What telemetry is sent, and what is not

Telemetry is off until you switch it on. When on, the events this app already records in its own activity log are mirrored to the hub: things like a sign-in, a payment recorded, a push sent. Before anything leaves the server it is scrubbed of names, email addresses and payment references, and each event is tagged with an anonymous per-day identifier rather than anything that names a person. The scope decides whose activity is sent: staff-only is the default and the safe choice, because staff events carry no client data. Sending client activity to a third party is a data-protection decision under UK and EU law, so it is a deliberate opt-in and, even then, carries only an anonymous id. A slow or unreachable hub is never waited on: telemetry is sent in the background and its failure is invisible to everyone using the app.