Privacy Policy — AI Usage Tracker

This Privacy Policy explains how AI Usage Tracker ("we", "us", "our") collects, uses, and protects your personal data when you use our iOS application and related services. We are committed to full compliance with the EU General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Data Controller

Data Controller: AI Usage Tracker

Contact Email: [email protected]

Infrastructure: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (EU)

For all privacy-related inquiries, including data access requests or deletion requests not handled in-app, contact us at [email protected].

2. What Data We Collect

We collect only what is strictly necessary to provide the service.

Account Data

Email address — required for account creation and authentication
Display name — optional, used only for display purposes within the app
Apple Sign In identifier — if you choose to sign in with Apple (we receive an anonymized Apple ID)
Password hash — bcrypt-hashed password (we never store or see your raw password)

OAuth Tokens (Provider Credentials)

To fetch your AI usage data from providers on your behalf, we store encrypted OAuth access and refresh tokens for the providers you connect:

Anthropic (Claude) OAuth tokens
OpenAI OAuth tokens
Google Gemini OAuth tokens
AntiGravity (Cloud Code) OAuth tokens

🔐 All OAuth tokens are encrypted at rest using AES-256 (Fernet) encryption. The encryption key is derived from a server-side secret. Tokens are never transmitted to third parties, never logged in plain text, and are only decrypted transiently when fetching your usage data.

Usage Data

API utilization percentages (e.g. 45% of your 5-hour Claude limit)
Token counts returned by provider APIs
Usage snapshots stored for history visualization (premium feature)
Timestamps of usage fetches

What We Do NOT Collect

❌ The content of your AI conversations or prompts
❌ Device identifiers (IDFA, IDFV, or similar)
❌ Location data
❌ Analytics, tracking pixels, or behavioral data
❌ Advertising identifiers
❌ Crash reports sent to third-party services

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data under the following legal bases:

Consent (Art. 6(1)(a)) — You provide explicit, informed consent via the in-app consent screen before we access any of your AI usage data. You can withdraw consent at any time in Settings.
Performance of a contract (Art. 6(1)(b)) — Processing your account data (email, password hash) is necessary to provide the authentication service you signed up for.

4. How We Use Your Data

Authenticate you securely when you log in
Display your AI API usage across connected providers in the app
Store encrypted OAuth tokens to fetch usage data on your behalf
Record usage snapshots to power the history charts (if premium)
Send transactional emails (password reset — if applicable)

We do not use your data for profiling, advertising, behavioral targeting, or any purpose other than providing the AI usage tracking service.

5. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

Provider API Connections

When you connect a provider (e.g., Anthropic), we use your OAuth tokens to make API calls to that provider on your behalf. This is the core function of the service. Your credentials are sent directly to the provider's official API endpoints — we act as a secure intermediary.

Infrastructure

Our backend runs on Hetzner Online GmbH servers located in Germany (EU). Hetzner processes infrastructure-level data (IP addresses in server logs) as a data processor under our instruction. Hetzner is GDPR-compliant and operates under EU jurisdiction.

Apple (App Store)

Premium purchases are handled entirely by Apple via StoreKit 2. We do not receive or process your payment information. Apple's privacy policy governs purchase transactions.

6. Data Retention

Account data (email, password hash): Retained until you delete your account
OAuth tokens: Retained until you disconnect the provider or delete your account
Usage snapshots: Retained until you delete your account (premium: full history; free: 7 days)
Session tokens: Expire after 90 days of inactivity
Server logs: Standard infrastructure logs retained for up to 30 days, then deleted

7. Your Rights Under GDPR (Art. 15–22)

As an EU data subject, you have the following rights:

Right of Access (Art. 15) Request a copy of all personal data we hold about you. Contact [email protected].

Right to Rectification (Art. 16) Correct inaccurate data. Contact us to update your email or account details.

Right to Erasure (Art. 17) Delete your account and all data in-app: Account → Delete Account. Data removed within 24 hours.

Right to Restrict Processing (Art. 18) Revoke consent via Settings → AI Data Sharing toggle to stop usage data processing.

Right to Data Portability (Art. 20) Request your data in a portable format. Contact [email protected].

Right to Object (Art. 21) Object to processing at any time. Contact [email protected].

Right to Withdraw Consent (Art. 7(3)) Withdraw consent in Settings at any time without affecting prior lawful processing.

Right to Lodge a Complaint You may complain to a supervisory authority. In Germany: Bundesbeauftragter für den Datenschutz (BfDI).

8. Account Deletion and Right to Erasure

You can permanently delete your account and all associated data directly in the app:

Go to Account → Delete Account. This permanently removes:

Your email address and account credentials
All encrypted OAuth tokens for all connected providers
All usage snapshots and history data
Your consent record and session data

Deletion is irreversible and completes within 24 hours. An audit log entry (without PII) is retained for compliance purposes.

9. Data Security

All data transmitted over HTTPS/TLS (TLS 1.2+)
OAuth tokens encrypted at rest with AES-256 (Fernet)
Passwords hashed with bcrypt (never stored in plain text)
Session tokens hashed with SHA-256 before storage
Backend access restricted; no unencrypted data exposed
Server hosted in Hetzner's ISO/IEC 27001 certified data centres

10. Children's Privacy

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child under 16, please contact [email protected] and we will delete it promptly.

11. International Data Transfers

All personal data is stored and processed within the European Union (Hetzner, Germany). We do not transfer personal data outside the EEA. When your OAuth tokens are used to call provider APIs (Anthropic, OpenAI, Google), those API calls may involve servers outside the EU; however, this is a direct service interaction between your app and the provider, and we act only as a secure credential proxy.

12. Cookies and Tracking

This landing page does not use cookies, tracking pixels, analytics scripts, or any form of behavioral tracking. The iOS app does not use analytics SDKs or advertising frameworks.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via an in-app notification or a notice on this page. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the service after changes are posted constitutes acceptance of the updated policy.

14. Contact and Data Protection

Privacy inquiries: [email protected]

Support: [email protected]

Response time: We aim to respond to all privacy requests within 30 days as required by GDPR Art. 12.

Note: A formal Data Protection Officer (DPO) is not required for our scale of operations under GDPR Art. 37, but all privacy inquiries are handled directly by the controller.

If you are not satisfied with our response, you have the right to lodge a complaint with your national supervisory authority. In Germany: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI).