Cherry Studio Exposed for Continuing to Collect Device Information After Disabling "Anonymous Analytics," Author Acknowledges Toggle Failure

According to Intercept Beating monitoring, the open-source AI client Cherry Studio was found by users to have a malfunctioning privacy toggle. GitHub user Yuerchu posted packet capture screenshots in Issue #14387: even after turning off the "Send anonymous error reports and data statistics" option, the client continued to send requests to analytics.cherry-ai.com. Cherry Studio, led by domestic developer kangfenmao, supports aggregation of multiple large models and a local knowledge base, and is one of the largest open-source AI desktop clients in terms of user base in China.

The client reports three types of events in total: each AI conversation, each application launch, and each update check. Only the conversation event respects the user's setting, while the other two events bypass the toggle and are sent out. Each request carries a unique device ID, along with system information, CPU architecture, application version, effectively enabling long-term tracking of the computer.

Upon inspecting the code, it is revealed that when this reporting mechanism was first added in February 2026, the toggle was effective. By March 22, maintainer kangfenmao himself made a version change, removing the toggle check and adding more device information to the request header. This version modification ran for a month in versions v1.8.3, v1.8.4, v1.9.0, and v1.9.1.

In response to the issue, kangfenmao acknowledged the problem in the issue thread and explained that different events used different toggle logic, so when the setting was turned off, the requests for application launch and update check were not blocked; sensitive data such as chat content, user input, files, and API keys did not flow through this channel. The fix in PR #14390 has been merged, and all three types of events now follow the same toggle.

There is an earlier layer to this issue. Community members examining old code discovered that when the analysis feature was first added to the project in February 2025, an upgrade script was also introduced: for users upgrading from an older version, the "anonymous statistics" toggle would be automatically turned on once. Subsequently, the analysis service backend transitioned from Google Analytics to PostHog, Sentry, and then to the current self-hosted analytics.cherry-ai.com, but the code for this automatic toggle remains unremoved. This means that users who installed Cherry Studio before February 2025 and then upgraded, regardless of whether they manually toggled this setting initially, would have the toggle automatically turned on again during the upgrade, requiring them to manually turn it off again after the update.