The manager worker reports to stats.firestar.link after a drive and once after startup with a valid clock. It starts requests only while offroad. Reporting failures do not affect manager process health or engagement.

Reports contain the branch and commit, device type, vehicle fingerprint, last verified running model, cumulative usage, regional location, and settings. They exclude VIN, recordings, passwords, pairing credentials, and exact GPS. Location lookup receives whole-degree coordinates and reports a nearby city center when available, otherwise the coarse coordinates.

Settings come from the existing typed UI owners. Ordinary Boolean, bounded numeric, and fixed-choice rows are collected automatically. Raw Params dumps, source documents, actions, free text, and user-defined sound-pack names are excluded. Each field records the saved value and its owner-defined default where available; it does not imply that the feature was actively controlling the car.

The Influx write API uses organization and bucket StarPilot with built-in client authentication. Operators can override it with STARPILOT_STATS_TOKEN or /data/starpilot/analytics/token (a regular file with mode 0600, owned by root or the manager user). STARPILOT_STATS_TOKEN_FILE selects another file. UsageStatsStatus records the local reporting state without secrets or response bodies. UsageStatsState retains counters and sanitized last-drive context.

Run the mocked network, privacy, owner, and lifecycle checks with:

./dev python -m pytest -q openpilot/starpilot/analytics/tests

These checks also run in ./test. No test sends statistics to production.