* Initial plan * Fix security vulnerabilities: MD5→SHA-256, XSS via dangerouslySetInnerHTML/innerHTML, insecure randomness, CodeQL config Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com> * Clean up README: remove decorative emojis for a professional tone Remove all emojis from section headers, list item prefixes, and decorative positions. Replace ✅ phase status markers with '(Complete)' text. Keep the ⭐ in the final call-to-action line. No changes to links, badges, code blocks, or technical content. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: remove emoji characters from CONTRIBUTING.md Remove all emoji from section headers and closing line while preserving links, code blocks, and technical content. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: remove emoji characters from documentation files Remove all emoji characters from 8 documentation files in docs/. Replace status-marker checkmarks (✅) with '(Done)' text. Remove decorative emojis from headers and body text entirely. Preserve emojis inside code blocks unchanged. Clean up trailing whitespace introduced by removals. Files modified: - DEPLOYMENT_GUIDE.md - IMPLEMENTATION_PLAN.md - MILESTONE_6_SUMMARY.md - PRODUCTION_ROADMAP.md - PROJECT_STATUS.md - REPOSITORY_ENHANCEMENT.md - ROADMAP.md - SECURITY_AUDIT_ROADMAP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: remove emoji characters from documentation files Remove all emoji characters from 9 markdown files while preserving code block content (box-drawing characters, indentation). Emojis removed from headers, list items, and body text across READMEs, issue templates, PR template, runbook, and mobile docs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove excessive emoji from all documentation for professional presentation Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com> * Fix PluginWidget initial state and remove || true from security audit steps Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com> * Remediate all failing CI checks: update deprecated actions, fix npm vulnerabilities, fix migrations YAML Co-authored-by: SynOSdev <257853113+SynOSdev@users.noreply.github.com> * Fix all remaining CI failures: Node 18→20, fix test API contract, fix pytest version, fix Postgres health checks Co-authored-by: SynOSdev <257853113+SynOSdev@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: SynOSdev <257853113+SynOSdev@users.noreply.github.com>
5.7 KiB
5.7 KiB
Telemetry System Documentation
Overview
LifeRPG includes an optional telemetry system designed to help improve the application through anonymous usage analytics. The system is built with privacy-first principles and user control.
Key Features
- Opt-in Only: Users must explicitly consent to telemetry collection
- Anonymous: No personal information or habit content is collected
- Transparent: Users can see exactly what data is collected
- Administrative Control: Can be disabled globally by administrators
- GDPR Compliant: Respects user privacy and data protection regulations
Architecture
Backend Components
telemetry.py- Core telemetry engine
- Consent management
- Event recording and sanitization
- Pre-defined event helpers
- Analytics aggregation
- Database Models
TelemetryEvent- Stores anonymous event dataProfile- Stores user consent preferences
- API Endpoints
POST /api/v1/telemetry/consent- Set user consentGET /api/v1/telemetry/consent- Get consent statusPOST /api/v1/telemetry/event- Record custom eventsGET /api/v1/admin/telemetry/stats- Admin analytics
Frontend Components
TelemetrySettings.jsx- User consent management UIAdminTelemetryDashboard.jsx- Administrative analytics dashboarduseTelemetry.js- React hook for event tracking
Data Collection
What We Collect
- Feature Usage: Which features are accessed and how often
- Performance Metrics: Error rates and system performance
- Aggregated Behavior: Usage patterns and trends
- Gamification Events: XP earnings, level-ups, achievements
What We Don't Collect
- Personal information (names, emails, etc.)
- Habit titles or descriptions
- User notes or content
- Location data
- Device identifiers
- IP addresses
Event Types
// User actions
habit_created: { habit_difficulty, habit_cadence }
habit_completed: { habit_difficulty, xp_awarded }
achievement_earned: { achievement_type, xp_awarded }
level_up: { old_level, new_level }
// Feature usage
analytics_heatmap: { feature_used: 'analytics_heatmap' }
analytics_trends: { feature_used: 'analytics_trends' }
feature_used: { feature_used: 'feature_name', duration? }
// Technical events
error_occurred: { error_type, context? }
page_view: { page }
user_interaction: { action, category?, label? }
Configuration
Environment Variables
# Enable/disable telemetry globally
TELEMETRY_ENABLED=true # default: true
User Consent
Users can opt-in/out at any time through:
- Settings page in the UI
- API endpoint
- Automatic consent prompts
Privacy Compliance
GDPR Compliance
- Lawful Basis: Legitimate interest with opt-out capability
- Data Minimization: Only collect necessary anonymous data
- Purpose Limitation: Data used only for application improvement
- Transparency: Clear disclosure of what data is collected
- User Control: Easy opt-out mechanism
Data Retention
- Events are stored indefinitely for analytics
- User consent can be withdrawn at any time
- No personal data is stored in telemetry events
Implementation Examples
Backend Integration
from .telemetry import record_habit_completion
# In habit completion endpoint
result = gamification.process_habit_completion(db, user.id, habit_id)
# Record telemetry
record_habit_completion(db, user.id, habit.difficulty, result.get('xp_awarded', 0))
Frontend Integration
import { useTelemetry } from '../hooks/useTelemetry';
const MyComponent = () => {
const { trackFeatureUsage, trackInteraction } = useTelemetry();
const handleAnalyticsView = () => {
trackFeatureUsage('analytics_dashboard');
};
const handleButtonClick = () => {
trackInteraction('button_click', 'navigation', 'analytics');
};
};
Security Considerations
Data Sanitization
All event properties are sanitized to remove:
- Strings longer than 100 characters
- Non-whitelisted property keys
- Potentially identifying information
Access Control
- User events require authentication
- Admin analytics require admin role
- Anonymous events allowed for error reporting
Monitoring and Analytics
Admin Dashboard
Administrators can view:
- Total events and unique users
- Event type distribution
- Usage trends over time
- Performance insights
Metrics Available
- Daily/weekly/monthly active users
- Feature adoption rates
- Error rates and types
- User engagement patterns
Troubleshooting
Common Issues
- Telemetry not recording
- Check
TELEMETRY_ENABLEDenvironment variable - Verify user has given consent
- Check database connectivity
- Admin dashboard empty
- Verify admin role permissions
- Check if telemetry is globally enabled
- Ensure events are being recorded
- Consent not saving
- Check authentication token
- Verify database write permissions
- Check API endpoint configuration
Future Enhancements
- Real-time event streaming
- Advanced user behavior analytics
- A/B testing framework integration
- Performance monitoring dashboard
- Automated privacy compliance reports
API Reference
Endpoints
POST /api/v1/telemetry/consent
GET /api/v1/telemetry/consent
POST /api/v1/telemetry/event
GET /api/v1/admin/telemetry/stats
Event Recording Functions
# Direct event recording
record_event(db, user_id, event_name, properties)
# Convenience functions
record_habit_completion(db, user_id, difficulty, xp_awarded)
record_achievement_earned(db, user_id, achievement_type, xp_awarded)
record_level_up(db, user_id, old_level, new_level)
record_feature_usage(db, user_id, feature, duration)
record_error(db, user_id, error_type, context)