Privacy
What leaves your machine, stated plainly.
Most privacy pages are a list of the things a product would like permission to do. This is a list of what VolnOS actually sends, which is very little, and it includes the part that is inconvenient to admit.
The short version
VolnOS has no account system, no telemetry, and no advertising. Nothing about you is collected, stored or transmitted by the operating system itself.
The one component that sends anything is the assistant, and only while you are talking to it: your message and the output of any tool it ran go to the endpoint you chose. Choose an endpoint on your own machine and nothing leaves it at all.
What is not there
These are absences, not settings: packages removed during the build, so there is nothing to switch off and nothing to switch itself back on:
ubuntu-report, Ubuntu's install-time hardware and configuration report.popularity-contest, the package-popularity survey.whoopsieandapportfor automatic crash reporting and its upload daemon.- The MOTD news fetcher, which pulls remote text on login.
There is also no VolnOS account, no licence check, no activation, and no server of ours that a running system contacts on its own.
The assistant
This is the only part of VolnOS that sends anything, and it is worth being precise.
What is sent
When you send a message: that message, the conversation so far, and the output
of any tool the assistant ran during the turn. Tools such as
read_logs, search_files
and system_info can carry personal data in their
output. That is the nature of asking a question about your own machine, and it
is why those tools are named here rather than buried.
Where it goes
To the endpoint configured in Control Panel → Assistant, and onward to whoever serves the model you picked. That may be a hosted gateway, or it may be a server on your own machine or network, in which case the traffic never leaves your hardware. VolnOS ships no model precisely so that this stays your decision.
When
Only during a turn you started. Nothing is sent while the assistant is idle, and there is no background synchronisation, no usage beacon and no “help us improve” channel.
The ten free questions
An image may carry one credential of ours so the assistant works before you have a key: ten questions a day, on a route that belongs to the image, with endpoint, model and token all fixed at build time. Those questions travel to our gateway, which means traffic on that route is visible to whoever operates it. Your own key is never sent there, and picking your own endpoint replaces the route entirely.
Your key
An API key you add is stored in your login keyring, not in a configuration file and not in the image, and is only ever sent to the endpoint you attached it to.
Updates
Updates are ordinary apt over HTTPS, from a channel whose indexes are signed with a GPG key baked into the image. Two consequences:
- Downloading an update reveals to whoever serves the store what any file download reveals: your IP address and which file you asked for. No identifier, machine fingerprint or account is attached, because none exists.
- Integrity does not depend on that server being honest. apt verifies the signature before it installs anything, so a tampered mirror fails rather than succeeds quietly.
- Those requests are counted, in aggregate. Two numbers are published at /api/downloads: how many times the update index was fetched, and how many packages were sent. Both come from the host's ordinary request logs after the fact, so nothing extra is sent by your machine, nothing is stored against it, and no request is tied to any other. Because nothing identifies a machine, these are request counts and not a headcount: a computer that checks daily is counted once per check.
This is the closest VolnOS gets to knowing how many people use it, and it is deliberately not very close. The alternative, having the system report itself, is the thing the rest of this page exists to refuse.
This website
No cookies. No advertising or tracking scripts. No fonts, stylesheets or images loaded from anyone else's server; the one stylesheet comes from this site. The page you are reading makes zero external requests, and its content security policy forbids them.
It is served by Cloudflare, which keeps the standard request logs any web host keeps. The version and checksum shown here are read from the update store by the server, not by your browser, so loading this page does not make your browser contact the store at all.
Downloads are counted
This is the inconvenient part, so here it is in full. When you click Download, the server adds one to a tally. Four things are recorded with it: that it was the ISO rather than the checksum, which release, the two-letter country code Cloudflare already has for your connection, and the website you arrived from if any. Nothing else: no IP address, no hash of one, no cookie, no identifier of any kind, and so no way to tell one visitor from another or to recognise you on a second visit.
Two consequences follow. Downloading twice counts twice, and this can only ever be a count of downloads, because counting installations would mean an installed machine contacting a server of ours, which is exactly what the rest of this page says it never does. The totals are public at /api/downloads, so the figure on the front page is checkable.
What you can change
- Point the assistant at a different endpoint, or at your own hardware, in Control Panel → Assistant.
- Remove your API key from your login keyring at any time; the assistant falls back to asking for one.
- Land on the desktop instead of the assistant, also in Control Panel → Assistant. Nothing about the desktop depends on it.
- Decline any change the assistant proposes. Declining is a normal outcome: it is told you said no, and told not to try again.
Questions about this
Ask on the public tracker, or write to updates@volnos.org. If something on this page turns out to be wrong, that is a bug in the page and it will be fixed.