telemetry.

2. Where to

To the LnkStart service, over HTTPS. With a license: https://lnkstart.com/api/licenses/renew and …/heartbeat, or the address set in license.url in your configuration. With no license involved: https://lnkstart.com/api/telemetry/setup for the install notice (registered or not) and …/api/telemetry/report for the daily report of an unregistered server.

3. What, when installing

• installId — a random number created the first time and kept in install.json (a one-off one if it cannot be saved yet). setup only reserves it: the 30 days to register start when the server starts. It never travels with the license or the email: the install notice carries neither, and the daily report of a registered server does not carry this number.
• serverVersion, os, arch — server version, operating system and architecture.
• front — how traffic reaches it: direct (the server holds ports 80 and 443), sni_proxy (behind a proxy that does not decrypt) or behind_proxy (behind nginx or Caddy).
• step — the last step it reached: machine, ports, dns, config, license or service.
• result — how it ended, as a code: ok, ok_unregistered (finished, but the license service gave no license), register_failed (finished, but registering failed), acme_failed (finished without the server's own certificate), not_linux, not_root, no_systemd, already_running, port_80_busy, port_443_busy, sni_ports_busy, tcp80_blocked, tcp443_blocked, dns_unresolved, dns_mismatch, config_failed, user_failed, service_failed, not_listening or other.

Not the domain, not the email, not the IP address: only these seven fields.

4. What, always

Daily and when renewing, also with telemetry = "off" when renewing.

• license — the license key, which carries the email it was registered with. An unregistered server sends installId instead.
• serverVersion, protocolVersion — server and protocol version.
• os, arch — operating system and architecture, such as linux and x86_64.
• uptimeSecs — seconds since the server process started.
• agentsConnected, agentTokens, services — counts.

5. What, with telemetry = "full"

This is the default. With telemetry = "minimal" none of this is sent. All of it is counts and totals. "Today" means since the previous daily report that arrived; if the process restarts, it starts from zero, like the totals.

• tlsMode — acme, manual or off.
• servicesWithPassword, servicesWithAccessToken, servicesWithFallbackRedirect, servicesOnFullHosts — how many services use each feature.
• servicesTcp, servicesUdp, servicesBalanced — how many services are TCP, UDP, or served by several machines at once. Counts only: never ports or allow-lists.
• agentsQuic, agentsWebsocket — which transport the connected agents use.
• agentVersions — the distinct agent versions connected.
• agentPlatforms — how many connected machines there are of each platform (linux-x86_64, macos-aarch64…), from a closed list of systems and architectures: any other value is counted as other, never copied.
• quicListening — whether the server could open QUIC (UDP 443).
• firstMachineAfterSecs, firstVisitAfterSecs — seconds from the server's first start to the first connected machine, and to the first time an app answered a visitor through the tunnel (HTTP, TCP or UDP). Absent until there is one.
• certsValid, certsExpiringSoon — how many HTTPS certificates it has, and how many expire in less than 14 days. Counts only: not a single name.
• acmeFailures — today's failures asking Let's Encrypt for certificates, by type: rateLimited, challenge (it could not validate the domain) and other.
• requestsToday, bytesInToday, bytesOutToday, unavailablePagesToday — today's requests, bytes and "unavailable" pages.
• tunnelLatencyMsP50, tunnelLatencyMsP95 — what the tunnel adds: the round trip between the server and its agents, in milliseconds (today's median and 95th percentile). Counted in buckets, and it comes out as the bucket's upper bound: exact up to 10 ms, within 15 % up to 200 ms, and coarser up to 10 s, the maximum. Absent without samples.
• memoryRssMb — the memory the server process takes when it writes the report, in MB. It shows whether something keeps growing (a leak) on servers that are not ours. Linux only; on other systems it is left out.
• handshakeRejections — machines refused on connect today, by reason: badToken, revoked, protocol (incompatible version), nameTaken, lapsed (unregistered past 30 days) and other.
• requestsTotal, bytesInTotal, bytesOutTotal, unavailablePagesTotal, agentConnectionsTotal, handshakeRejectionsTotal, internalErrorsTotal — totals since the server process started.

6. What never

Visitor or agent IP addresses · URLs, paths or query strings · headers or content · service names, hosts or domains · machine names or token labels · ports, including public TCP and UDP ones · internal IP addresses · allow-lists · passwords or tokens, not even hashed.

How we handle the email carried by the license is described in the privacy policy.