What reaches the internet

There is no telemetry. Nothing reports what you deploy, how much you deploy, or that this instance exists. There is no analytics in the dashboard and no account with anybody.

These leave the box, and all of them are yours to look at:

• Installing and upgrading pulls two images from ghcr.io, and asks GitHub which release is newest so it can pin an exact one.
• The running daemon asks GitHub which releases exist — when an admin opens the update screen, and when the automatic update timer comes round. It is a plain GET on the public releases API with no credential and nothing about your instance in it (the whole of it). An instance that cannot reach GitHub simply never offers an update and says so, rather than claiming to be current.
• Let's Encrypt, for certificates — and only once you have given the instance a domain.
• The template catalog, when somebody opens Templates in the dashboard or installs one: the daemon reads cubeship.dev/api/v1 (or CUBESHIP_CATALOG_URL), and reads the template's template.yaml from raw.githubusercontent.com at the release's commit. Plain GETs, nothing about your instance in them, and nothing at all until somebody opens that screen.

After that it does what you ask it to: pull the images you named, clone the repositories you connected, write the DNS records you configured.

A build with no version stamped on it — which is what make dev is — never checks for a release at all.