I built a small link shortener and faced this exact decision. I track click counts, top country, and top referrer — nothing else. No fingerprinting, no user profiles, no persistent identifiers. The data gets attached to a link, not to a person.

The line I drew: if deleting the short link removes all the data, it's analytics. If deleting the link leaves a profile somewhere, it's surveillance.

GitHub CLI is the opposite case — the data follows the user, not the artifact they created. That's the part that feels off.