You have audited code for everything you run?

You don't need to audit the code to know if something sends telemetry. For many things (such as your kernel) you can rely on reputation/quickly searching through github issues. For others you can rely on packet sniffing.

I'm pretty confident that the only things I use regularly on my computer (not counting my phone here) that send telemetry are

- Firefox (opt out, but prompts you)

- Visual Studio Code (opt out, doesn't prompt you, requires re-opting out on updates)

- rustup (not sure if opt in or out, don't mind if it's recording telemetry)

I don't remember if we turned rustup's on, but we must not have, because everyone felt very strongly it should be opt-in.