Privacy notice

Your content and hosted account data

tokenstat's hosted account and usage-sync service does not receive your coding conversations, prompts, responses, or source files. When you access your own devices remotely, that content travels in an authenticated, end-to-end encrypted connection. Our relay forwards encrypted bytes without the keys to read them. SSH vault contents are also encrypted on your device before upload; the server cannot decrypt them. The tools and AI services you choose may receive content directly from your devices, as described below.

Hosted features still need limited account and connection records: sign-in provider identifiers, profile details, device registrations, usage totals, security logs, notification routing tokens, and subscription records. These records can be personal data when linked to you and are readable by the hosted service. End-to-end encryption protects remote content and vault contents; it does not make every account record encrypted or anonymous. The following sections explain these records and their retention.

The IDE, coding agents, and AI services

Third-party coding agents are installed separately when you choose them. tokenstat does not include an AI provider account or model service. Your chosen tools may send prompts, source code, files, and tool results to the providers and integrations you configure, under those services' privacy policies and terms. Review their data handling and age requirements before use, including when a parent or guardian is choosing tools for a child.

This notice covers pueev OÜ's processing for tokenstat. Accounts, usage sync, billing, security logs, push registration, and relayed remote connections involve the limited account or connection data described below. Their processing is separate from the AI provider's processing. The software also makes update and catalog requests as described below; an IP address is visible to a service receiving a network request.

Why we process hosted data

To provide the hosted features you request, we rely on performance of our agreement with you, under GDPR Article 6(1)(b). This covers the records needed for sign-in, account and device management, usage sync, a public profile you choose to publish, remote connection routing and plan allowances, encrypted vault storage, requested status notifications, and subscription management. Without the records needed for a particular feature, we cannot provide that hosted feature. Local use of the IDE remains account-free.

For limited operational and security records, we rely on legitimate interests under Article 6(1)(f): keeping the service reliable, preventing account takeover and abuse, enforcing account eligibility, and establishing, exercising, or defending legal claims. This basis requires weighing those purposes against your rights and reasonable expectations, with particular care for children. The security-log and purchase-dispute sections describe the records and retention used for those purposes. You can object to processing on this basis by contacting us.

Accepting the terms or declaring an age range is not blanket consent to data processing. If a separate purpose requires consent, it needs a separate, informed choice and a way to withdraw it. Where parental authorisation is required for that consent, a 13-or-older declaration or a general guardian permission statement does not replace it. The validity of an agreement with a minor also depends on applicable contract law.

Age eligibility

Our minimum age for a hosted account is 13. Local legal requirements and your chosen tools' age requirements still apply. We use your chosen sign-in provider to recognise your account. If it has no recorded eligibility, we ask you to choose your age group before creating an account or completing sign-in. We retain only the time of a declaration that you are 13 or older, so later sign-ins do not repeat the question. We do not request your birth date, identity documents, or extra age-related provider permissions. This is a declaration, not independent age verification.

While awaiting an answer, the provider profile is held in an encrypted, HttpOnly cookie for at most ten minutes, not in the account store. An under-13 answer clears it and sets a 24-hour eligibility cookie to prevent immediate retries with a different answer. An existing account is restricted, its sessions are revoked, and its public profile and aggregate contribution are disabled pending review. A restricted account cannot be reopened by simply changing the answer. Apple authorization revocation uses the process described below. If you made a mistake or believe an account belongs to a child under 13, contact gyorgy@pueev.com so we can investigate, stop further collection, and remove the child's account data where appropriate. A guardian's agreement for a minor does not substitute for verifiable parental consent; we do not currently enrol under-13 hosted accounts.

What is collected

tokenstat does not use advertising cookies, marketing pixels, or browser fingerprinting. Sign-in and sync are the product. Tracking people across the web is not.

Anonymous counters are kept on this server: how many people open a page, which links get clicked, how far down a page people read, what was typed into the on-site search box, and which paths return errors. These are counts and nothing else. There is no visitor ID, no profile of browsers, and no way to tell one person's visits apart from another's. Nothing is stored in your browser for this, so it does not call for a cookie consent banner. If your browser sends Do Not Track or Global Privacy Control, those client events are not recorded.

The web server also logs each request with an IP address, timestamp, and URL, the same as any web server, to diagnose errors and catch abuse. Those logs stay on the operator's server and are not sold. Web and relay operational logs are kept only through the server's ordinary security-log rotation. They may be isolated for longer only when needed to investigate a specific security, fraud, or abuse event, and are deleted when that purpose ends.

Separately from those rotating logs, a security log records the events that protect your account: signing in, a failed sign-in, linking or unlinking a login, a device being authorised, and a purchase. Each row holds the time, what happened, the account, the IP address the request came from, and the two-letter country Cloudflare reports for it. Each of your devices also keeps the address it last synced from, so you and we can see where it is being used. This is the same information any web server writes for every request. There is no fingerprinting: no canvas or font probing, no device signature, no cross-site identifier, and nothing is stored in your browser for it.

It exists to keep accounts from being taken over, to stop one person running dozens of accounts, and to answer a store fairly when someone disputes a charge. The lawful basis is our legitimate interest in the security of the service and in defending against fraud, under Article 6(1)(f), which Recital 49 names for exactly this. Rows are deleted automatically after 180 days. If you delete your account, the account identifier is removed from these rows and the rest stays until that window ends, in the same way the payment records above do. Otherwise anyone could erase the record of what they did by pressing delete.

Cloudflare

The site sits behind Cloudflare. Request traffic passes through their network for DNS, TLS, and DDoS protection. Cloudflare can also inject its Web Analytics script (real user monitoring) into pages at the edge. That switch lives in Cloudflare's dashboard, not on our server, so this notice assumes the script can load in your browser. Where it loads, it reports totals and load timing: how fast pages render and how many visits each page gets. Cloudflare says the script sets no cookies, keeps no persistent browser state, and does not fingerprint you, profile you, or serve ads, so it needs no consent banner. pueev OÜ does not run that hop. What Cloudflare sees there (the request, the IP, timing) falls under their own privacy policy and terms.

Accounts and OAuth

If you sign in, the identifier your chosen provider supplies is stored (GitHub, Google, X, or Apple), along with a display name and the fact that a sign-in exists. No password is received or stored, and no email address either: no provider is asked for one, so there is none to store and nothing to send you.

Signing in is OAuth with that provider. They see that you authorised tokenstat. That grant, and the account you already have with them, is held by them under their own policy: GitHub, Google, X, or Apple. Only what is needed to recognise you next time is kept here. Linking another provider only happens from your settings, from a session you already control.

For Sign in with Apple, an Apple refresh token is retained solely so tokenstat can revoke that authorization if you unlink Apple or delete the account. It is encrypted at rest and is not used to read Apple account data. Unlinking or deletion requests revocation from Apple before the local identity is removed. If Apple is temporarily unavailable, the encrypted credential is kept in a separate revocation queue and retried. It is deleted as soon as Apple accepts the request.

Sessions record when they were created, when they expire, and when they were last used. They deliberately do not record an IP address or a browser fingerprint.

When you sync from the CLI, the desktop app, or the mobile client, daily usage counters are stored: dates, token totals, model and harness ids, and opaque project hashes. Never a prompt, a file path, a repository name, or a readable project name. The device can also send the last plan-limit figures it already read from a vendor on that machine. Vendor credentials stay on the device.

Hosted profile data and synced usage history are kept while the account is active. For a Free account, if none of its linked devices has synced for more than 30 consecutive days, we may remove that hosted data. Paid tiers are not subject to this inactivity removal while the paid plan is active. The local archive on your device is not affected. Account deletion remains available from settings at any time.

An Elite account can mint a read-only API token in settings. Tokens are shown once and stored hashed. They can only read the counters the account already holds. They cannot sync, and they cannot read another account.

You can download a JSON export of your profile, linked sign-in identities, sessions, synced usage counters, and encrypted SSH vault from settings. Contact us for access to other account records, including billing or relay-usage metadata. You can also delete the account from settings. Deletion is immediate and permanent once confirmed. If an App Store or Google Play subscription is active, the deletion screen warns that deleting tokenstat does not cancel it and asks you to acknowledge the risk of continuing store charges. You may still delete immediately. Use Apple ID or Google Play subscriptions separately to stop renewal.

Remote management

On every plan, a phone or another computer you have signed in on can reach a machine you already control. Remote screen viewing and control is a Elite feature. The two devices authenticate each other and establish an end-to-end encrypted session. The app tries a direct connection first. A direct session does not carry its contents or relay-usage metadata through tokenstat. When network conditions prevent a direct connection, tunnel.tokenstat.ai forwards the already-encrypted bytes. The relay has no session key and cannot decrypt chat contents, terminal contents, screen images, file contents, or keystrokes.

What is stored for remote is the fact of it: that a machine is registered, the public key used as its routing address, whether it is online, and when it last connected. Short-lived tunnel tokens are stored hashed, the same way API tokens are. When the relay is used, daily totals record the channel purpose from a fixed list (such as screen, SSH, or SFTP), the host machine being reached, encrypted bytes carried, connection seconds, and session count. Those totals enforce plan limits, protect the service from abuse, and measure capacity. Operational logs can also contain connection times, account and shortened machine identifiers, channel events, byte counts, and refusal reasons. They do not contain the session payload or a decryption key. Relay usage totals remain attached to the account until the account is deleted. Deleting the account deletes those totals with it.

SSH vault sync is end-to-end encrypted. It is encrypted on your device before upload and decrypted only on a signed-in device after local unlock. The server stores an opaque encrypted snapshot, revision metadata, password and recovery salts, and opaque encrypted key wraps. A device that you unlock is registered for vault sync. Older vault formats may also store an encrypted key wrap for that device. The server never receives plaintext SSH passwords, private keys, snippets, the vault master key, vault password, or recovery code. The password and recovery code are processed locally. If they and every device able to open the vault are lost, neither tokenstat nor pueev can reset or recover the vault. You can still retrieve or export an existing encrypted vault after a plan downgrade.

Notifications

If you enable notifications in the mobile app, tokenstat stores the APNs device token Apple assigns, the platform and Apple environment, an optional tokenstat machine id, and creation and last-seen times. The token is used only to ask Apple Push Notification service to deliver account notifications to that device. Turning notifications off or signing out unregisters it. A token not seen for 180 days is deleted automatically, and account deletion deletes it immediately.

Notification text is composed from a fixed list of events and may include the machine label you chose. It does not include prompts, responses, file paths, folder names, commands, or remote-session contents. Apple processes delivery under its privacy policy.

If you enable notifications in the Android app, tokenstat stores the FCM registration token Google assigns, the platform, an optional tokenstat machine id, and creation and last-seen times. The token is used only to ask Google Firebase Cloud Messaging to deliver account notifications to that device. Turning notifications off or signing out unregisters it. A token not seen for 180 days is deleted automatically, and account deletion deletes it immediately.

The Android payload carries only the event reason and the machine id. The banner text is composed on the device from that reason and never names the machine. It likewise carries no prompts, responses, file paths, folder names, commands, or remote-session contents. Google processes delivery under its privacy policy.

If you use an iOS Live Activity, we store its Apple delivery token, the account and device identifiers, an opaque activity identifier, revision, Apple environment, and timing information. The associated state is one of working, waiting, done, failed, or stopped. Apple receives that state and its timestamp to update the activity; prompts, responses, chat titles, files, and commands are not included. Registrations expire after eight hours. Expired registrations and states older than eight hours are removed during activity registration or update cleanup. Successful end delivery also removes the registration, and account deletion removes these records through their account and device links.

Cookies

An anonymous visit sets no session cookie. Cookies appear only when you sign in, or for a preference the page needs before it paints:

One keeps you signed in: a random value and nothing else, deleted when you sign out. Another is short-lived and protects the forms in your account from cross-site requests. Short-lived cookies also appear during OAuth (to finish sign-in) and to carry one-time secrets such as a fresh API token. A preference cookie records light or dark so pages arrive already in that theme. The same choice is kept in your browser's localStorage. It may be written from your system appearance setting before you touch the toggle. Another holds the IANA name of your timezone (for example Europe/Budapest, never a city and never coordinates) so the signed-in greeting is the same words on first paint as after the page becomes interactive.

Under GDPR and the ePrivacy rules these count as strictly necessary (sign-in, security, completing a flow you started) or as a first-party preference you asked the site to remember. None track you across sites, none are shared for advertising, and there are no analytics or marketing cookies of our own. That is why there is no cookie consent banner.

Payments

If you buy a paid tier on the website or in the desktop app, checkout is run by Paddle.com as Merchant of Record. Paddle processes the payment and related buyer details (card, invoice, tax). pueev OÜ does not receive or store your card number. We keep only what we need to apply your plan: that a subscription exists, which tier it is, and its status. During checkout Paddle may set its own cookies as part of running payment. Those belong to Paddle, not to tokenstat. What they hold is under Paddle's privacy policy and buyer terms. After account deletion, tokenstat may retain Paddle's event identifier, event type, and receipt time solely to reject a duplicate webhook. The tokenstat user identifier is removed from that record. Paddle retains its own transaction and tax records independently under its policy.

If you ask a store for a refund or dispute a charge, the store may ask us about the purchase before it decides, and we answer. Apple is told only whether the plan was delivered and whether we ask it to decline or refund in full. Google gets the activity record for the period in dispute: the days the account was active or signed in, what it used, how many devices were registered, and, for each day, the IP address and country the account was used from. Paddle builds its own dispute file and is not sent this record. Purchases are final under the terms. Where a store asks, we ask it to decline, unless the plan never reached the account, in which case we ask for a full refund. The store decides.

There is no setting to switch this off. The lawful basis is Article 6(1)(f) of the GDPR: the defence of a legal claim, not consent. The right to object does not end this processing, because Article 21 keeps it lawful where it is needed to establish, exercise or defend legal claims. Nothing goes unless a store asks, and a store only asks once a refund or chargeback has been raised on your purchase.

If you buy a paid tier in the iOS app, Apple is the seller. Apple handles the payment, tax, and refunds under Apple's terms. We never see your Apple ID password or card number. We receive a signed App Store receipt so we can apply the same plan on this account: the product you bought, Apple's subscription identifier, when it renews or ends, and a derived account token that ties the purchase to the signed-in tokenstat user. That token is not your Apple ID. Apple's own collection is under Apple's privacy policy.

If you buy a paid tier in the Android app, Google is the seller through Google Play Billing. Google handles the payment, tax, and refunds under Google's terms. We never see your Google account password or card number. We receive the purchase record so we can apply the same plan on this account: the product you bought, Google's purchase token, when it renews or ends, and the renewal and cancellation updates Google sends while the subscription is active, plus a derived account token that ties the purchase to the signed-in tokenstat user. That token is not your Google account. Google's own collection is under Google's privacy policy.

Where you install from

You can get the CLI and the apps from this site, from GitHub, or from an app store when the app is listed there (Mac App Store, App Store, Google Play). The Windows desktop preview ships only through GitHub releases. It is not in the Microsoft Store. A download from GitHub or from a store is handled by that host. They see the request under their own policy: GitHub, Apple, Google. We do not receive your GitHub account or your Apple or Google store account from those downloads. The apps themselves are free. Paid plans are sold on this site through Paddle, in the iOS app through the App Store, and in the Android app through Google Play, as above.

What is not done

No ad networks. No selling lists. No silent third-party scripts for marketing. No fingerprinting to recognise you without a cookie. The software on your device sends nothing for tracking. Local usage collection does not upload conversation text. Network features include release checks and updates, price and catalog refreshes, vendor usage or plan-limit connections, account services, and pages you open. Setup enables scheduled updates by default. Agents and workflow steps may connect to their configured providers or services. Linked devices can sync counters and, when enabled, share plan-limit readings. Remote management, when you turn it on, tries an end-to-end encrypted direct connection first. If that cannot connect, the relay receives encrypted session bytes and the limited routing and usage metadata described above. Vault sync sends only ciphertext and opaque device key wraps.

Your rights

Under GDPR you have the right to access, correct, or delete personal data held about you, to request restriction of processing, and, where applicable, to data portability. You can object to processing based on our legitimate interests. Account export and deletion are on the settings page. The self-service export is not the limit of your right of access. For other records or any question, contact gyorgy@pueev.com.

You can also complain to a data protection supervisory authority, including the authority where you live or work. Our Estonian supervisory authority is the Estonian Data Protection Inspectorate. Contacting us first is optional.

Data controller

pueev OÜ

Narva mnt 5, 10117 Tallinn, Harju, Estonia

Registry code: 14469383  ·  VAT: EE102062975