Security
Credential handling
We never ask for your Anthropic, OpenAI, or Google account password. Connecting Claude Code grants a local collector read access to your existing Claude Code session data directory — a filesystem permission, not an authentication handshake. If a future provider requires an API key, it's encrypted at rest, never logged, and shown masked after creation.
Encryption
TLS in transit everywhere in staging/production. Sensitive columns (provider API keys, when applicable) are encrypted at the application layer in addition to disk-level encryption at rest from our database provider.
Data storage
We store account information, provider connection metadata, and aggregated usage metrics (request counts, token counts, estimated cost). We do not store Claude conversation content or your source code.
No source-code collection
The Claude Code local collector reads only per-turn timestamp and token-usage metadata that Claude Code itself already records. It never reads file contents, tool inputs/outputs, or message text.
No conversation collection
We do not collect, transmit, or store the content of your AI conversations.
Data deletion
Disconnect a provider to stop future syncs immediately. Use "Delete all data" to erase usage history while keeping your account, or "Delete account" for a full, irreversible deletion.
Compliance
We do not claim SOC 2, ISO 27001, or GDPR certification. This page describes our actual current practice, not aspirational or marketing claims.