Privacy · tokenusage.dev

tokenusage.dev is operated by Pistachio Technology Inc.

What a share stores

Your handle.
Per day: responses, recorded input, cached input, output and reasoning tokens, and sessions started.
Per month, the longest and the biggest session: start and end time, active time, token counts, model name, and the first 12 characters of the plugin's one-way hash of the session id. The other session summaries a share carries are not kept.
The weekly limit windows from your last share: when each started, the plan type, the first and highest percentage of the limit Codex or Claude Code reported, and the tokens and responses counted in it. They are kept for the shared-report subscription API, whose cells stay empty until qualifying shares can fill them. They do not supply homepage category-run figures. The site no longer keeps an estimate for each plan from them; one it kept before is removed at your next share.
Your response times from your last share that carried them: the days they span, how many responses and turns were timed, their median and 90th percentile, and the same per model and reasoning effort, with the plugin's estimated output rate and time above its fastest pace. Your profile shows them, and they are kept for the shared-report subscription API too. They do not supply the daily Speed chart. Homepage cards have no Response column. No tool names. Schema 1 also accepts medians by hour of the day and day of the week, in UTC. The current Codex and Claude Code plugins omit those buckets; the site checks any it receives but keeps none, and removes any it kept before at your next share that carries response times.
The name and version of the client that shared, when you first and last shared, and how many times.
Your report page, the HTML the plugin rendered, unless you shared with --no-report or took it down.
A hash of your share token. The token itself is never stored, and without it no one, the site included, can update or delete your share through the API.

To limit new sharers, shares, report uploads, reset-alert verification requests and Nerf Watch evidence requests, the server counts requests in fixed one-hour windows. Each counter is filed under a salted hash of an IP address, a sharer's id, a normalized phone number or a normalized email address, never the raw value itself. Reset-alert counters use a private secret as their salt. SMS and email share an IP allowance and have separate global counters with no person's identity. Every counter carries an expiry time, and a database policy sweeps expired ones away. Nerf Watch evidence counters also use a private secret as their salt. Their allowances are separate from Reset Alerts.

What SMS reset alerts store

If you confirm a verification code, the site stores your phone number, the optional name you supplied, and when you subscribed and last updated your details. The record is filed under a keyed hash of the normalized phone number. The phone number itself is also stored because the site needs it to send texts. Neither your number nor your name is public. If you unsubscribe, the site keeps your contact record and records when it marks the subscription inactive.

Twilio receives your phone number to send and check verification codes and to send messages. Welcome, alert and correction messages include your optional name. Twilio processes messaging and opt-out information. The site does not send subscriber details to X or OpenAI. The site never sells your phone number, and never shares it or your consent to receive texts with anyone for marketing. Mobile phone numbers, SMS opt-in data and consent are never sold to or shared with third parties or affiliates for marketing or promotional purposes. The site uses Twilio for verification, messaging and opt-out processing, and Google Cloud to host the site and store subscription data.

The site does not store verification codes or verification challenges. Confirming an already-used code may show an invalid-code error even though an earlier confirmation succeeded.

Delivery records keep a keyed subscriber identifier, acceptance or failure status, correction status, timestamps and a numeric error code. They contain no name, phone number or provider message identifier. They expire after thirty days; database cleanup can happen later. Acceptance by Twilio does not prove delivery to your phone. The site keeps reset announcements and their identifiers so an old alert cannot be sent again.

Reply STOP to cancel. The site keeps your contact record and marks your subscription inactive when it receives the signed opt-out notification. Inactive subscriptions receive no new alerts or corrections. Twilio also blocks messages to an opted-out number. Reply START to enable texts again, then subscribe and confirm a new code on the Reset Alerts page. START alone does not subscribe you.

STOP and the owner's sending switch prevent new automatic sends after the change is observed. A message already submitted to Twilio may still be delivered. The site does not retry an uncertain send because that could send the same text twice. The owner may send a correction to retract an accepted alert while automatic sending is off.

What email reset alerts store

If you confirm an email verification code, the site stores your normalized email address, the optional name you supplied, and when you subscribed and last updated your details. The record is filed under a keyed hash of the address. The address itself is also stored because the site needs it to send email. Neither your address nor your name is public. If you unsubscribe, the site keeps your contact record and records when it marks the subscription inactive.

Postmark processes your address and email content to send verification codes, welcomes, reset alerts and corrections. Welcome, alert and correction emails include your optional name. Open and click tracking are disabled. The site uses Google Cloud to host the site and store subscription data. It does not send subscriber details to X or OpenAI, sell your email address or share it or your email consent with anyone for marketing.

The site does not store email verification codes, challenges or a cache of successful codes. Codes expire 10–20 minutes after request. A still-valid code can be confirmed more than once; an existing subscription updates its optional name without another welcome.

Email delivery records keep a keyed subscriber identifier, acceptance or failure status, correction status, timestamps and a numeric error code. They contain no name, email address or provider message identifier. They expire after thirty days; database cleanup can happen later. Acceptance by Postmark does not prove delivery to your inbox.

Postmark manages unsubscribe for welcome, alert and correction emails. Unsubscribe with the link in any alert email. Postmark stops further email at once. The site keeps your contact record and marks the subscription inactive the next time an email to it is refused. Inactive subscriptions receive no new alerts or corrections. An address that has unsubscribed cannot subscribe again through the form; email support@tokenusage.dev instead.

The site is not told when you unsubscribe; it learns only when Postmark refuses the next email to your address. A verification code can still reach an unsubscribed address, but confirming it does not restore alerts.

Email already submitted may still arrive. Failed or uncertain sends are not retried. The owner may request a correction for an accepted alert while automatic sending is off.

What Nerf Watch evidence stores

When you ask for Nerf Watch evidence, the site stores your email address, which model and days you asked about, when the link was sent and when it expires, and whether the email went out. It keeps this indefinitely. It sends you the link you asked for and nothing else, and it never publishes, sells or shares your address for marketing. Postmark sends the email, with open and click tracking off.

The link works for 7 days, and anyone with it can open it. The site stores only a hash of the link's token, and the token sits after the # in the link, the part browsers do not send to servers; the page sends it in the body of a request.

What is public

An evidence link shows one question's two answers from one model, with their scores, never the question. For the app test, you can also run each day's app in a sandbox.
On your profile, /u/<handle>, and the leaderboards: your handle, your counts by day and month, totals, ranks, the longest and biggest sessions (with the shortened hash), your response times, the plugin version, and when you first and last shared.
Your saved report page, /r/<handle>, to anyone with the link. Asked to share, the plugin first does a dry run that writes it to your machine, so you can open it before it goes up.
Your weekly windows are never shown, on their own or beside your handle, and nothing is published by hour of the day or day of the week. The shared-report subscription API uses windows only across sharers: a median, rounded to two significant figures, only once enough sharers are on a model and plan. Its cells stay empty until qualifying shares can fill them. The API exposes a rounded range under the same conditions. A median or a range end can be one sharer's estimate, rounded, but never with a name on it. Homepage cards use the owner's local category-run records, published through the ingest API. Raw evidence and turn timings stay local.
The Speed chart publishes one rounded median completion time per successful model and UTC day from three responses to our fixed local probe task. Its active series stores no counts, account identities or raw samples. Shares do not supply this series. The former sharer-derived series is archived privately and is never returned by the public API.
The Reset Alerts page shows recent public reset announcements and links to their source posts. The public API lists recent announcements and when the site detected them. Neither lists subscribers or deliveries.

Profiles and report pages ask search engines not to index them. Anyone can still read them and the public API responses. Subscription records and owner diagnostics are not public API responses.

Application logs for Nerf Watch evidence omit email addresses, link tokens, token hashes, answer text, request bodies and provider error messages.

Site analytics

When enabled, we use Google Analytics 4 to count visits and understand how the site is used. Google is our analytics processor under its data processing terms. Analytics requests may include page addresses (including public profile handles and query filters), page titles, referral information, interaction and engagement events, and browser, device and approximate location information. These requests expose your IP address to Google. Our analytics commands include no alert subscription details, report HTML or Nerf Watch evidence.

Google Analytics may use cookies such as _ga and _ga_* to distinguish visitors and sessions. We request host-only analytics cookies with an expiry of 33,696,000 seconds: 390 days, about 13 months, with automatic expiry renewal disabled. Your browser may shorten their lifetime.

We use your browser's time zone, without making a location request, to decide whether to ask first. We ask for time zones associated with the EU, EEA, UK and Switzerland, and conservatively include some other zones and unknown zones. A time zone may differ from your physical location. For those zones, nothing from Google loads until you allow analytics. Elsewhere, analytics starts without a banner unless you have declined it.

If your browser sends Global Privacy Control, analytics stays off without a banner everywhere, even if you previously allowed it. We configure advertising storage, advertising user data and advertising personalization as denied.

A page opened from an evidence link never loads Google Analytics, and page addresses sent to Google never include the part after #.

Use the controls below to allow or decline analytics. We store granted or denied under tokenusage.analytics in this browser's local storage until you change the choice or clear browser data. Browser storage must be available for the choice to be remembered across page loads. Other open tabs keep their current choice until they reload.

Turning analytics off deletes its cookies and, if analytics has already loaded, reloads the page to stop its running code. This does not erase data already received by Google.

What is not collected

When analytics is enabled, the site uses cookies and loads Google Analytics as described above. Report pages run in a sandbox: their scripts cannot access the site's cookies or storage. A request for a report can still carry the site's cookies to our server. Their policy blocks external images, scripts, styles and fonts, requests through fetch or XMLHttpRequest, WebSocket connections and form submissions. A report page can still send its own tab to another address and include anything typed into it in the destination URL, so never type a password or share token into one. The plugin never sends prompts, outputs, file contents, paths, session titles or your account; How the numbers work lists what it does send.

The reset watcher reads public posts from X and sends those posts and their directly referenced public context to OpenAI for classification. Responses are not stored by OpenAI for later retrieval through the API (store: false). It sends no subscriber information to the classifier.

Application logs for reset alerts omit names, phone numbers, email addresses, verification codes, subscriber identifiers, provider message identifiers and provider error messages.

The site runs on Google Cloud (Firebase Hosting, Cloud Functions and Firestore), which keeps request logs for Hosting and Cloud Functions: the address a request came from, the path it asked for, the time and the browser's user agent.

Deleting and renaming

From the plugin's token-share directory:

cd ~/.codex/plugins/cache/stdcmms-lang/token-counter/*/skills/token-share
python3 scripts/share.py --delete --yes          # delete everything, report page included
python3 scripts/share.py --delete-report --yes   # take down the report page, keep the numbers
python3 scripts/share.py --handle new-name --yes # rename; the old handle is released

For Claude Code, from ~/.claude/plugins/cache/stdcmms-lang/token-counter-claude/*/skills/token-share, with python on Windows and python3 elsewhere. Its share token is separate from the Codex plugin's.

python scripts/share.py --delete --yes          # delete everything, report page included
python scripts/share.py --delete-report --yes   # take down the report page, keep the numbers

Deleting removes your handle, every month, your windows and any estimate still kept from them, your response times, your report page and the hash of your token. Deleting a share does not change daily local-probe points or future probes. The private archive of previously published sharer-derived Speed points stays as recorded. The hourly rate-limit counters are left to expire on their own. Cached copies of your profile, the leaderboards and your report page can take a couple of minutes to clear. After a rename, anyone can claim the old handle.

To stop SMS reset alerts, reply STOP to the alert number. The site keeps your contact record and marks the subscription inactive. To request deletion of your stored contact details, email support@tokenusage.dev. Expiring hashed delivery records, rate-limit counters and Twilio's records are separate from that subscription.

To stop email reset alerts, use the unsubscribe link in any alert email. The site keeps your contact record and marks the subscription inactive the next time an email to it is refused. To request deletion of your stored contact details, email support@tokenusage.dev. Expiring hashed delivery records, rate-limit counters and Postmark's records are separate from that subscription.

Lost your token, or want something taken down that is not yours? Contact says how. Do not put a phone number, email address, verification code or share token in a public issue.

Questions about your data

For questions about this policy or your data, email support@tokenusage.dev. The Terms cover the Reset Alerts text and email programs.