Privacy

This website

This is a set of static pages. It has no accounts, no database and no cookies. The only thing it stores in your browser is your light or dark choice, under the key tg-theme, so the page opens the way you left it.

Our host, Cloudflare, keeps ordinary server logs (such as IP addresses) as any web host does.

If analytics are switched on, they are Cloudflare Web Analytics, which sets no cookies and does not track you across sites.

The tokengraph CLI

tokengraph reads the logs your coding agents already write on your machine, and keeps its own ledger of daily token counts in ~/.tokengraph. It publishes nothing until you run tokengraph login.

Once you have logged in, it publishes to your own GitHub account only, and only when it publishes (a sync, a hook, the schedule, login, readme --colors, or the same actions in the terminal view):

• the SVG graph, to a public gist: daily totals and the names of the model families it is coloured by;
• one file per machine, to a secret gist: daily token counts per agent, model and pricing tier, with a random machine id, a machine label (such as darwin-3f2a1c), a hashed machine fingerprint, the CLI version and the time of the last update; with the Cursor fetch, also your Cursor account’s daily counts per model under a hashed account key. A secret gist is unlisted, not private: anyone who has its URL can read it. It never holds a hostname, a user name or an e-mail address.

Which hour of the day you work is kept on your machine only, for the terminal view and export --hours, and is never published.

The one other network call is the Cursor fetch. When Cursor is logged in on your machine, tokengraph sync reads Cursor’s own login token from Cursor’s local database and asks cursor.com for your own usage history, the same file cursor.com’s export gives you, at most once an hour. The token goes to cursor.com only and is never stored, printed or published; the usage rows are kept in ~/.tokengraph. tokengraph cursor off turns it off, and sync --local never fetches.

It never sends prompts, answers, code, file names or paths, and there is no tokengraph server for anything to be sent to.

tokengraph story shares cards only with devices on your own network, through a one-off page that stops by itself.

Removing your data

• tokengraph logout makes this machine forget the login.
• Delete the two gists on gist.github.com (opens in a new tab) to remove what was published.
• tokengraph uninstall --purge removes the hooks, the hourly schedule and tokengraph’s own files in ~/.tokengraph, including the local ledger.
• Revoke tokengraph’s access at github.com/settings/applications (opens in a new tab).

Contact

Questions or concerns: open an issue on GitHub (opens in a new tab).