OpenE2EE Relay
Product event catalog
Versioned, privacy-safe website and Relay funnel events with no CLI telemetry.
Catalog version: relay-funnel-v1
Reviewed: 2026-08-26
Status: release-gated until REL1
This catalog is non-authoritative. An event can explain onboarding and product behavior. It cannot authorize a request, calculate exact quota, create a message graph, or produce an invoice value.
Privacy classes
| Class | Identity boundary | Retention and deletion |
|---|---|---|
| Anonymous aggregate | No account, organization, project, device, visitor, session, cookie, or IP-address field. | Cloudflare Workers Analytics Engine keeps it for three months, then expires it. No person identifier exists for a person-level deletion. |
| Project operational | Opaque project or organization handles only. No raw account, device, provider subject, message, attachment, group, certificate, or protocol identifier. | Three months in the non-authoritative funnel dataset. Provider expiry and project purge remove the analytics copy. Authoritative billing, security, and deletion records follow their own policies. |
OpenE2EE never joins an anonymous website event to a person, organization, or project.
Website events active before Relay launch
| Event | Source | Bounded fields |
|---|---|---|
demo_run | Home-page demo | event, path, count |
quickstart_open | Website link | event, path, count |
runtime_select | Runtime link | event, path, expo / browser / node, count |
install_copy | Install-copy action | event, path, count |
guide_finish | Article closing link | event, path, count |
github_open | Repository link | event, path, count |
security_view | Security page | event, path, count |
pricing_view | Pricing page | event, path, count |
signup_start | Console link | event, path, count |
enterprise_contact | Enterprise contact link | event, path, count |
These events have no identifier and no cross-event deduplication. They are aggregate popularity signals. The demo records at most one demo_run for one page load and sends nothing about the typed text.
Managed Relay events activated at REL1
Every project-operational event uses one stable event identifier from its authoritative transition. An exact retry cannot add another event. Common fields include the event name, stable event ID, UTC time, and optional opaque project or organization handles. An event can also contain one bounded plan, runtime, provider, guide, or outcome code.
| Journey | Events | Authoritative source |
|---|---|---|
| Learn and select | quickstart_viewed, local_roundtrip_completed, provider_selected, runtime_selected, guide_selected | Docs or Console selection boundary |
| Initialize | control_operation_first_observed, project_files_initialized, account_created, organization_created, development_environment_provisioned, device_registered_first | The successful control-plane or account transition |
| Deliver | managed_delivery_first_accepted, managed_delivery_first_acknowledged | Mailbox authority |
| Activate production | production_activation_started, production_deploy_planned, production_deploy_confirmed, production_deploy_failed, production_deploy_completed | Project policy and protected deploy result |
| Set up payment | card_setup_started, card_setup_completed, card_setup_failed, card_setup_abandoned | Console and the SetupIntent result |
| Reach a limit | limit_warning, hard_cap_event | Exact quota authority |
| Change plan | upgrade_viewed, upgrade_previewed, upgrade_confirmed, upgrade_failed, upgrade_completed | Console and the versioned plan-control saga |
The bounded plan IDs are relay_free_v1, relay_starter_v1, relay_growth_v1, relay_business_v1, and relay_enterprise_v1. Runtime, provider, guide, and outcome values use reviewed allowlists. Free text is not allowed.
CLI boundary
The CLI sends no analytics beacon and contains no telemetry client. The control plane infers control_operation_first_observed from the first successful authenticated request. It does not claim that the user installed the package. The control plane records project initialization only after it accepts an authenticated initialization request.
The machine-readable source of truth is docs/relay/event-catalog.json in the OpenE2EE operating workspace.