diff --git a/README.md b/README.md
index 730f1e7469ef..d01715b55679 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,7 @@ H2O-3 (this repository) is the third incarnation of H2O, and the successor to [H
* [Building H2O on Hadoop](#BuildingHadoop)
* [Sparkling Water](#Sparkling)
* [Documentation](#Documentation)
+* [Privacy & Telemetry](#Privacy)
* [Citing H2O](#Citing)
* [Community](#Community) / [Advisors](#Advisors) / [Investors](#Investors)
@@ -661,8 +662,27 @@ If the build fails, try `gradlew clean`, then `git clean -f`.
Documentation for each bleeding edge nightly build is available on the [nightly build page](http://s3.amazonaws.com/h2o-release/h2o/master/latest.html).
+
+## 9. Privacy & Telemetry
+
+H2O-3 can send anonymous usage telemetry to help us prioritize features and platforms. It is **opt-in and off by default** — nothing is sent unless you turn it on. Here is what happens when enabled:
+
+- **Default is off (opt-in).** Nothing is sent until you explicitly turn telemetry on; the choice is remembered across sessions.
+- **One small ping per `h2o.init()`** plus one per major user action (training, scoring, MOJO download, upload, import, save/load, AutoML). Each ping is ~200 bytes of JSON over HTTPS.
+- **Standalone & Hadoop clusters too.** A cluster started directly with `java -jar h2o.jar` or `hadoop jar h2odriver.jar` can send one ping when the cluster forms — if the server administrator enables it. Same fields.
+- **What's sent:** version strings, OS, an ephemeral session UUID regenerated on every `h2o.init()`, a Unix timestamp, the algorithm name, and coarse bucket labels for counts (rows, columns, durations, sizes) — reported as ranges, not raw integers. One exception: a small cluster's exact node count (1–16) is sent, since 1-node vs 4-node is operationally meaningful; larger clusters are bucketed.
+- **What's never sent:** code, file paths, dataset names, model names, column names, hyperparameter values, hostnames, usernames, email addresses, or any user-generated content.
+- **Turn it on** — any of the following enables telemetry:
+ - **Programmatic, persistent:** call `h2o.set_telemetry(True)` (`h2o.set_telemetry(TRUE)` in R), and read the state with `h2o.telemetry_enabled()`. Applies immediately and is saved under `~/.h2oai` so later sessions honor it.
+ - **This session only:** pass `telemetry=True` (Python) / `telemetry = TRUE` (R) to `h2o.init()` or `h2o.connect()`.
+ - **Config file:** add `general.telemetry = true` under `[general]` in `~/.h2oconfig`.
+ - **JVM cluster:** the admin sets `H2O_ENABLE_TELEMETRY=1` in its environment, or passes `-Dsys.ai.h2o.telemetry.enabled=true`.
+- **Keep it off / turn it back off** — `DO_NOT_TRACK=1` is a hard opt-out that always wins (honored by Python, R, and the JVM server); or use `h2o.set_telemetry(False)`, `telemetry=False`, `general.telemetry = false`, or (JVM) `-Dsys.ai.h2o.telemetry.disabled=true`.
+- **Fire-and-forget.** Every call runs on a background task with a 2-second timeout. If the receiver is unreachable, your code returns exactly as if telemetry never happened — never blocks, never raises, never retries.
+
+
-## 9. Citing H2O
+## 10. Citing H2O
If you use H2O as part of your workflow in a publication, please cite your H2O resource(s) using the following BibTex entry:
@@ -702,7 +722,7 @@ Arora, A., Candel, A., Lanford, J., LeDell, E., and Parmar, V. (Oct. 2016). _Dee
Click, C., Lanford, J., Malohlava, M., Parmar, V., and Roark, H. (Oct. 2016). _Gradient Boosted Models with H2O_. .
-## 10. Community
+## 11. Community
H2O has been built by a great many number of contributors over the years both within H2O.ai (the company) and the greater open source community. You can begin to contribute to H2O by answering [Stack Overflow](http://stackoverflow.com/questions/tagged/h2o) questions or [filing bug reports](https://github.com/h2oai/h2o-3/issues). Please join us!
diff --git a/h2o-docs/src/product/index.rst b/h2o-docs/src/product/index.rst
index db42db053a4a..2f88e14c0211 100644
--- a/h2o-docs/src/product/index.rst
+++ b/h2o-docs/src/product/index.rst
@@ -154,6 +154,11 @@ The following are additional resources to learn more information about H2O-3:
security
+.. toctree::
+ :maxdepth: 2
+
+ telemetry
+
.. toctree::
:maxdepth: 1
diff --git a/h2o-docs/src/product/telemetry.rst b/h2o-docs/src/product/telemetry.rst
new file mode 100644
index 000000000000..76537ed36d35
--- /dev/null
+++ b/h2o-docs/src/product/telemetry.rst
@@ -0,0 +1,67 @@
+Telemetry
+=========
+
+Starting with version **3.46.0.12**, H2O-3 can send anonymous usage telemetry to help the team prioritize features and platforms. It is **opt-in and off by default** — nothing is sent unless you turn it on. It is also designed to be invisible when enabled: every send is fire-and-forget with a short timeout, so if the receiver is unreachable your code behaves exactly as if telemetry never ran — it never blocks, raises, or retries.
+
+What is sent (when enabled)
+---------------------------
+
+- One small ping when you start or connect to H2O (``h2o.init()`` / ``h2o.connect()`` in Python or R, or a standalone ``java -jar h2o.jar`` / ``hadoop jar h2odriver.jar`` cluster), plus one per major action: training, scoring, MOJO and model download, upload, import, parse, AutoML, and model save/load.
+- Each ping contains the H2O version, the client (``python`` / ``r`` / ``jvm``), the operating system, an ephemeral session ID regenerated on every start, a timestamp, the algorithm name, and **coarse range buckets** for counts such as rows, columns, durations, and sizes. These counts are reported as ranges rather than exact figures. One notable exception: a small cluster's node count (1–16) is sent exactly, since 1-node vs 4-node is operationally meaningful; larger clusters are bucketed.
+
+What is never sent
+------------------
+
+Code, file paths, dataset or model names, column names, parameter values, hostnames, usernames, email addresses, or any user-generated content.
+
+Enabling telemetry
+------------------
+
+Telemetry is **off by default**. Any one of the following turns it on:
+
+**Per session** (applies to the current process only):
+
+- Pass ``telemetry=True`` (Python) or ``telemetry = TRUE`` (R) to ``h2o.init()`` or ``h2o.connect()``.
+
+**Persistent** (remembered across sessions):
+
+- **Programmatic switch** — use the setter ``h2o.set_telemetry()`` to change telemetry and the getter ``h2o.telemetry_enabled()`` to read the current state. Both are available in the Python and R clients; the setting applies immediately and is saved under ``~/.h2oai/telemetry`` so later sessions honor it.
+
+ Python:
+
+ .. code-block:: python
+
+ h2o.set_telemetry(True) # opt in (persisted across sessions)
+ h2o.set_telemetry(False) # opt back out
+ h2o.telemetry_enabled() # -> True or False
+
+ R:
+
+ .. code-block:: r
+
+ h2o.set_telemetry(TRUE) # opt in (persisted across sessions)
+ h2o.set_telemetry(FALSE) # opt back out
+ h2o.telemetry_enabled() # -> TRUE or FALSE
+
+- **Config file** — add a ``general.telemetry`` key to ``~/.h2oconfig`` in your home directory:
+
+ .. code-block:: ini
+
+ [general]
+ telemetry = true
+
+For a cluster started directly on the JVM (``java -jar h2o.jar`` / ``hadoop jar h2odriver.jar``), the server administrator enables it with ``-Dsys.ai.h2o.telemetry.enabled=true`` or by setting ``H2O_ENABLE_TELEMETRY=1`` in its environment.
+
+Turning it off again
+--------------------
+
+Since telemetry is off by default you normally don't need to do anything. To turn it off after enabling it — or to guarantee it stays off regardless of any of the settings above — use any of:
+
+- Pass ``telemetry=False`` (Python) / ``telemetry = FALSE`` (R) to ``h2o.init()`` / ``h2o.connect()`` for the current session, or ``h2o.set_telemetry(False)`` to persist it.
+- Set ``general.telemetry = false`` in ``~/.h2oconfig``.
+- Set ``DO_NOT_TRACK=1`` (the cross-tool standard from `consoledonottrack.com `__). This is a **hard opt-out**: it always wins over every enable setting above, and is honored by the Python client, the R client, and the JVM server.
+- For a JVM-launched cluster, ``-Dsys.ai.h2o.telemetry.disabled=true`` (also a hard opt-out).
+
+The receiver also honors the standard ``DNT: 1`` (Do Not Track) and ``Sec-GPC: 1``
+(Global Privacy Control) request headers: any event arriving with either header set
+is dropped and never stored.