Here's a privacy setting that didn't do what it said on the tin. A GitHub user discovered that Cherry Studio, an open-source AI desktop client, was sending analytics data even when users had explicitly turned off the "anonymous error reporting and statistics" option.
GitHub user Yuerchu posted packet capture screenshots in Issue #14387 showing that after disabling the setting, the client kept pinging http://analytics.cherry-ai.com.
Cherry Studio is led by Chinese developer @kangfenmao and aggregates multiple large language models with local knowledge base support. It's one of the most popular open-source AI desktop clients among Chinese users.
What Was Being Sent?
The client reports three types of events: every AI conversation, every app launch, and every update check. Only the conversation event respected the user's privacy setting; the other two simply bypassed the switch and sent data anyway.
Each request carried a unique device ID, plus system info, CPU architecture, and app version—effectively creating a long-term tracking profile for that computer.
How Did This Happen?
When this reporting mechanism was first added in February 2026, the privacy switch actually worked. Then on March 22, maintainer kangfenmao made a change that removed the switch check for some events and stuffed even more device information into the request headers.
This broken version ran for a month across four releases: v1.8.3, v1.8.4, v1.9.0, and v1.9.1.
Kangfenmao acknowledged the issue in the GitHub thread, explaining that different events used different logic for checking the privacy setting. When users turned it off, app launches and update checks weren't blocked. He noted that sensitive data like chat content, user inputs, files, and API keys weren't sent through this channel. A fix in PR #14390 has been merged, making all three events use the same switch.
https://twitter.com/YinsenW_/status/2046042068972360005
The Hidden Upgrade Script
But wait, there's more. After analyzing the code with Claude, user @skyJiLine found something even older lurking in the project.
When analytics were first added back in February 2025, the developers also slipped in an upgrade script: any user updating from an older version would have their "anonymous statistics" switch automatically turned on once. As the analytics backend shifted from Google Analytics to PostHog, then Sentry, and finally to the current self-hosted http://analytics.cherry-ai.com, that automatic switch-flipping code was never removed.
So if you installed Cherry Studio before February 2025 and later updated, your privacy setting got re-enabled during the upgrade—regardless of whether you'd manually turned it off. You'd have to go back and disable it again after updating.
This isn't the first time an AI tool has faced scrutiny over its data practices. Earlier this month, Cursor AI was accused of "shelling" Anthropic's Claude code, essentially wrapping another company's core product with minimal changes. Meanwhile, Anthropic continues to push forward with its own developments, recently launching Claude Opus 4.7 with smarter coding capabilities and better vision.