tokenproof

Privacy policy

Last updated 27 October 2026

tokenproof is built to publish proof of usage without publishing your work. This page lists everything it handles.

Never collected

Your prompts, code, replies and files go straight from your agent to its provider. tokenproof never stores or sends them, and never publishes the times of day you work.

Kept on your Mac

A signed ledger of token counts per response, and a signing key that never leaves your Mac's Secure Enclave.

Published, by design

These appear on your public profile and in your public GitHub gist, because that is what lets anyone verify them:

• Your GitHub username, and a public gist holding your Mac's key id.
• Daily token totals per model, with the signatures and Apple App Attest certificate that prove them.

Payments

Checkout is run by Dodo Payments, which collects your name, email, billing address and payment details under its own privacy policy. We receive the license key, and store only a one-way hash of it, bound to your GitHub account.

GitHub sign-in

Connecting GitHub uses GitHub's device sign-in with only the gist permission. The sign-in token is used once to create the gist and is never stored.

No tracking

The website sets no cookies and runs no analytics or ad trackers. It is hosted on Cloudflare, which processes standard request logs.

Deleting your data

Quit the app and delete its folder to remove local data. To remove your public profile, email shekhaliul44@gmail.com from the address on your GitHub account and we'll delete it. You can delete the gist on GitHub yourself.