diff --git a/CHANGELOG.md b/CHANGELOG.md
index d3e9a9d..947ec49 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Removed the privately operated telemetry receiver and internal statistics dashboard from the public source repository. Client-side opt-in telemetry remains unchanged.
+
 ## 0.9.0-rc.12
 
 - Fixed persistence of the last successful telemetry report and status after payload generation.
@@ -11,7 +13,6 @@
 ## 0.9.0-rc.11
 
 - Added explicit opt-in anonymous telemetry with a live payload preview, daily jittered reporting, fail-open delivery, local reset/server deletion controls, and persistent update and rollback counters.
-- Added a separately deployable PostgreSQL telemetry tracker with a write-only public listener, authenticated internal dashboard, strict schema/rate/body limits, retention, migrations, and hardened Compose/reverse-proxy examples.
 
 ## 0.9.0-rc.10
 
diff --git a/docs/telemetry.md b/docs/telemetry.md
index a3ad8f1..b914916 100644
--- a/docs/telemetry.md
+++ b/docs/telemetry.md
@@ -16,13 +16,15 @@ The report contains:
 - Boolean registry categories: Docker Hub, GHCR, GitLab, and generic OCI;
 - cumulative successful/failed update and automatic/manual rollback counters.
 
-The raw delete token remains only in local Container Pilot state. The tracker stores only its hash. Counters are cumulative; the tracker keeps the latest value per installation and derives changes between reports instead of adding cumulative totals repeatedly.
+The raw delete token remains only in local Container Pilot state. The receiving service stores only its SHA-256 hash. Counters are cumulative and the latest values replace earlier cumulative values instead of being added repeatedly.
 
 ## Data never sent
 
 Container Pilot does not send hostnames, Docker host names, IP or MAC addresses, machine IDs, hardware serials, container names or IDs, images, tags, digests, repository names, registry domains or URLs, labels, Compose metadata, networks, volumes, mounts, paths, ports, environment variables, usernames, passwords, tokens, secrets, certificates, keys, browser information, application data, or file contents.
 
-The tracker does not persist remote IP addresses and never logs complete payloads. The public listener exposes only ingest, installation deletion, and health routes. Statistics and installation data are available only through a separately bound internal dashboard listener with authentication.
+The receiving service stores only the telemetry fields documented above. Remote IP addresses are not persisted and complete request payloads are not written to application logs.
+
+Collected telemetry statistics are used internally for project development and are not publicly accessible. The centrally operated receiving service is not part of the public Container Pilot source repository.
 
 ## Controls and transparency
 
@@ -32,6 +34,6 @@ Disabling telemetry stops future requests without deleting local counters. **Res
 
 ## Failure behavior
 
-Telemetry has an eight-second timeout and is fail-open. DNS, connection, timeout, TLS, HTTP, rate-limit, invalid-response, and tracker errors are reduced to a non-sensitive local status. They never stop or delay scans, updates, rollbacks, UI actions, or the Container Pilot process.
+Telemetry has an eight-second timeout and is fail-open. DNS, connection, timeout, TLS, HTTP, rate-limit, invalid-response, and receiving-service errors are reduced to a non-sensitive local status. They never stop or delay scans, updates, rollbacks, UI actions, or the Container Pilot process.
 
 Privacy principles: opt-in instead of opt-out, transparent instead of hidden, aggregated instead of detailed, and minimal instead of curious.