Tokenly — Privacy Policy

Last updated: 24 September 2026

1. Overview

Data controller: Maciej Siemiński — the developer of Tokenly, for all platforms (macOS, Windows, iOS and Android). Contact: mail@macsiem.dev.

Tokenly is a usage dashboard for AI subscriptions, available as a desktop app (macOS, Windows) and as companion apps for iOS and Android. It shows how much of your AI plan limits (for example Claude or ChatGPT) you have used. Tokenly is built local-first: your credentials and usage data stay on your devices.

2. Provider Credentials

To read your usage, Tokenly needs access credentials (such as session tokens or API keys) for the AI services you choose to connect. These credentials:

are provided by you and stored only on your device, in the operating system's secure storage (macOS Keychain, iOS Keychain, or the platform credential store on Windows);
are used exclusively to query the given provider's usage endpoints directly from your device;
are never transmitted to us — no Tokenly server ever receives, stores, or proxies your credentials.

3. Usage Data

Usage statistics fetched from your AI providers (plan type, limits, consumption, reset times, banked usage-limit resets and their expiry) are processed and cached locally on your device. We have no access to them.

4. Device-to-Device Sync and the Relay

If you pair a mobile app with your desktop app, usage data on the same network is synchronized directly between your devices with end-to-end encryption. Pairing keys are stored in the system keychain. We cannot read the synchronized content.

So that a paired phone also works away from your home network, the desktop additionally uploads an encrypted snapshot to the Tokenly relay (trial.tokenly.macsiem.dev, a Cloudflare Workers service). This off-LAN sync is on by default and can be turned off in Settings (LAN-only mode). The snapshot is AES-GCM encrypted with a key derived from your pairing secret; that key never leaves your paired devices, so the relay cannot decrypt your data.

What the relay does receive and store: the encrypted snapshot, an opaque randomly-generated account identifier, an opaque device fingerprint, the per-pairing authorization credential (it authenticates this pairing's uploads and reads and cannot decrypt anything), your push notification token (APNs/FCM) if the mobile app registers for sync wake-ups, and ordinary connection metadata such as IP address, sizes and timestamps. Push payloads contain only a generic "new data available" signal — never usage values or credentials. To notice silent delivery failures, the relay also keeps per-account delivery counts (platform, wake-up kind and outcome, such as "accepted by Apple/Google" or "push not configured") and the time a platform last worked. They contain no tokens and no content, are readable only by your paired devices, and are deleted 90 days after their last update.

5. Crash Diagnostics

Tokenly can use Sentry for crash reporting when a build is configured with a Sentry DSN. Crash diagnostics may include app version, OS version, device model, stack traces, and navigation breadcrumbs; on Apple devices also app-hang and performance diagnostics provided by the system (MetricKit). The apps also send anonymous session start and end events so we can measure how many sessions end without a crash. Credentials, tokens, and usage values are not attached, and no user identifier is set.

6. Subscriptions and Payments

Optional Tokenly Premium is offered as an in-app subscription. On iOS, payment, billing details, and subscription management are handled entirely by Apple through your Apple Account; we do not receive your payment data. See the Terms of Use.

7. Advertising

Tokenly shows no ads on any platform. There are no ads on macOS, Windows, iPhone, iPad or Android, on any tier — free, trial or Premium. All advertising SDKs, ad identifiers and ad consent flows were permanently removed from every build on 17 July 2026.

Because Tokenly contains no ad network, it does not collect or use your device's advertising identifier and does not share any data with an advertising partner.

8. Legal Bases (GDPR)

Performance of the service (Art. 6(1)(b) GDPR) — local processing of the credentials and usage data required to show your dashboards, and operation of the encrypted relay for cross-network sync of paired devices.
Legitimate interest (Art. 6(1)(f) GDPR) — crash diagnostics via Sentry to keep the app stable.

9. Data Retention

Credentials and cached usage data remain on your device until you disconnect a provider, delete app data, or uninstall the app.
The relay keeps only the latest encrypted snapshot per pairing; each upload replaces the previous one. When the desktop has not uploaded for 90 days, the snapshot and the account record are deleted automatically, and the authorization credential within 97 days; you can also request deletion earlier (see below). Cloudflare keeps request logs (IP address, time, the opaque account identifier) for up to 7 days.
Relay push tokens are refreshed by the platform and expire no later than 180 days after their last successful registration; they are deleted together with the relay record.
Sentry crash reports are retained for 90 days (Sentry default), then deleted automatically.

10. Your Rights, and how to delete your data

There is no Tokenly account, so there is nothing to close. Almost everything Tokenly knows about you lives on your own devices, and you delete it yourself:

Usage data, provider credentials, pairing keys, history: disconnect the provider in the app, unpair the device, or simply uninstall Tokenly. All of it is removed with the app — we never had a copy.
Crash diagnostics (Sentry): we cannot look you up, because crash reports carry no user identifier. If you want them erased anyway, email mail@macsiem.dev from the address you contact us on and we will have them deleted.
Relay data (encrypted snapshot, account record, push token): email mail@macsiem.dev with the opaque account identifier shown in the app and we will delete the server-side record. Without new uploads it is deleted automatically after 90 days. Turning the relay off in Settings stops any further uploads; uninstalling alone does not contact the relay.

To request deletion of anything else, or to exercise any other right, write to mail@macsiem.dev. We answer within 30 days.

Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

11. Children

Tokenly is not directed at children and we do not knowingly collect personal data from children.

12. International Transfers

Your credentials never leave your devices through any MacSiem server. When your device queries an AI provider, that traffic goes directly to the provider under its own privacy policy. The encrypted relay runs on Cloudflare Workers. Encrypted snapshots are stored in Cloudflare R2 in Europe; the account record, the authorization credential, push tokens and delivery counts are kept in Cloudflare Workers KV and Durable Objects, which Cloudflare may replicate or run outside the European Economic Area. As a global network, Cloudflare may also process connection metadata outside the EEA. These transfers are covered by GDPR safeguards such as Standard Contractual Clauses. Crash data processed by Sentry may be transferred outside the EEA under the same kinds of safeguards.

13. What We Do Not Collect

We do not collect your name, email address, or account credentials.
We never see your AI usage data in readable form — the relay stores only an encrypted snapshot we cannot decrypt.
We do not collect location data.
We never show ads on any platform or tier, and we do not collect or use an advertising identifier — see section 7.
We do not sell personal information.

14. Changes and Contact

We may update this policy when the app or legal requirements change; the current version is always available at the canonical URL below. For privacy questions, contact mail@macsiem.dev.