Cherry Studio was exposed for continuing to secretly transmit device information after turning off "Anonymous Statistics," with the author admitting the switch failed.

ME News message, April 20 (UTC+8). According to Dongcha Beating monitoring, the open-source AI client Cherry Studio was found by users to have a malfunctioning privacy switch. GitHub user Yuerchu posted a packet-capture screenshot in Issue #14387: after turning off “Anonymous error reporting and data statistics,” the client continued to send requests to analytics.cherry-ai.com.

Cherry Studio is led by domestic developer kangfenmao. It supports aggregating multiple large language models and includes a local knowledge base, making it one of the most popular open-source AI desktop clients among users in China.

The client reports three types of events in total: every AI conversation, every app startup, and every update check. Only the conversation one respects the user’s settings; the other two bypass the switch and send requests directly. Each request includes a dedicated device ID, plus system information, CPU architecture, app version, and more—adding up to long-term tracking of that computer.

By looking through the code, it can be seen that when this reporting mechanism was added in February 2026, the switch was effective. By March 22, maintainer kangfenmao had modified it, deleting the switch check and, along with that, putting more device information into the request headers. This round of changes ran for a month across four versions: v1.8.3, v1.8.4, v1.9.0, and v1.9.1.

kangfenmao acknowledged the issue in the issue thread and explained that different events used different switch-checking logic: after turning off the setting, requests for app startup and update checks were not blocked. Sensitive data such as chat content, user input, files, and API keys do not go through this channel. The fix PR #14390 has been merged, and all three event types now use the same switch.

There is an even earlier layer to the matter. After digging through older code, the community found that when the project first added analytics functionality in February 2025, it also included an upgrade script: for users upgrading from older versions, this “anonymous statistics” switch would be automatically turned on once. Since then, the analytics backend service has changed from Google Analytics to PostHog and Sentry, and then to the currently self-hosted analytics.cherry-ai.com—but the code that automatically turns on the switch has never been removed. That means for users who installed Cherry Studio before February 2025 and later upgraded, regardless of whether they had manually turned off the switch at the time, the switch would be turned on again during the upgrade. If they want to turn it off, they would need to manually switch it off again after upgrading.

(Source: BlockBeats)