What we keep, and what we don't.

Three kinds of data, and only these. The collector’s side of this — what leaves your machine — is spelled out field by field on the security page.

• Your account. The name and email address you sign up with, the organisation you create or are invited to, and your role in it. If you tell us your city at signup, we keep that label and its city-centre coordinates; it is optional and can be a place we have never heard of.
• Your devices. The name you give each device, when it last reported, and a hash of its token — never the token itself.
• Your usage. Per device, per day, per model and tool: input, output and cache token counts, and the dollar cost ccusage assigned. No prompts, no responses, no code, no file or project names — the collector never reads them, so we could not store them if we wanted to.

One thing is derived rather than collected. Each sync arrives tagged by our host with the city it came from; we round that to roughly 11 km and store it against the device so a pin can appear on the map on the homepage. The IP address is used in memory for rate limiting and is never written to disk or to the database.

The homepage shows a live leaderboard. To keep it honest it uses real data, and by default that includes yours:

• Your name and your organisation's name, with your total tokens for the trailing seven days and your city, if one is known.
• Nothing else. Not your email, not your devices' names, not per-day numbers, and nothing at all about the content of your work.

If you would rather not appear, email hello@tokken.site from your account address and we will hide you or your organisation from the public board. A setting for this is on the way; until then a mail is the switch.

• To show you and your team your own usage and spend — the product.
• To run the public leaderboard described above.
• To email you about your account: invites, confirmation, password resets. No marketing mail, no newsletter you did not ask for.
• To keep the service working: rate limiting, abuse prevention, and aggregate page-view statistics for the marketing site.

We do not sell data, share it with advertisers, or use it to train models. Usage numbers are never shown to anyone outside your organisation except through the public leaderboard, in the shape described above.

Access is enforced in the database, not just the interface. Every table carries row-level security keyed on organisation membership, so a query from one organisation cannot return another’s rows even if the application had a bug. Anonymous visitors have no access to any table; the only thing the public site can read is one function that returns the aggregates on the homepage.

Four services, each doing one job. None of them receives more than that job needs.

Supabase

Database and sign-in. Hosted on AWS in Mumbai, India.

Vercel

Hosts the site and the ingest endpoint; supplies the city-level request location.

Resend

Sends the transactional email: invites, signup confirmation, password resets.

Google Analytics

Page-view analytics on tokken.site only — never on previews or local builds.

• Sign-in cookies, set by Supabase when you log in. They are what keep you logged in; the site does not work without them.
• One preference cookie, active_org, remembering which organisation you last had open if you belong to several.
• Google Analytics cookies on tokken.site, used to count visits. They carry no account information.

• Devices. Removing a device on the Devices page deletes it and every usage row it ever sent, immediately.
• Accounts. Email hello@tokken.site from your account address and we will delete the account and everything attached to it — profile, devices, usage, memberships — within 30 days. Email delivery logs at Resend expire on their own schedule and hold only the address and subject line.
• Otherwise, usage history is kept for as long as your account exists, because that history is the product. There is no silent expiry.

If this policy changes in substance, the date at the top changes with it and the change is described here. Questions, corrections, or deletion requests go to hello@tokken.site.