# Privacy Policy

Last updated: December 2024

## Data Collection

CUStats is designed with privacy as a core principle. We collect **minimal data** necessary for the app to function:

- **Credentials:** Your Claude session token, Anthropic API key, or OpenAI Codex credentials are stored locally on your device only. These credentials are encrypted using AES-GCM encryption before storage.
- **Usage Data:** Usage information is fetched directly from Claude/Anthropic and OpenAI Codex services and displayed locally. We do not store, log, or transmit this data elsewhere.
- **Preferences:** App settings (theme, refresh interval) are stored locally in macOS user defaults.

## Data Storage

All data is stored locally on your Mac:

- Encrypted credentials: `~/Library/Application Support/ClaudeUsageStatus/`
- App preferences: macOS UserDefaults (standard app preferences)

Your credentials are encrypted using AES-GCM (Advanced Encryption Standard with Galois/Counter Mode), a secure encryption standard. The encryption key is derived from your system and stored securely.

## Data Transmission

The app only communicates with:

- **claude.ai** \- To fetch your usage data (when using session token authentication)
- **api.anthropic.com** \- To fetch usage data (when using API key authentication)
- **chatgpt.com / auth.openai.com** \- To authenticate and fetch OpenAI Codex usage data

**No data is ever transmitted to any other servers.** We do not collect analytics, telemetry, crash reports, or any other information. There are no third-party SDKs or tracking services in this app.

## Security Measures

- Credentials encrypted with AES-GCM before local storage
- No plain-text credential storage
- All API communications use HTTPS
- App is sandboxed (when run from App Store)
- Open source code for full transparency

## Cookies & Analytics (Website Only)

**Note:** This section applies to our website (custats.info), not the macOS app. The CUStats app itself contains no cookies, analytics, or tracking.

On our website, we use:

- **Essential Cookies:** Required for basic website functionality, such as form submissions and remembering your cookie preferences. These cannot be disabled.
- **Google Analytics:** We use Google Analytics to understand how visitors interact with our website. This helps us improve the site experience. Analytics cookies are only loaded after you provide consent.

What we collect via analytics:

- Pages visited and time spent
- General location (country/city level)
- Device type and browser
- How you found our site

What we do NOT collect:

- Personal identifying information
- Email addresses (unless you submit a form)
- Any data from the CUStats app

## Your Cookie Choices

You have full control over cookies on our website:

- **Accept All:** Enables analytics cookies for a better experience
- **Essential Only:** Only uses cookies necessary for the site to function
- **Decline All:** Rejects all non-essential cookies

To change your cookie preferences, you can clear your browser's localStorage and revisit the site, or use your browser's cookie settings.

## Your Rights (GDPR & CCPA)

Depending on your location, you have the following rights:

- **Right to Access:** Request a copy of data we hold about you
- **Right to Rectification:** Request correction of inaccurate data
- **Right to Erasure:** Request deletion of your data
- **Right to Portability:** Request your data in a portable format
- **Right to Object:** Object to processing of your data
- **Right to Withdraw Consent:** Withdraw consent at any time

Since we collect minimal data and the CUStats app stores everything locally on your device, most data deletion can be accomplished by simply uninstalling the app or clearing your browser cookies.

## Contact

If you have questions about this privacy policy, want to exercise your privacy rights, or have concerns about our data practices, please contact us at [custats.info@gmail.com](mailto:custats.info@gmail.com?subject=CUStats%20Privacy%20Question).

We aim to respond to all privacy-related inquiries within 30 days.

### Summary

- ✓ Your credentials are encrypted and stored locally only
- ✓ The macOS app contains no analytics or tracking
- ✓ Website analytics require your consent
- ✓ No data sold to third parties
- ✓ Secure AES-GCM encryption
- ✓ You can delete all data by uninstalling the app
- ✓ GDPR and CCPA compliant

### Cookie Preferences

We use cookies to enhance your browsing experience and analyze site traffic. We respect your privacy and give you full control over your data.