How to Check If a Windows App Has Telemetry

To check whether a Windows app has telemetry, start with what the developer documents (privacy policy, settings, and source code if it's open), then confirm it by watching the app's network connections while you use it. TCPView or Resource Monitor shows which servers the app connects to. A packet capture with Windows' built-in pktmon adds the timing and host names. An app with no telemetry should only connect when it has a stated reason, such as an update check.

What counts as telemetry

Telemetry is data an app sends home about how it's used or how it's running. Common types:

• Usage analytics: which features you open, how long sessions last, button clicks.
• Crash and error reports: stack traces and system details sent when something fails.
• Device and install data: OS version, app version, a machine or install ID.

Not every connection is telemetry. Update checks, license checks, sync you turned on, and content you asked for (opening a link, fetching an image) are network traffic with a user-facing purpose. Telemetry-free apps can still make those. The question is whether each connection matches something the app tells you about.

Step 1: Read what the developer says

1. Privacy policy. Look for "analytics", "diagnostics", "crash reports" and named third-party services.
2. Settings. Search for an opt-out such as "send usage data" or "send crash reports". An opt-out means telemetry exists and is on by default.
3. Store listing. Microsoft Store listings link to the app's privacy policy.

This tells you what's claimed. The next steps check it.

Step 2: Search the source code (open-source apps)

If the code is public, search the repository for well-known analytics and crash-reporting services and the words developers use for them:

• sentry, posthog, amplitude, mixpanel, segment
• analytics, telemetry, crashReporter

Also check the dependency list (package.json for Electron apps, Cargo.toml for Rust and Tauri apps). A hit isn't proof of tracking; crash reporting may be opt-in. A clean result isn't proof either, because the installer you downloaded might not be built from exactly the code you read. That's why the network check matters.

Is your Electron clipboard app spying? How to check its IPC shows how to read an Electron app's code from a user's point of view.

Step 3: Watch which servers the app connects to

TCPView, a free Microsoft Sysinternals tool, lists every network connection on the PC with the program that owns it. Resource Monitor, built into Windows, shows the same thing on its Network tab.

1. Close other apps you don't need, so the list is short.
2. Open TCPView (or run resmon and open the Network tab).
3. Find the app's process name and watch its rows.
4. Start the app, leave it idle for a few minutes, then use its main features.
5. Note each remote address and when it appeared.

Connections that appear the moment you launch, before you've done anything, deserve the most attention. So does a steady stream of short connections while you work.

For a clipboard manager specifically, how to audit whether a clipboard app talks to the network adds a second test: block the app in Windows Defender Firewall and see what still works.

Step 4: Capture packets for host names and timing

TCPView shows IP addresses. To see host names, record a packet capture and open it in Wireshark. Windows 10 (version 2004 and later) and Windows 11 include pktmon for this.

Open a terminal as administrator and run:

pktmon start --capture --comp nics --file-name C:\Temp\app.etl

Use the app for a few minutes, then stop and convert the capture:

pktmon stop
pktmon etl2pcap C:\Temp\app.etl --out C:\Temp\app.pcapng

Create C:\Temp first if it doesn't exist. Open app.pcapng in Wireshark and look at DNS queries and the server names in TLS connections; together they show which hosts were contacted. Hosts belonging to analytics or crash-reporting services stand out quickly.

Two limits apply. A packet capture records every program on the PC, not just the one you're testing, so match times against what you saw in TCPView. And almost all traffic is encrypted, so you'll see where data went and how much, not what was in it.

Step 5: Separate Windows' own traffic

Windows itself contacts Microsoft for updates, Defender signatures, time sync and diagnostic data. Capture a few quiet minutes before launching the app so you know what normal looks like. To change what Windows sends about you, go to Settings > Privacy & security > Diagnostics & feedback.

Reading the results

What Edge Drop connects to

Edge Drop, the clipboard shelf made by the team behind this site, has no telemetry, analytics or crash reporting. If you run the checks above on it, these are the only connections you should see:

• GitHub installer build: an update check against GitHub Releases 3 seconds after launch when updates are set to Automatic or Notify me, plus the update download in Automatic mode. Check for updates contacts api.github.com. With updates set to Off, there's no automatic network traffic.
• Microsoft Store build: no update traffic from the app; the Store handles updates.
• Both builds: if you drag an image from a web page onto the shelf and the browser only passes its web address, Edge Drop downloads that image.

Link previews are built offline from the URL itself, so copying a link doesn't contact the site. Links you click open in your browser, not inside the app. Is Edge Drop safe? covers the two builds in more detail.

FAQ

Is an update check telemetry?

Not by itself. An update check reveals your IP address and that you run the app, and sometimes the version. Whether it's acceptable depends on whether you can turn it off and whether it sends anything else.

Can a firewall block telemetry?

Yes. An outbound block rule in Windows Defender Firewall stops a desktop app from connecting anywhere, which also stops update checks and any online features.

Do open-source apps never have telemetry?

No. Some open-source apps include opt-in or opt-out analytics. Open source means you can check, not that there's nothing to find.

Related reading

• How to Audit Whether a Clipboard App Talks to the Network
• How to Check an Electron App's Security Settings (IPC)
• Most Private Clipboard Managers for Windows, Compared
• Is a Clipboard App Safe? 7 Red Flags to Check First

Sources

• TCPView (Microsoft Sysinternals) — connections listed with their owning process.
• Packet Monitor (Microsoft Learn) — built-in packet capture, available from build 19041.
• pktmon start (Microsoft Learn) — capture, component and file-name options.
• pktmon etl2pcap (Microsoft Learn) — converting a capture for Wireshark.
• Wireshark User's Guide (Wireshark) — reading capture files.
• Configure Windows diagnostic data (Microsoft Learn) — what Windows itself sends.

Copy. Stack. Drop.

Transform your clipboard into an interactive edge shelf. Stack, pin, and drag assets into any app with zero friction.

Download for Windows Get from Microsoft Store

How to Install Guide · First 10 Minutes Guide · Drag & Drop Guide · Edge Drop vs Win+V · Support