From e1a98edc94b8570f528c7037bb81c85b83937de5 Mon Sep 17 00:00:00 2001
From: Daniel Sauble <daniel@flox.dev>
Date: Fri, 2 Oct 2026 01:38:38 +0000
Subject: [PATCH] docs(authentication): add an FAQ entry on usage metrics

Add an FAQ entry on the authentication page covering what data
authenticated users send and how to send less.

Scoped to what the docs already assert: the metrics payload documented in
flox-config (a unique token and the subcommand issued), both documented
ways to switch it off, and a link to the privacy policy. Deliberately does
not claim we collect no code or IP -- that assurance is not in the privacy
policy today, and resolution does send package descriptors to the catalog,
so a blanket sentence would be wrong.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 concepts/authentication.mdx | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/concepts/authentication.mdx b/concepts/authentication.mdx
index 7b963e1..330d847 100644
--- a/concepts/authentication.mdx
+++ b/concepts/authentication.mdx
@@ -161,6 +161,20 @@ The [CI/CD tutorial](/tutorials/ci-cd) covers setup on specific platforms.
     takes under a minute.
   </Accordion>
 
+  <Accordion title="What usage data does the CLI send, and can I turn it off?">
+    Flox collects basic usage metrics. The
+    [documented payload](/man/flox-config#environment-variables) is a unique
+    token and the subcommand you ran. You can turn it off:
+
+    ```bash
+    flox config --set disable_metrics true
+    ```
+
+    Or set `FLOX_DISABLE_METRICS=true` in the environment, which is usually
+    easier in CI. Our [privacy policy](https://flox.dev/privacy-policy) covers
+    how we handle the data we do collect.
+  </Accordion>
+
   <Accordion title="Do you have an option that isn't public FloxHub?">
     Yes. FloxHub Enterprise runs on your own infrastructure. Email
     hello@flox.dev for more information.