LogForge is provided by 17811365 Canada Incorporated. The public plugin connects to https://usage.logforge.dev/mcp using an account and OAuth. This service processing is distinct from the controllable local aggregate usage reporting described below.
The service stores your chosen username, account identifier, password hash, sessions (which may include network addresses and user-agent details), OAuth client registrations and grants, and connection names, identifiers, credential hashes, expiration, revocation, and last-seen times. The username signup flow creates an internal placeholder email; it does not verify an email address and currently has no email password recovery. Keep your password in a password manager. Account and connection records remain until deletion is requested and verified through adan@logforge.dev; operational backups may retain earlier records until their backup is removed. There is currently no automatic backup retention deadline.
The private relay makes outbound HTTPS connections. Your Central API key stays in protected configuration on its machine and is not sent to the hosted gateway. The gateway queues only allowlisted read-only requests for the authenticated account's linked relay. It cannot execute shell commands or install agents. Existing Central permissions and entitlements continue to apply.
Requested tool results can include application logs, metrics, inventory, alerts, approved file reads, and reports with source excerpts and application data. Share project report directories explicitly. A remote request selects a shared project identifier, never an arbitrary local path. The gateway holds pending requests and results temporarily in memory and does not intentionally archive diagnostic payloads or log request bodies. The requesting AI client (including Claude, Perplexity, ChatGPT and Codex) service processes received results under its own account/workspace policies. This does not promise that all application logs are free of secrets; choose appropriate queries and sharing scope.
HTTPS processing necessarily handles source network addresses. The gateway keeps short-lived rate-limit counters in memory; its authentication provider also stores authentication rate-limit identifiers and counters in its database. Access logging and authentication debug logging are disabled. Infrastructure providers may retain separate operational records.
Stop or revoke a relay to prevent new reads; an in-flight response may already have reached its requester. Unshare a project to stop future report access. Revocation does not erase results already received by the requesting client. Contact adan@logforge.dev for account/data deletion or support, providing your username or connection identifier, never passwords, API keys, relay tokens, or unredacted diagnostic payloads.
Local aggregate reporting is on by default in Codex 0.5.2, Claude 0.2.0 and Perplexity 0.5.2. Disabling it stops local plugin aggregates; it does not disable the service processing required for a requested hosted query. Reporting identities and distribution labels are not verified marketplace installation receipts.
LogForge is a product of 17811365 Canada Incorporated. Starting with Codex 0.5.2, Claude 0.2.0 and Perplexity 0.5.2, local plugin usage reporting is enabled by default on first diagnostic or bridge activity, with disclosure before use and an accessible off switch. Earlier releases retain their earlier defaults. Explicitly saved disabled choices remain disabled after restart and upgrade. It is separate from your application telemetry and your self-hosted LogForge connection. Disabling reporting does not limit plugin functionality.
Unless disabled, the plugin sends daily cumulative usage totals to https://usage.logforge.dev/v1/plugin-reports: a random reporting identity, the UTC day of first observed use, reporting day, plugin version, operating-system family, selected development/production environment and distribution label, bridge starts, connection successes/failures, allowlisted tool call counts, failures, total durations and latency buckets, diagnostic pass/fail counts, output/check/filter/unreached counts, and the languages exercised (JavaScript, TypeScript, Python). Unknown tool names become other. Distribution is self-reported; it is not proof of a marketplace install.
It does not send source code, source snippets, filenames, project names, repository URLs, log contents, .logforge documents, feature tags, prompts, tool arguments/results, queries, raw errors, credentials, hostnames, emails, or AI-provider account identifiers. The application SDKs do not send publisher analytics themselves. The local bridge and diagnostic runner summarize their own activity.
The random reporting token authenticates subsequent reports for the same identity. It is not your LogForge MCP key. On Windows the token uses user-bound DPAPI; elsewhere the state directory/file is owner-only. Local usage state is outside the installed plugin and survives version updates. At most 100 daily/version report snapshots are retained locally, with at most nine UTC days of history; transient failures are retried during later usage. This is best-effort reporting, not an audit log. Abrupt termination or persistent local storage failure can lose counts.
The receiver keeps the latest cumulative report per identity/day/version/distribution/environment until the operator deletes it; there is no automatic server retention deadline. It stores only a hash of the reporting token. Reports are available through the private, authenticated usage dashboard. The HTTP service necessarily processes connection metadata, including the network source address, while receiving requests; the report payload does not contain it. LogForge's receiver disables access logging and uses short-lived hashed addresses for rate limiting. Hosting/network infrastructure may have separate operational records.
Run these commands from the installed plugin directory, using Python 3.10 or newer:
python scripts/logforge_usage.py status
python scripts/logforge_usage.py enable
python scripts/logforge_usage.py preview
python scripts/logforge_usage.py disablepreview shows pending report payloads without the reporting token. disable stops future reports and discards the pending local queue. A request already in flight may finish. It does not erase reports already received. Re-enabling after disabling starts a new random reporting identity; changing the destination also resets the identity and discards pending reports so credentials/data never cross destinations. A copied state file can share an identity, so reporting identities are not a count of distinct people or machines.
For questions or deletion of received usage reports, contact adan@logforge.dev and provide the random instance_id shown by status, never your reporting token or MCP key. Save that identifier before resetting or removing local state. The operator must verify the request before deleting records.
For a development receiver, explicitly select it:
python scripts/logforge_usage.py enable --environment development --endpoint http://127.0.0.1:58001/v1/plugin-reportsHTTPS with normal certificate validation is required except on loopback. Redirects are refused. The default distribution follows distribution.json: local for the personal development package and openai-directory, claude-directory or perplexity-directory for the corresponding distributed build. --distribution explicitly overrides it. This identifies the distributed build, not the installation mechanism: manually copying a directory build retains its label. It is not a verified installation receipt.
The .logforge reports generated for your development task can contain code and application data. They stay in the project unless you share them or your AI client reads them to perform your request. Tool results read by your AI client are subject to your AI client/provider workspace settings and policies. The separate publisher usage feed never uploads those reports.
The builds use distinct product labels: logforge-codex-plugin, logforge-claude-plugin and logforge-perplexity-plugin. Claude and Perplexity use separate reporting state. A saved disabled choice is preserved. Product and distribution labels describe a build; they do not verify the marketplace or identify the AI client making a hosted request. Hosted connector calls do not execute the local reporting helper.
Use the installed package's documented platform-specific environment control before launching a local helper to prevent recording and uploads without creating reporter state. In the full plugin package, run python scripts/logforge_usage.py disable for a persistent off choice, including before first use; pending local reports are discarded. Standalone skills document their equivalent control. Use status and preview to inspect effective settings and pending reports. Explicit enable turns reporting back on, but the environment override takes precedence. Failed reporting never blocks diagnostics.
These controls concern local aggregate reporting. Requested hosted queries still require account, security and transient request processing described above. Local usage reports and hosted traffic are separate measurements, and neither is a verified marketplace installation count.
Hosted gateway reporting defaults on for authenticated requests and executed tool handlers. It records UTC day, server environment (production or development), a bounded configured client label or unknown, public tool name, and request/success/error counts. Analytics contain no account IDs, OAuth client IDs, prompts, tool arguments or results, source code, filenames, tags, credentials, or raw errors. Client labels come from configured authenticated OAuth registrations; discovery clientInfo is not used. These are operational counts, separate from local plugin reports and marketplace installation receipts.
Before your first hosted query, use the reporting checkbox on the authorization page, or sign in at your LogForge account and turn off Share hosted aggregate usage. The choice persists for that account across reconnections and releases. Preference storage identifies the account so its choice can be honored; account identity is excluded from aggregate counters. Turning off stops future optional collection; a request already in flight may finish. Existing merged aggregates cannot be associated with an individual account or removed per account. Daily aggregate counters are retained for 400 days. Counters use a bounded memory buffer and may lose unflushed counts on process termination. Required authentication, rate limits, and processing your requested queries continue. Local plugin reporting has its own separate controls.