Telemetry
As part of our commitment to transparency, this page explains what usage data IDA sends to Hex-Rays, why we collect it, and how we protect it.
In short
Only IDA Free sends usage statistics. IDA Pro, IDA Home and IDA Classroom contain no telemetry code at all.
One small report per session. When you close a database, IDA Free sends one summary of that session.
Never your binary or your work. No file contents, file names, addresses, function names, comments or decompiled code are sent.
No link to your identity or license. Reports use a pseudonymous device ID that Hex-Rays cannot trace back to a person or a license.
Stored in the EU and kept for one year.
Who is affected
IDA Free
Sent at the end of each database session
No. It’s a condition of using IDA Free. IDA Home, IDA Pro & IDA Headless collect no statistics.
IDA Home
Not collected. The feature is not built into this edition.
Nothing to turn off
IDA Pro
Not collected. The feature is not built into this edition.
Nothing to turn off
IDA Classroom
Not collected. The feature is not built into this edition.
Nothing to turn off
What we collect
Each report describes one database session and contains:
Session
Open and close time, duration, whether the database is new
How long people work in IDA
IDA and system
IDA version, operating system, CPU architecture
Which platforms and versions to support
License
Edition, license type
How IDA Free is used and how to improve the product
Input file
Processor module, file format, size range (for example 1 to 10 MB), bitness, endianness, function count, MD5 and SHA-256 hash
Which architectures and formats matter most
Activity counts
Number of renames, comments, functions created, types applied, saves
Which features people rely on
Activity is counted, not recorded: we know that you renamed 12 items, not what you renamed them to.
About file hashes. The MD5 and SHA-256 hashes do not contain your file, but they uniquely identify it. If the binary is public (for example a known malware sample), its hash can be matched against public databases. If this matters for your work, use IDA Pro or IDA Home, which send nothing.
The full field list is in the technical reference.
What we never collect
The binary itself or any part of it
File names or paths
Addresses, names, comments, types or any other database content
Decompiler output
Personal data: your hostname, MAC address, IP-derived location, name, email or license ID
Why we collect it
We use usage statistics to improve the stability, performance and features of our products.
We do not use usage statistics for advertising, we do not sell them, and we do not use them to train AI models.
How reports are identified
Each report carries a device ID calculated on your machine from its hostname and network card address. Only the resulting one-way hash is sent; the hostname and MAC address never leave your computer. Reports from the same machine share this ID, so we can count machines without knowing whose they are. Your license ID is deliberately not part of it.
Offline and firewalled machines
Telemetry never blocks or slows IDA. If a report cannot be delivered, it is saved locally and retried later. The local queue is capped at 500 reports or 4 MB, oldest first. You can read it at any time:
Linux and macOS:
~/.idapro/ida-telemetry.jsonlWindows:
%APPDATA%\Hex-Rays\IDA\ida-telemetry.jsonl
A machine that never reaches our server sends nothing.
How we protect your data
Reports are sent over HTTPS and stored in the European Union.
Access is limited to authorised Hex-Rays staff.
We do not attempt to re-identify users from usage statistics.
Reports are kept for one year and then deleted.
Contact
Questions about telemetry: support@hex-rays.com.
Technical reference
This section is for administrators, security reviewers and anyone who wants to verify exactly what IDA Free sends.
Network
IDA Free sends one JSON document per session by HTTPS POST to https://es.eu.hex-rays.com. To allow or block it at a firewall, use that host name. Blocking it does not affect IDA; reports stay in the local queue described above.
Event: ida_session
Sent when you close a database, or quit IDA with a database open. Activity counters start after initial auto-analysis on a new database and count IDA kernel events, not keystrokes.
schema_version
integer
5
Report format version
@timestamp
date
2026-09-04T08:12:00Z
Session close time (UTC)
event
keyword
ida_session
Event type
session_id
keyword
a1b2c3d4e5f6...
Random ID for this database session
anon_id
keyword
6fabf9a4d6d725191445d1366e5b7d83
Pseudonymous device ID (see below)
session.start / session.end
date
2026-09-04T07:01:00Z
Database open and close time (UTC)
session.duration_sec
integer
4260
Session length in seconds
session.new_database
boolean
true
Database created in this session
ida.version
keyword
9.5
IDA version
ida.sdk_version
integer
950
SDK version number
platform.os / platform.arch / platform.os_version
keyword
macos / arm64 / 15.5
Host system
license.type / license.edition
keyword
named / ida-free
License type and edition
input.processor
keyword
metapc
Processor module
input.file_format
keyword
PE
File format name
input.size_bucket
keyword
1-10MB
Size range, not exact size
input.md5 / input.sha256
keyword
9e107d9d372bb682...
Hashes of the input file
input.is_64bit / input.bits / input.endian
boolean / integer / keyword
true / 64 / little
Address size, bitness, byte order
input.function_count
integer
1842
Functions at close
activity.renames
integer
12
Names assigned or changed
activity.comments
integer
7
Comments added or changed
activity.functions_created / _deleted
integer
3 / 1
Functions created and deleted
activity.code_created / data_created
integer
150 / 20
Instruction and data items created
activity.types_applied
integer
5
Types applied or changed
activity.operand_changes
integer
8
Operand representation changes
activity.bytes_patched
integer
4
Bytes patched
activity.segments_added
integer
1
Segments created
activity.saves
integer
2
Database saves
How the device ID is calculated
The device ID is calculated locally so it can be checked independently:
The hostname is as reported by the operating system (empty if unreadable). The MAC address is the first usable interface, uppercase and colon-separated. Worked example:
The hostname and MAC address never leave your machine. Hex-Rays does not have them, so it cannot reverse the ID. Someone who already knows both values for your machine could recompute it.
Inspecting what is sent
Every report IDA could not deliver is in ida-telemetry.jsonl, one JSON document per line, in the same format as the table above. [Optional: add a way to log every outgoing report, for example an environment variable, so security teams can audit sends on a connected machine.]
Last updated
Was this helpful?
