Trackers and telemetry

Outbound ships a database of telemetry endpoints: the analytics, crash reporting, advertising and similar servers that apps talk to. It uses the database to label connections, to power the Tracking Report, and to build blocking rules when you ask.

Labels in the monitor and alerts

Wherever a server is shown, the Network Monitor and the connection alert can show a tracker label. The help on it is “Why this label”. Opening it shows the owner, the category, whether the endpoint sends data or fetches settings, what blocking it would do, and the sources Outbound checked. A catalogue company can be opened in the Tracker Database from there. A name-only guess has no company to open.

Two wordings:

• A row from the database: “From Outbound’s tracker database, checked against the company’s own documentation.” The title is the company.
• A guess from the server’s name alone. The title is Possible telemetry, and the sheet says “Guessed from the server’s name only. Outbound does not know this company.”

What the categories mean

Each endpoint carries one category. Settings › Telemetry and the Tracker Database use these sentences:

Category	What it covers
Analytics	Counts which features you use and how you move through an app.
Crash reporting	Sends error and crash reports to the developer’s service.
Logging	Sends an app’s activity logs to a logging service.
Feature flags	Reports which experiments and feature flags an app showed you.
Advertising	Ad networks and the services that measure ads.
Attribution	Measures which ad or link led to an install or sign-up.
Session replay	Records taps, scrolls and screens so a developer can replay a visit.
Diagnostics	Reports on how an app or the system is running, so its maker can find problems.
Essential	Services apps need to work, such as sign-in, updates and package downloads. Outbound never blocks them.
Unknown	The category exists. The pane shows no sentence for it.

Blocking known telemetry

Settings › Telemetry has Block known telemetry. It is off until you turn it on. The categories that can be ticked start ticked: Analytics, Crash reporting, Logging, Feature flags, Advertising, Attribution and Session replay. Diagnostics, Essential and Unknown are not offered, and a settings file that names them is ignored.

Example data.

When the switch is on, Outbound builds one rule group, Known telemetry, of block rules for catalogue endpoints that are telemetry, receive events, and do not change how the app works. Endpoints that fetch configuration, mix the two, or would degrade or break the app are labelled and never blocked. A rule is one host or one domain, outgoing, any app, forever.

The caption under the switch counts the current selection: “Blocks N known telemetry endpoints from M companies.” or, while the switch is off, “Turn on to block N known telemetry endpoints from M companies.” The coverage line is “Outbound recognises N telemetry endpoints from M companies. Some apps send data through their own domains, which no list can recognise, so this cannot promise that all telemetry is off.” The footer is “Telemetry database version version”, or “No telemetry database is loaded.” when none is.

Never blocked expands to: “Outbound never blocks model APIs, sign-in, updates or package registries, because blocking them would stop the app or tool from working. Apple’s own diagnostics are labelled but not blocked. To turn them off, use System Settings › Privacy & Security › Analytics & Improvements.”

Turning telemetry off for one app

Selecting Turn off telemetry for an app opens a sheet with:

• The companies the app was seen sending to.
• The opt-outs the developer documents, each ready to copy. The kinds are an environment variable (export NAME=value), a line for a config file (JSON as a quoted key, TOML and INI as key = value, YAML as key: value), a command, a defaults write line, or the place in the app’s own settings.
• The same opt-outs for tools that run inside the app, such as Next.js inside node.
• A switch that adds the app to the blocked apps, where blocking is safe.

Example data.

The block switch is offered only when the database has blockable endpoints for the app. Generic runtimes (node, python, curl, a browser engine) are excluded, because blocking them by name would block everything they run. When the developer documents no switch, the sheet says “This app’s maker does not document a switch for its telemetry.”

Apps you turned telemetry off for are listed under Apps with telemetry turned off, with a Remove button each. This list is independent of the master switch: an app on it stays blocked when Block known telemetry is off.

Where else the database shows up

The Tracking Report sums up tracker connections over a period, and the Overview shows today’s count. outboundctl telemetry can classify a host, show an app’s opt-outs and print the database version. See outboundctl.