Privacy & network policy

Tokfuel never sends usage data — prompts, transcripts, costs, or paths — from Claude Code, Cursor, or Codex CLI off your Mac. That rule has exactly the exceptions below, and nothing else.

• ExchangeRateService — once a day, only if you enable JPY display, fetches the USD→JPY rate from Frankfurter. No usage data in the request.

• CursorPricingService — once a day, if Cursor is detected on your Mac, fetches Cursor's own published price table to correct Cursor cost estimates. No usage data is sent; unpriced models are counted as $0 rather than guessed.

• CursorDashboardService — if Cursor is installed and you're signed in, calls Cursor's own dashboard usage API using the session token Cursor already keeps locally. Only an auth header and a date range are sent — never prompts or transcripts. Falls back to a local SQLite token snapshot on failure.

• UpdateChecker — polls the public GitHub Releases API at launch and every 24 hours to detect a new version. The release asset itself only downloads when you click Update in the popover. No usage data, transcripts, or identifiers in these requests.

• Crash reporting via Firebase Crashlytics — distribution builds only, no consent prompt, no prompts or costs included. Development builds never configure Firebase.

• Anonymous Firebase Analytics for app-UI events — distribution builds and opt-in only, off by default.

Everything else — cost analysis, budgets, charts, CSV export — runs entirely on-device by reading files Claude Code, Cursor, and Codex CLI already keep on your Mac.