docs: PRIVACY.md does not disclose PostHog as a telemetry recipient

Hi — thanks for Open Design, and for how openly telemetry is discussed in this repo; reading #4708 and #4558 is what led me here.

First, what this is not. I've read the existing privacy issues and I'm deliberately not re-treading them:

• #4708 (@Philmod) — safety/crash telemetry bypassing the opt-out toggle. Confirmed by @lefarcen, still open, internal fix pending. Not what this is about.
• #4558 (@UjuiUjuMandan) — PRIVACY.md saying opt-in when the app ships opt-out. Fixed. Not this either.

Both are about when data is sent. This one is about who receives it — and I couldn't find it reported anywhere.

PRIVACY.md never mentions PostHog

PRIVACY.md has a "How telemetry is sent" section that describes exactly one destination:

Redacted telemetry batches are sent to a Cloudflare Worker relay operated by the Open Design team, which forwards them to Langfuse for analysis. The relay holds the Langfuse write credentials server-side, so packaged clients only ever ship a public relay URL — no secret keys.

That's accurate for the content category. But it isn't the whole picture: anonymous metrics and stability events go straight to PostHog, and PostHog is not named anywhere in PRIVACY.md (grep -ci posthog PRIVACY.md → 0).

Checked at 2a6aaeb:

what	where
const DEFAULT_HOST = 'https://us.i.posthog.com'	apps/daemon/src/analytics.ts:29
const DEFAULT_HOST = "https://us.i.posthog.com"	apps/packaged/src/startup-telemetry.ts:37
posthog-js 1.374.2	apps/web/package.json:52
posthog-node 5.34.6	apps/daemon/package.json:57
"PostHog / Langfuse telemetry endpoints. metrics and content…"	apps/web/src/types.ts:454

So the split appears to be metrics → PostHog directly, content → Cloudflare relay → Langfuse. PRIVACY.md documents the second and is silent on the first — including for the packaged desktop app, which posts packaged_runtime_failed directly to us.i.posthog.com on a startup crash.

The reason I think this matters rather than being a nitpick: PRIVACY.md opens by saying "It documents the behavior shipped in the app", and closes with "When the telemetry behavior changes, this page is updated alongside it." A reader who wants to know which third parties see their data — which is, I'd guess, most people who open a file called PRIVACY.md — would come away believing the answer is "Langfuse, via a relay you operate." PostHog is a US-hosted third party receiving data from every install, and it's simply not on the page.

I'd also gently flag that "packaged clients only ever ship a public relay URL — no secret keys" reads as "the relay is the only endpoint we ship," when packaged clients also ship a PostHog host and project key. (The phc_ key is a public key, so nothing is leaking — it's the "only ever" that's doing work it can't quite support.)

Suggested fix

I've opened #5541, which rewrites only the "How telemetry is sent" section to describe both paths. It's a docs-only change — no behavior, no code — and it deliberately doesn't touch the "What is never collected" line about telemetry being off, since that's #4708's territory and your internal fix will presumably land there.

Very happy for you to rewrite my wording entirely — you know the data flows better than I do, and how you describe your own privacy posture should be your words, not a stranger's. If you'd rather fold this into the #4708 fix and close this, that's completely reasonable too.

Not a claim of

This isn't a claim of a vulnerability, of wrongdoing, or of a legal violation — I'm not a lawyer and this isn't legal advice. It's a documentation-accuracy observation: the page says it describes what ships, and one of the two recipients is missing from it.

---

Checked against main @ 2a6aaeb3d254d9b82e72ea7e2c3794b099069df0. grep -ci posthog PRIVACY.md → 0.