I'd say that at the very least:
1. Notify the users that this behaviour happens and provide them an easy way to opt out of this tracking
2. Only send a post-back occasionally, not on a regular basis - keep a file or something which contains a timestamp of the last notification.
You can easily make a remote HTTP post to notify your own server that someone's running the application. This could include the HTTP host name (but should not include anything sensitive). If this post fails, don't retry it or prevent the application from working.
You might also ask them for the administrator email so that you can (optionally) add them to a mailing list e.g. notifying them of new versions - but keep this low traffic and make it easy to unsubscribe.
It's not spyware if the end-user knows about it and can opt out.
If you're not making spyware, don't encrypt any PHP code.
Mark