Questions about the host helper: relay operator, build provenance, and telemetry

[thiagocmagero]

Hi I'm evaluating Onepilot for a VPS that runs a staging environment, and
before installing the host helper I'd like to understand a few things that
aren't covered in the docs. Asking publicly since these seem generally useful.
Happy to move any of it to email if you'd prefer.

1. Build provenance of the npm package

npm install -g onepilot --include=optional pulls prebuilt platform binaries.
Is the source for those binaries published anywhere, and which repo/commit are
they built from? Are the builds reproducible, or is there a way to verify that
a published binary matches a given commit?

2. The relay

The support docs mention onepilot relay status, and the overview says a host
behind NAT "can dial out and hold the connection open". Could you clarify:

• Who operates the relay, and where is it hosted?
• Is the traffic passing through it end-to-end encrypted between the phone and
  the host, such that the relay operator cannot read the session?
• Is the relay opt-in? On a host with a public IP and reachable SSH, is any
  outbound connection made at all?

3. Telemetry and outbound connections

With the relay unused, does the daemon make any outbound connections -
telemetry, crash reporting, update checks, license/pairing validation? If so,
to which endpoints, and can they be disabled?

4. Privileges

Which user does the daemon run as, and does it require (or benefit from) sudo
or membership in the docker group? On a host where the login user is in the
docker group, that's effectively root - I'd like to know what the helper's
actual privilege footprint is.

5. "No hosted backend" vs. the privacy policy

The site says there's no hosted backend and no accounts to create, but the
privacy policy mentions collecting an email address for signup and "basic usage
analytics". Could you reconcile the two? Which parts of the product involve
servers you operate?

6. Data controller (GDPR)

I'm in the EU. The privacy policy lists a contact address but no legal entity
or jurisdiction. Who is the data controller for GDPR purposes?

7. Pairing side effects and uninstall

Does onepilot pair write anything to ~/.ssh (e.g. authorized_keys) or
install a systemd/launchd unit? What exactly do the cleanup flags remove, and
does uninstalling revoke any access previously granted to a paired device?

Thanks for the work on this - the product looks genuinely useful, I'd just like
to understand the trust boundary before putting it on my VPS.