ArtCraft telemetry: the app loads Microsoft Clarity and a Google tag before you sign in

A sign-up form is usually the first place you type something private into a new app. We opened ArtCraft 0.41.0 on our test machine and touched nothing, and with no one signed in its window had fetched 189,032 bytes from Google Tag Manager and sent 13,501 bytes to an address we later matched to Microsoft Clarity. This is our ArtCraft telemetry record: two runs on 8 October 2026, one with no sign-in and one through account creation, set beside the public source code of the same version.

ArtCraft is a desktop app for AI image and video work, published by the GitHub organisation storytold. Its website calls it open source; its licence file is narrower, as we show below.

What does ArtCraft contact before you sign in?

In run 1 we launched the app from its mounted disk image and left it alone, with the window open from 11:57:48 to 11:59:33. Its own Rust code made 26 connections to api.storyteller.ai, 7 of them in the first second and then one about every 5 seconds. Its interface is a web page inside a WebKit web view, and that web view reached www.googletagmanager.com, www.clarity.ms, fonts.googleapis.com and two addresses we had not yet named.

In run 2 a person created an account and signed in inside the app window, over 2 minutes 10 seconds. Nothing typed was recorded. The Rust side made 32 connections, again only to api.storyteller.ai, and its log shows the paths /v1/create_account and /v1/session. The web view contacted two destinations: www.clarity.ms and 20.85.17.170, which received 26,492 bytes, the largest upload of the run.

In both runs the largest upload from the web view went to a Microsoft Clarity collection host. Google Tag Manager and Google Fonts did not reconnect in run 2. They were most likely cached, and we did not verify that. For scale, when we listed the sockets of LM Studio at rest, it held no outbound connection at all.

How did we measure ArtCraft telemetry, and what can the method not show?

The app ran with its proxy settings pointed at a small logging proxy that records the host name of each connection request and does not intercept TLS. Alongside it, the macOS tool nettop sampled TCP connections every 2 seconds. So we know which hosts received data and how many bytes. We never know what the bytes were.

The proxy log named only the Rust side’s host, so the web view’s hosts had to be named from addresses. In run 1 we did that by resolving candidate host names after the run, which makes those names attributions, not captures. In run 2 we built an address-to-name map every 20 seconds during the run. The two Clarity collection addresses were matched afterwards, by resolving a.clarity.ms through z.clarity.ms: g.clarity.ms resolves to 20.85.17.170 and y.clarity.ms to 172.171.87.38.

That limit matters most for Clarity, which Microsoft describes as a behavioural analytics tool with session recordings and heatmaps. Microsoft’s Clarity masking documentation states: “Content in the input boxes is masked in all modes”. It adds that the default mode, Balanced, treats numbers and email addresses as sensitive. That is Microsoft’s statement about its product. We did not read the upload and cannot see the project’s Clarity settings, so nothing here shows that a keystroke or the sign-up form was recorded.

The binary’s strings contain hosts such as grok.com, sora.chatgpt.com and www.midjourney.com, and markers for the Sentry, Statsig and Amplitude SDKs. Strings are not traffic: nothing went to any of them in either run. No provider was connected and nothing was generated, so this piece says nothing about those paths. And the app’s signature reads Developer ID Application: Learning Machines LLC, notarized; that is what the signature says, and we report it as that. The same rule held in our OpenCode investigation, where a Sentry address found in the bundle counted only once a live socket matched it.

Where does the ArtCraft source load Clarity and the Google tag?

In one file. At the release tag, frontend/apps/artcraft/app/index.html carries both scripts in its head, above the app’s own code:

<script async src="https://www.googletagmanager.com/gtag/js?id=G-Y4Y8KMLPQ7"></script>
t = l.createElement(r); t.async = 1; t.src = "https://www.clarity.ms/tag/" + i;

Neither sits behind a condition. The Tauri configuration file, crates/desktop/artcraft/tauri.conf.json, lists https://*.clarity.ms and https://www.google-analytics.com among the hosts the web view may connect to. A small library, frontend/libs/analytics/google-analytics, sends named events such as enqueue_image and switch_tab, and when a signed-in session loads, the file fetchers.ts passes the account’s user token to the Google tag as user_id. In our record www.google-analytics.com appears only as a string in the binary.

The Rust side has its own report. In storyteller_activity_thread.rs, once a session exists, the app posts to /v1/analytics/active_user_v2 with the app version, the operating system and its version, the session length and counts of what was generated, waiting at least a minute between posts. Our run 2 log does not show that path, so we have the code and no observation of it.

Can you use ArtCraft without the analytics?

From the source and the documents, we found no switch. We read 2,464 text files at the tag and searched them for opt-out and telemetry settings; the hits were code comments about other things. The settings window’s sections are General, Downloads, Accounts, Plan & Credits, Appearance, Keybinds, Alerts and About, and none is for privacy.

Discord rich presence, which shows what you are running on your Discord profile, is the same. The startup routine calls spawn_discord_presence_thread() with no condition around it, and the thread looks for a local Discord client every 10 seconds. When it finds one it sets an activity line that names ArtCraft and refreshes it every 60 seconds. This is a local pipe, not a network connection, and in run 1 it found no Discord.

That leaves building your own copy. The licence file, marked WIP in its own heading, calls the app “fair source” and lists modifying and compiling the code for private personal purposes among the permitted uses. It forbids forks that remove community links, donation links or paid model services. We have not built it.

We found no privacy policy to check this against. The getartcraft.com pages we read link none. The host the app talks to does publish one: the Storyteller AI Privacy Statement at storyteller.ai/privacy, updated November 18, 2022 and issued by Learning Machines, Inc. It says “We run Google Analytics and collect payment information.” It does not mention ArtCraft, Clarity or Microsoft. Both the statement and the app’s source name Google. Clarity is in our measurements and absent from the statement.

What does ArtCraft write to your disk?

Run 1 left three folders under ~/Library (Caches, Logs and WebKit, each named ai.artcraft.app) and a folder called Artcraft in the home directory. After sign-in, ~/Library/Caches/ai.artcraft.app/.cookies was 795 bytes with file mode 644 and held a session cookie and a visitor cookie for api.storyteller.ai.

The debug log in ~/Artcraft carries a 15-character session identifier on every start, before sign-in as well as after. The source generates it fresh at each launch, which puts it on the per-session side of the line we drew when sorting per-session identifiers from permanent machine IDs. The folder ~/Artcraft/credentials stayed empty.

That empty folder is the next thing to watch. Connecting a Midjourney, Sora or Grok account is the step we have not run, and it is the point where another company’s login would have to be held somewhere on this disk. The checks for it are the same ones listed in our telemetry investigations index.