Privacy

UsageNow is local-first. Your usage data stays on your Mac unless a request to the provider is needed to get your current limits.

What UsageNow never sends to UsageNow servers#

• prompts
• source code
• project names
• file contents
• conversation content
• Claude credentials
• Codex credentials
• token counts
• quota percentages
• reset times

At a glance#

What UsageNow reads#

UsageNow reads only what it needs to show your usage, and only for providers you’ve enabled.

• Codex — rate limits and plan from Codex’s own app-server, and token counts, model identifiers, timestamps, and recorded rate limits from Codex session files. UsageNow checks whether Codex’s credentials file exists but never reads its contents. Details

• Claude Code — timestamps, identifiers, model names, and token counts from Claude Code session files, and the plan from Claude Code’s account profile. Details

• Kiro — the plan, credit amounts, and reset date from the usage-limits answer Kiro writes to its own log, and the time and credits of each prompt from Kiro session files. The account identifiers in that log are never read. Details

• Warp — times, outcomes, credit amounts, and tokens per model from Warp's local database, opened read-only. The text of prompts and replies is never read. Details

• OpenCode — each answer's time, model, and token counts from OpenCode's local database, opened read-only. SQLite extracts only those numbers, so the reply text stored beside them never leaves the database, and prompt tables aren't read. Details

• Qoder — each answer's time, request identifier, and credits from the transcripts Qoder writes in ~/.qoder/projects. Prompts, replies, and tool results on the same lines are never decoded, and Qoder's sign-in is never opened. Details

• Qwen Code — each answer's identifier, time, model, and token counts from the session recordings in ~/.qwen/projects. Messages are never decoded, and Qwen Code's sign-in is never opened. Details

• Cline — each API request's time, model, token counts, and the cost Cline recorded, from the tasks its editor extension saves and the sessions its CLI saves. The request Cline stored beside those numbers passes through memory and is never kept or logged; prompts, replies, and Cline's keys are never read. Details

• Grok Build — each finished turn's time, models, token counts, model calls, and the cost xAI reported, from the session logs in ~/.grok/sessions. Prompts, replies, tool calls, and the turn's result text are never decoded. Details

• Windsurf — only the cached plan in its read-only local database, never its credential entries. Details

• JetBrains AI — quota percentages and explicit refill times from the selected IDE's XML cache or a newer quota event in that IDE's log. No credentials, account identifiers, prompts, or conversation fields are retained. Details

• Antigravity — the IDE's loopback usage summary, or its official CLI's read-only usage report. The CLI owns its authentication; UsageNow never reads Google credentials. Details

• Explicit connections — reported usage from the service you connect, with your saved key, token, or selected web-session cookie. Only usage display fields are retained. Details

For an account you added, the same is read from the folder you chose. Its name is the label you typed; UsageNow never reads an account's own name or email.

Lines in session files that hold conversation content are skipped. Nothing read from them is stored beyond in-memory totals, including the 30-day history, which is computed from the tools' own files each time and never saved by UsageNow.

Quota pace keeps a bounded local history of quota observations, separate from session activity. It contains no credentials, account labels, prompts, or paths, is never sent to telemetry or widgets, and is removed for providers or accounts no longer being tracked.

Network requests#

UsageNow itself makes network requests only in these cases:

When you explicitly choose Sign In for Cursor or Perplexity, a temporary browser window also loads that provider's website and its sign-in services over HTTPS. No existing browser profile is imported. Only selected session cookies can be saved after verification. See web sign-in.

For Codex, UsageNow runs the Codex app-server locally, and the app-server talks to Codex’s own services on its behalf, the same way Codex does.

For the Antigravity CLI fallback, the official CLI handles its own sign-in and any provider network requests. UsageNow asks only for its usage report and never launches an agent conversation.

An update check asks for one file — the update feed — and carries nothing about you: system profiling is off, so no identifier, version history, or hardware description is attached. As with any request, the server sees your IP address, which is unavoidable in fetching a file at all.

Experimental Claude usage limits#

This optional feature reads Claude Code's existing sign-in, unlike the credentials you explicitly add for other connections. It’s off by default. When you turn it on, UsageNow reads your existing Claude Code access token from the macOS keychain, keeps it in memory, and sends it only to Anthropic to ask for your usage.

See Claude Code for the full list of guarantees.

Widget snapshot#

The desktop widget can’t read provider data itself. The UsageNow app writes a small snapshot of display values — usage windows, reset times, plan, most recent model, and today’s token and request counts — to an App Group container on your Mac, and the widget renders only that. The snapshot never includes prompts, code, file paths, or credentials, and it isn’t sent anywhere. See Widgets.

Analytics#

Anonymous analytics are optional and off by default. Release builds from 0.4.0 send them only while you have the setting on, and nothing about your usage is ever part of them. Telemetry documents exactly what is sent.

Notifications and the keyboard shortcut#

Notifications about limits are off by default and local: UsageNow hands macOS a title and a line of text — a provider's name, a percentage, a reset time — and nothing is sent anywhere. macOS shows them wherever your notification settings allow, including the Lock Screen.

The keyboard shortcut uses the system's hot key API, which needs no Accessibility or Input Monitoring permission. macOS tells UsageNow only that its own shortcut was pressed; UsageNow never sees anything else you type. See Settings.

Report a Problem#

Settings › About › Report a Problem builds a report of what UsageNow sees — versions, screen sizes, settings, and each provider's status and limits — and shows all of it first. UsageNow doesn't send it: it opens a GitHub issue or an email with the report filled in, for you to send or not. It never includes names, emails, file paths, keys, tokens, or prompts. See Settings.

Logs#

UsageNow writes diagnostic messages to the macOS unified log. They never include tokens, credentials, prompts, conversation content, source code, or file paths from ~/.codex or ~/.claude. See Security.

Questions#

If something in UsageNow seems to contradict this page, that’s a bug. Please report it — see Security.