Privacy Policy

Effective: July 7, 2026

The short version: Tokeasy's tools run entirely on your machine. Your code, prompts, file contents, file paths, and search queries never leave it. The only things our servers ever receive are billing details (via Stripe), license-validation pings, and — unless you opt out — anonymous savings counters.

1. What we collect

• Billing & account. When you subscribe, Stripe processes your payment and shares with us your email address, Stripe customer ID, and subscription status. We never receive your card number. Stripe's own privacy policy applies to the checkout.
• License records. We store a SHA-256 hash of your license key (not the key itself — keys are 128-bit random, so the hash is not reversible or guessable), its status, and creation/validation timestamps.
• License validation. When the plugin validates, it sends your license key and a 12-character anonymous instance hash (derived locally; it identifies the install, not you or your hardware). We record which instance hashes are active to enforce the device limit, plus standard server logs (IP address, timestamp) used for rate limiting and abuse prevention.
• Savings telemetry (optional, on by default). At most every 6 hours the plugin reports aggregate counters: calls saved, estimated bytes saved, estimated dollars saved, and the model name used for pricing — plus your license key or instance hash as the reporting identity. Numbers only. Opt out with TOKEASY_TELEMETRY=0, or point reporting at your own server with TOKEASY_REPORT_URL.
• Leaderboard. The public leaderboard shows a pseudonymous generated name (like "swift-otter-4f2a") derived one-way from the reporting identity, with savings totals. It never shows emails, keys, or anything from your machine.
• Waitlist / email. If you gave us your email for the waitlist or write to us, we keep that correspondence.

2. What we never collect

Your source code, file contents, file names, file paths, search queries, SQL contents, prompts, or agent transcripts. The tools do their work locally and the telemetry payload is counters only — there is no code path that uploads code. The local recall log (recall.jsonl) and savings ledger stay on your disk.

3. How we use data

To provide and bill the Service, enforce per-license device limits, prevent fraud and abuse, operate the leaderboard, and improve Tokeasy using aggregate statistics. We do not sell personal data and we do not run third-party ads or trackers.

4. Website

tokeasy.net sets no cookies and runs no analytics scripts. The landing page loads the three.js graphics library from jsDelivr's CDN, so your browser's request (IP address, user agent) is visible to jsDelivr like any CDN fetch. Checkout happens on stripe.com.

To see which channels bring people here, the server keeps aggregate, cookie-less request counts for its own pages: the path visited, the referring domain (not the full URL), and any campaign tag in the link. No IP addresses or user-agent strings are stored alongside these counts, and nothing about them identifies you.

5. Ad measurement (Reddit)

We sometimes run ads on Reddit, and we measure them without installing anything on your browser — no ad pixels, no tracking scripts, and still no cookies. If you arrive by clicking a Reddit ad, the link itself carries a click id (rdt_cid in the URL). If you then subscribe, our server sends that click id and the purchase amount to Reddit, server to server, to confirm the ad led to a sale. That's the entire payload — no name, email, IP address, or device data. If you didn't arrive from an ad, there is no click id and nothing is sent to Reddit at all.

6. Sharing

We share data only with processors needed to run the Service: Stripe (payments) and our hosting provider (Hetzner, servers in the EU). We'd disclose data if legally compelled, and we'd tell you unless prohibited.

7. Retention & deletion

License and billing records are kept while your subscription is active and for a reasonable period afterwards for accounting and fraud prevention. Telemetry rows are overwritten by each new report (latest totals only). Email team@tokeasy.net to request deletion of your data — we'll remove what we're not legally required to keep, including your leaderboard row on request.

8. Security

License keys are stored only as SHA-256 hashes; validation responses are Ed25519-signed; transport is TLS end to end. No system is perfect — report security issues to team@tokeasy.net and we'll respond fast.

9. Children

Tokeasy is a developer tool, not directed at children under 16, and we don't knowingly collect their data.

10. Changes

We'll post any changes here with a new effective date; material changes to what we collect will be called out on the site.

Questions: team@tokeasy.net · Terms · Privacy