Privacy

Last updated November 4, 2026

The Token Homepage ranks people by how many AI tokens they use. This page describes exactly what we collect to do that, what becomes public, and how to remove it. Questions or requests: hello@tokenhomepage.com.

The short version

We collect token counts from your local Claude Code and Codex logs, never your prompts, conversations, code, file names or folder paths.
Nothing is uploaded until you run token-sync upload. Run token-sync --dry-run first to see the exact payload.
Nothing is public until you choose a display name and opt in. Your GitHub username is never shown.
You can delete everything yourself, at any time, from your account page.
No ads, no analytics, no tracking cookies.

What token-sync uploads

token-sync reads the session logs Claude Code and Codex already keep on your computer and sends only these fields, once per model response:

Token counts: input, cache writes, cache reads, output and reasoning tokens.
The product (Claude Code or Codex), model name and CLI version.
The response's timestamp.
The opaque message and session IDs from the log (random identifiers, used so re-uploading never double-counts).
Per-session summaries: which of those IDs belong to the session, and its token totals.

It never sends message content, tool inputs or outputs, file contents, file paths, working directories, project names, your computer's name, or any credentials. Locations it scanned and local diagnostics are printed on your screen only.

What we store about your account

Data	Why	Who can see it
Your GitHub account ID and username	Signing you in. We request no GitHub permissions, so we never see your email, repositories or private data, and we don't keep the GitHub access token.	Only you, on your account page
Uploaded usage (above)	Computing your totals	Only you, in detail
Authorized devices: the name you gave them, when they were added and last uploaded	Letting you see and revoke them	Only you
Display name, and the profile address made from it	The public leaderboard, if you opt in	Everyone, only while you're listed
Your totals: ranked tokens and their breakdown (uncached input, cache writes, output), cache reads, record counts, the date of your first record, and the same totals per product	The public leaderboard, if you opt in	Everyone, only while you're listed

Device and sign-in tokens are stored only as one-way hashes.

Cookies

tokenhomepage.com sets no cookies. Signing in sets two strictly necessary cookies on api.tokenhomepage.com, neither readable by scripts:

ts_oauth_state protects the GitHub sign-in against forgery. It's removed once GitHub sends you back, and expires after 10 minutes otherwise.
ts_session keeps you signed in. It lasts 30 days or until you sign out or delete your account.

Abuse prevention and logs

To rate-limit requests we count them per IP address and per device. The counters store only a keyed hash, never the raw IP address or token, and are routinely cleared once they're two days old. Our hosting provider also keeps standard request logs (IP address, URL, browser) for a limited period, which we use only to keep the service running.

Who processes data for us

Vercel hosts the website and API (United States).
Neon hosts the database (United States).
GitHub handles sign-in.
Resend receives email sent to hello@tokenhomepage.com and forwards it to us.
Google Fonts serves the site's typefaces, so your browser contacts Google when loading pages.

We don't sell or share your data with anyone else, and we don't use it for advertising or to train AI models.

Keeping and deleting your data

We keep your data until you delete it. From your account page you can:

Leave the leaderboard: uncheck "Show me on the public homepage". We remove your entry immediately. Copies already loaded or cached elsewhere can take a little longer to go: public leaderboard responses may be cached for up to 60 seconds, the homepage map refreshes every minute, and a page someone already has open keeps showing what it loaded until they reload it.
Revoke a device: it can no longer upload. Run token-sync logout on it to remove its local credentials.
Delete a source: erases all your Claude Code or Codex usage, and stops that same usage from being uploaded again.
Delete your account: immediately erases your account, sign-in, devices, all usage and your leaderboard entry. Signing in again later starts a new, empty account. Your public entry goes the same way as leaving the leaderboard, including the short delay for cached copies.

Deleted data may remain for a short time in our database provider's point-in-time restore history before it expires. If you can't sign in, or want a copy of your data, email hello@tokenhomepage.com.

Children

The Token Homepage isn't intended for anyone under 16, and we don't knowingly collect their data.

Changes

If we change what we collect or how it's used, we'll update this page and its date before the change takes effect. Material changes won't apply to data you've already uploaded without your consent.