# Privacy, telemetry, and PII (Capability word 10)

Bare OS telemetry is **operator-controlled** and **bounded**. Guests must treat every field as potentially visible to hosts, log sinks, and replicated drives.

## Fields to scrub or never emit

When building custom NDJSON / OTel mirrors or Pear-side aggregators, treat these as **PII or secret-adjacent** unless you have an explicit retention policy:

- **Identity:** `BARE_OS_SESSION_ID`, `BARE_OS_PUBLIC_KEY`, device or account ids from Pear, HDMS vault labels that name people.
- **Network:** full URLs with query strings, raw IP addresses paired with timestamps, DHT bootstrap strings copied from operator clipboards.
- **Crypto / auth:** TLS session keys, Hypercore secret keys, multisig payloads, `BARE_OS_LKG_SYSTEM_KEY_HEX`, any `*TOKEN*` or `*SECRET*` env values.
- **Paths:** home directory absolute paths on the host when they include real usernames (prefer basenames already used in `$HOME` mapping).
- **Capability word 8 fields:** `sessionForkGeneration`, `vaultRotateCount`, multisig / trust-graph ids surfaced as pointers, OIDC publishing URLs, subprocess **`uidGidMapHint`**, RocksDB / sidecar manifest pointers — treat as operator metadata; scrub before cross-tenant export.
- **Capability word 9 fields:** `bareModuleCryptoStagingProbeId`, `bareModuleProbeClass`, Pear stage / appling / updater / radio / wakeups sketches from **`BARE_OS_*_JSON`** env mirrors, SOCKS / HTTP proxy map keys (host-only interpretation) — treat as deployment fingerprinting; scrub or bucket before multi-tenant export.
- **Capability word 10 fields:** `pearInspectLoggerTlsProbeId`, `bareRpcProbeClass`, Pear doctor / workshop / RTI / user-dirs sketches, Bare logger tap payloads, mTLS proxy map keys, thread-pool telemetry JSON — treat as operator metadata; scrub before cross-tenant export.
- **Capability word 11 fields:** `hypercorePackHrpcLifecycleProbeId`, hypercore replicate budget / drive graph / protomux backpressure / Pear matrix / bundle preload / HRPC allowlist / sidecar cap / git LFS / net QoS / storage tier / indexer catchup / multisig quorum / relay geo sketches — operator hints only; no secret material in stock paths.

Stock emitters avoid logging env wholesale; `/proc/self/environ` omits secret-like keys. Prefer **hashed** or **bucketed** counters (e.g. pairing backoff counts) over raw payloads.

## GDPR / subprocessors (operator template)

Operators running Bare OS as part of a service should maintain a **subprocessor list** (who processes telemetry, drive replication, Pear runtime updates, HDMS pairing) and tie it to retention policies. The stock tree does not ship legal text; use this section as a checklist when filling **DPA / privacy policy** annexes.

## Schema versions

- NDJSON lifecycle / telemetry: see **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (**10** in stock tree) and rows in [`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md).
- OTel-inspired lines: **`otlSchemaVersion: 7`**, example [`kernel/etc/bare-os/otel-jsonl.example.json`](../kernel/etc/bare-os/otel-jsonl.example.json), schema [`docs/schemas/otel-bare-os-jsonl.schema.json`](../docs/schemas/otel-bare-os-jsonl.schema.json).
- Audit JSON: **`auditSchemaVersion: 7`** (delegate depth / Capability word 9–10 RPC classes); optional **`requestSmugglingClass`** remains default **`none`** in stock emitters where applicable.

## Related

- [Kernel extensions env table](../docs/reference/kernel-extensions.md)
- [Security and trust](09-security-and-trust.md)