Privacy

Privacy Policy

Last updated: 2026-11-01

Who we are

Tokenkarma is operated by Jean-Rémi Larcelet-Prost, an independent French developer (Auto-Entrepreneur, France). Contact: Contact support.

What we collect

Product analytics (every signed-in user)

  • How often the app opens and which features are used, linked to your account so we can fix problems
  • App version, operating system and system language

We look at usage across all accounts, internally, to improve the product, for example which AI tools are tracked most. We do not publish usage statistics.

Usage data (every signed-in user)

  • Usage snapshots: quotas, plan, raw provider usage objects
  • Provider account emails, org ids and user ids

When you turn it on

  • AI agent usage (paid plans), after you click "Enable usage sync" in the app: hashed IDs, model, token counts, read from the Claude Code and Codex logs on your computer
  • Invoices (Expert plan), after the same "Enable usage sync": invoice id, date, amount, tax, currency, status, account email. They are then collected automatically from the Claude.ai, Cursor and Google Play billing pages of the accounts you connected.
  • API and admin keys you paste and connect (Expert plan), encrypted with AES-256-GCM
  • Prompt text from Claude Code, when cheaper-model tips are on: it can reach our server, and it is not read or stored.

Never collected

  • Content of AI responses
  • Cookies or auth tokens to LLM providers (these stay on your machine)

Where data is stored

Tokenkarma's backend runs on Cloudflare infrastructure. Data is encrypted at rest and in transit.

How long we keep data

We keep your usage readings for as long as your account exists, so you can see your history. Readings older than 48 hours are kept as hourly totals. Daily activity records are deleted after 90 days.

Your rights (GDPR)

You can:

  • Export data we hold about you: GET https://api.tokenkarma.app/api/me/data
  • Delete data we hold about you: DELETE https://api.tokenkarma.app/api/me/data. Deleting your tokenkarma account deletes the AI service accounts linked to it. Some records are kept without your user ID: usage readings, which can include details returned by the AI services; devices; security logs with IP addresses; billing records; and feedback, suggestions or team invitations, with the email they contain. To have these removed as well, contact support.
  • Use our contact form for any GDPR request

Emails we send

We use your account email for service messages: sign-in codes, billing receipts, and important changes to your account or this policy. These are required to operate the service.

If you create an account or join the waitlist, we may also send you occasional emails about tokenkarma itself: usage reports about your own AI tools, new features and tips. Every such email includes an unsubscribe link, and opting out never affects your account or the service emails above. We never sell your address or share it with third parties for their own marketing.

Subprocessors

  • Cloudflare (infrastructure, EU)
  • Stripe (payment processing, EU)

Analytics cookies

We use Meta Pixel and Reddit Pixel to understand which pages of this site perform well and to measure our advertising. You can block these pixels with your browser settings or a content blocker; the site works the same way without them.

We also use PostHog (EU hosting) to measure how the site is used. Since 31 August 2026 it stores its anonymous visitor id in a first-party cookie, ph_<project>_posthog, so a browser is recognised from one page to the next instead of counting as a new visitor on every page load. No third party reads it.

Cookies set by Meta Pixel: _fbp, _fbc, fr. Cookie set by Reddit Pixel: _rdt_uuid. We do not store personally identifiable information beyond what Meta or Reddit themselves collect through their scripts.

Read more about Meta's data practices: facebook.com/privacy/policy .

Changes to this policy

We will notify you in-app and by email at least 30 days before any change that reduces your privacy.