Last updated: 2026-07-27 · Applies to the tokentracker-cli npm package, the macOS app, the Windows app, and www.tokentracker.cc.
TokenTracker reads the local logs that AI coding tools already write to your disk, and turns them into token counts and cost estimates. It is local-first: the dashboard, the parsers and the database all run on your machine.
This document lists every network request the software can make, what each one sends, and how to switch it off. If you find a request that is not listed here, that is a bug — please open an issue.
TokenTracker's parsers extract numbers and timestamps only.
Never read, never recorded anywhere:
- Prompts, responses, and conversation bodies
- File contents from your projects
- Commit messages and diffs — Git attribution runs
git loglocally, uses the subject line only to detect reverts, and keeps nothing - API keys, cookies, and session tokens belonging to your AI providers
Recorded locally, never uploaded:
- File paths, project names, and repository names. The Projects view needs to know which repo a session belonged to, so
project.queue.jsonlstores a project key and git remote URL, andsession.queue.jsonlstores each session's working directory. Both files stay on your machine — they are excluded from cloud sync (see §4) and the Projects view is computed entirely locally. SetTOKENTRACKER_DISABLE_GIT_ATTRIBUTION=1to stop deriving them at all.
You can verify this in src/lib/rollout.js: every parse*Incremental function emits only the queue row shapes described below.
Everything lives under ~/.tokentracker/ (%USERPROFILE%\.tokentracker\ on Windows):
| Path | Contents |
|---|---|
tracker/queue.jsonl |
Append-only hourly buckets: source, model, token counts, timestamp |
tracker/project.queue.jsonl |
The same hourly buckets, split per project: git remote URL and owner/repo key. Never uploaded |
tracker/session.queue.jsonl |
Per-session token totals and timing for the Sessions view, plus each session's working directory. Never uploaded |
tracker/cursors.json |
Read offsets so parsing stays incremental |
tracker/config.json |
Your preferences |
tracker/*-usage-limits-cache.json |
Last successful quota reading per provider, so a timeout shows stale bars instead of an error |
pets/, skills/, cache/ |
Desktop pet assets, skill index, misc caches |
To erase everything TokenTracker knows about you, delete that directory. tokentracker uninstall additionally removes the hooks it installed into your AI tools.
| Request | Destination | What is sent | Frequency |
|---|---|---|---|
| Anonymous heartbeat | srctyff5.us-east.insforge.app |
A one-way hash of the machine id, app version, OS platform, and shell (cli / mac / win). Nothing else. |
At most once per day |
| Dashboard analytics | us.i.posthog.com (PostHog) |
Pageviews and explicitly instrumented feature events, plus which shell you use. Autocapture and session recording are off; browser Do-Not-Track is respected. | While the dashboard is open |
| Provider quota reads | The provider's own API (api.anthropic.com, chatgpt.com, cursor.com, api.github.com, api.kimi.com, api.z.ai, qoder.com, qoder.com.cn, openapi.qoder.sh, openapi.qoder.com.cn, cloudcode-pa.googleapis.com, …) |
Whatever that provider's own endpoint requires, authenticated with the credentials that provider already stored on your machine. These requests go directly from your machine to the provider — they never pass through our servers, and we never see the response. | While quota bars are visible |
| GitHub star count | api.github.com |
Nothing but the request itself (public repo metadata) | On dashboard load |
| Update check | api.github.com |
Nothing but the request itself | Windows: once at launch. macOS: only when you click "Check for Updates" |
Both telemetry items are disabled together by a single switch:
export TOKENTRACKER_NO_TELEMETRY=1 # or DO_NOT_TRACK=1You can also set "telemetry": false in ~/.tokentracker/tracker/config.json. On localhost and inside the desktop apps, the dashboard asks the local server for this preference before initialising analytics — and if the answer cannot be confirmed, analytics stays off (fail-closed).
Audit: src/lib/telemetry.js, dashboard/src/lib/analytics.js.
| Request | Destination | What is sent | Trigger |
|---|---|---|---|
| Cloud sync / leaderboard | srctyff5.us-east.insforge.app |
Hourly buckets only — see §4 | Signing in to a TokenTracker account |
| Exchange rates | open.er-api.com |
Nothing but the request itself | Selecting a non-USD display currency |
| Desktop pet download | codex-pets.net |
The pet id you chose | Importing a pet from a link |
| IP check page | ip.net.coffee, claude.ai, 1.1.1.1 |
Your IP address is, by design, what these endpoints observe — that page exists to tell you how providers see your network | Opening the IP Check page |
| Service status page | Provider status pages (status.claude.com, status.openai.com, status.cursor.com, …) |
Nothing but the request itself | Opening the Service Status page |
| Share card fonts | fonts.googleapis.com |
Standard web-font request; Google can see your IP address | Generating a share image |
- No request contains prompt text, responses, file contents, paths, or project names.
- We operate no ad network, no data broker integration, and no cross-site tracking.
- We do not sell, rent, or share your data with third parties.
Signing in is entirely optional. TokenTracker is fully functional without an account; the leaderboard, cross-device aggregation, badges and public profiles are the only features that require one.
Sent when signed in:
- Hourly usage buckets, each containing exactly:
hour_start,source,model,input_tokens,output_tokens,cached_input_tokens,cache_creation_input_tokens,reasoning_output_tokens,total_tokens,conversation_count - A machine id at device-registration time, so usage from several computers can be merged into one account without double-counting
- The email address and display name from your OAuth provider (GitHub or Google)
Not sent, ever:
- Prompts, responses, file contents, project or repository names, file paths
- Local session records —
session.queue.jsonlstays on your machine - Per-project breakdowns —
project.queue.jsonlis never uploaded - Any provider credential
Public visibility: your profile appears on the public leaderboard only while Settings → Account → Public profile is on. Turning it off removes you from the leaderboard and turns badges into a "private" placeholder.
Deleting cloud data: contact us via GitHub issues and we will remove the account and its rows. Deleting ~/.tokentracker/ removes the local copy immediately.
| Service | Role | Their policy |
|---|---|---|
| InsForge | Backend for accounts, cloud sync, leaderboard, heartbeat | github.com/InsForge |
| PostHog | Anonymous product analytics | posthog.com/privacy |
| Vercel | Hosting for www.tokentracker.cc | vercel.com/legal/privacy-policy |
| GitHub | Source hosting, releases, OAuth, star counts | GitHub Privacy Statement |
| OAuth sign-in, fonts on share cards | policies.google.com/privacy |
AI providers whose quota endpoints TokenTracker reads (Anthropic, OpenAI, Cursor, GitHub Copilot, Google, Moonshot, Z.ai, Qoder, …) are governed by their own policies. TokenTracker acts on your behalf with credentials already on your machine; it does not create any new relationship with them.
| Variable | Effect |
|---|---|
TOKENTRACKER_NO_TELEMETRY=1 |
Disables the daily heartbeat and dashboard analytics |
DO_NOT_TRACK=1 |
Same as above (respects the standard) |
TOKENTRACKER_DISABLE_GIT_ATTRIBUTION=1 |
Stops TokenTracker running git log inside your project directories |
Signing out removes cloud sync. Not signing in means it never starts.
TokenTracker is a developer tool and is not directed at children under 13. We do not knowingly collect personal information from children.
Material changes to this policy will be noted in the release notes and in the Last updated date above. The full history is in this file's Git log.
Questions, corrections, or deletion requests: github.com/xiufengsun/TokenTracker/issues