GH-16875: Document telemetry (README + User Guide page)

README.md

@@ -24,6 +24,7 @@ H2O-3 (this repository) is the third incarnation of H2O, and the successor to [H
 * [Building H2O on Hadoop](#BuildingHadoop)
 * [Sparkling Water](#Sparkling)
 * [Documentation](#Documentation)
+* [Privacy & Telemetry](#Privacy)
 * [Citing H2O](#Citing)
 * [Community](#Community) / [Advisors](#Advisors) / [Investors](#Investors)
 
@@ -661,8 +662,29 @@ If the build fails, try `gradlew clean`, then `git clean -f`.
 Documentation for each bleeding edge nightly build is available on the [nightly build page](http://s3.amazonaws.com/h2o-release/h2o/master/latest.html).
 
 
+<a name="Privacy"></a>
+## 9. Privacy & Telemetry
+
+H2O-3 sends anonymous usage telemetry to help us prioritize features and platforms. Here is what happens:
+
+- **Default is on.** Opt-out, industry-standard for open-source server software. Setting an environment variable below stops everything instantly.
+- **One small ping per `h2o.init()`** plus one per major user action (training, scoring, MOJO download, upload, import, save/load, AutoML). Each ping is ~200 bytes of JSON over HTTPS.
+- **Standalone & Hadoop clusters too.** A cluster started directly with `java -jar h2o.jar` or `hadoop jar h2odriver.jar` — even with no Python/R client attached — sends one ping when the cluster forms. Same fields, same opt-outs.
+- **What's sent:** version strings, OS, an ephemeral session UUID regenerated on every `h2o.init()`, a Unix timestamp, the algorithm name, and coarse bucket labels for counts (rows, columns, durations, sizes). Numeric values are always ranges, never raw integers.
+- **What's never sent:** code, file paths, dataset names, model names, column names, hyperparameter values, hostnames, usernames, email addresses, or any user-generated content.
+- **Opt out anytime.** Either set an environment variable:
+  ```bash
+  export H2O_DISABLE_TELEMETRY=1   # or
+  export DO_NOT_TRACK=1
+  ```
+  Or pass `telemetry=False` (Python) / `telemetry = FALSE` (R) to `h2o.init()`. For a cluster launched directly on the JVM, the same environment variables work, or pass `-Dsys.ai.h2o.telemetry.disabled=true`.
+- **Fire-and-forget.** Every call runs on a background task with a 2-second timeout. If the receiver is unreachable, your code returns exactly as if telemetry never happened — never blocks, never raises, never retries.
+
+The full wire contract and the receiver software are open source in the [`h2o-3-telemetry`](https://github.com/h2oai/h2o-3-telemetry) repository. To run a private receiver, set `H2O_TELEMETRY_URL` to your `/v1/event` endpoint.
+
+
 <a name="Citing"></a>
-## 9. Citing H2O
+## 10. Citing H2O
 
 If you use H2O as part of your workflow in a publication, please cite your H2O resource(s) using the following BibTex entry:
 
@@ -702,7 +724,7 @@ Arora, A., Candel, A., Lanford, J., LeDell, E., and Parmar, V. (Oct. 2016). _Dee
 Click, C., Lanford, J., Malohlava, M., Parmar, V., and Roark, H. (Oct. 2016). _Gradient Boosted Models with H2O_. <http://docs.h2o.ai/h2o/latest-stable/h2o-docs/booklets/GBMBooklet.pdf>.
 
 <a name="Community"></a>
-## 10. Community
+## 11. Community
 
 H2O has been built by a great many number of contributors over the years both within H2O.ai (the company) and the greater open source community.  You can begin to contribute to H2O by answering [Stack Overflow](http://stackoverflow.com/questions/tagged/h2o) questions or [filing bug reports](https://github.com/h2oai/h2o-3/issues).  Please join us!  
 

h2o-docs/src/product/index.rst

@@ -154,6 +154,11 @@ The following are additional resources to learn more information about H2O-3:
 
    security
 
+.. toctree::
+   :maxdepth: 2
+
+   telemetry
+
 .. toctree::
    :maxdepth: 1
 

h2o-docs/src/product/telemetry.rst

@@ -0,0 +1,28 @@
+Telemetry
+=========
+
+Starting with version **3.46.0.12**, H2O-3 sends anonymous usage telemetry to help the team prioritize features and platforms. It is **opt-out** and designed to be invisible: every send is fire-and-forget with a short timeout, so if the receiver is unreachable your code behaves exactly as if telemetry never ran — it never blocks, raises, or retries.
+
+What is sent
+------------
+
+- One small ping when you start or connect to H2O (``h2o.init()`` / ``h2o.connect()`` in Python or R, or a standalone ``java -jar h2o.jar`` / ``hadoop jar h2odriver.jar`` cluster), plus one per major action: training, scoring, MOJO and model download, upload, import, parse, AutoML, and model save/load.
+- Each ping contains the H2O version, the client (``python`` / ``r`` / ``jvm``), the operating system, an ephemeral session ID regenerated on every start, a timestamp, the algorithm name, and **coarse range buckets** for counts such as rows, columns, durations, and sizes. Numeric values are always ranges, never exact figures.
+
+What is never sent
+------------------
+
+Code, file paths, dataset or model names, column names, parameter values, hostnames, usernames, email addresses, or any user-generated content.
+
+Opting out
+----------
+
+Any one of the following disables telemetry completely:
+
+- Set an environment variable: ``H2O_DISABLE_TELEMETRY=1`` or ``DO_NOT_TRACK=1``.
+- Pass ``telemetry=False`` (Python) or ``telemetry = FALSE`` (R) to ``h2o.init()``.
+- For a cluster started directly on the JVM, add ``-Dsys.ai.h2o.telemetry.disabled=true``.
+
+The wire format and the receiver software are open source in the
+`h2o-3-telemetry <https://github.com/h2oai/h2o-3-telemetry>`__ repository. To send
+telemetry to your own receiver instead, set the ``H2O_TELEMETRY_URL`` environment variable.