Privacy First

Privacy Policy

Last updated: October 8, 2026

1. Overview

UsageScope ("the App") includes desktop and mobile applications that monitor your AI service usage quotas. We are committed to protecting your privacy. This policy explains how the App and the UsageScope website handle your data.

2. Data Collection

AI usage records stay local unless you enable an optional sharing feature. The App operates primarily on your local machine. Specifically:

• Mobile app activity analytics are enabled by default, with an in-app opt-out described below
• No AI usage analytics or prompts are sent to advertising providers
• Desktop usage monitoring does not use advertising identifiers. Mobile app-open advertising and the website's limited Reddit Pixel use are described below
• No ranking data is sent unless you choose the optional "Check My Tier" flow

3. Optional Ranking

If you choose to use "Check My Tier," UsageScope submits a minimal monthly usage summary so the ranking service can calculate your tier. After you join, the App can refresh that monthly summary up to 30 times per day; current Mac versions refresh it in the background about once an hour, and only when it has changed.

• Uploaded: monthly token totals by board, your nickname, an anonymous ranking ID, app version, consent version, a masked email or anonymous alias, and any badge statistics you choose to make public
• Recorded by the ranking server: one record per day of your ranking standing, and the approximate country (a two-letter country code) that Cloudflare derives from the connection. The IP address, region, and city are not stored.
• Never uploaded: API keys, OAuth tokens, prompts, responses, raw local logs, full email address, or local file paths
• Opt-in first: the first ranking submission happens only after you explicitly confirm it

4. API Keys

To function, UsageScope requires API keys from the AI services you choose to monitor (e.g., Codex, Anthropic, Google, xAI, Perplexity). These keys are handled as follows:

• Secure storage: Credentials are stored in the platform's protected storage. Optional Mac- or Windows-to-mobile credential sharing is described below.
• Usage queries: API keys and access tokens are sent to the respective service for usage queries. When you explicitly connect Android to your Mac, or iPhone or Android to Windows, selected credentials can also pass through our relay as end-to-end encrypted data, as described below.
• Encrypted at rest: Credentials use Apple Keychain, current-user Windows DPAPI-encrypted private files, or Android Keystore-backed storage. Windows also uses Credential Manager for protected trial and purchase state.
• User-controlled: You choose which services to connect. Disconnecting a desktop connection stops queries and hides it but may retain credentials and history; disconnecting is not a request to erase every stored record

5. Network Communication

For usage monitoring, the App makes network requests to the official API endpoints of your connected AI services:

• Codex: api.openai.com
• Anthropic (Claude): api.anthropic.com
• Google (Gemini): generativelanguage.googleapis.com
• xAI (Grok): api.x.ai
• Perplexity: api.perplexity.ai

These requests are used to retrieve your usage and billing information. If you opt into optional ranking, the App also contacts the UsageScope ranking API to submit or refresh the limited monthly summary described above.

6. Local Data Storage

The App stores the following data in private storage on your device:

• App preferences: Settings such as polling interval, notification thresholds, and theme preference (stored in the app's private platform storage)
• Cached usage data: The most recent usage data and local token summaries from each service, enabling instant display on App launch (stored locally in the App's sandbox)
• API keys: Stored in Apple Keychain, current-user Windows DPAPI-encrypted private files, or Android Keystore-backed storage
• Ranking participant credential: Stored locally to identify your optional ranking submissions without requiring an account

Local records are stored in the app's private storage. Credentials use the platform's secure storage. Some operating-system keychain items may remain after uninstalling a desktop app. Android backup is disabled for private app data.

Optional iPhone Sync

Mac-to-iPhone sync uses Apple's CloudKit private database in your iCloud account. Both devices must use the same Apple Account. Usage snapshots and daily token summaries are stored in UsageScope's private iCloud area; they do not appear as files in iCloud Drive. Synced history is retained for up to two years and counts toward your iCloud storage.

Selected sign-ins may be shared through iCloud Keychain or through an encrypted CloudKit record after QR pairing. QR-shared credentials are encrypted on the Mac with a pairing key; refresh tokens are not shared. The iPhone uses shared credentials for read-only usage queries. Conversations, prompts, and raw CLI log files are not included in these sync records.

API keys and OAuth credentials added directly on an iPhone stay in that device's protected keychain and are not uploaded to the Mac by this feature. They are sent to the relevant AI service to query usage. Linking a Mac does not transfer ownership of those local connections; removing a local connection does not remove an independently synced Mac connection. Removing a Mac's synced records removes the shared copies, not the original records on the Mac.

Connecting an iPhone to Windows uses the optional encrypted Cloudflare relay described below, rather than CloudKit. Mac-to-iPhone CloudKit sync remains separate.

iPhone Learning, Notifications, and Advertising

On iPhone, learning completion and revision records are stored locally and used to schedule local reminders. Usage reset alerts and Live Activities can show remaining limits, service names, and reset times on your lock screen. You control notifications and Live Activities in Settings. QR pairing uses the camera to read a code; UsageScope does not upload camera images.

The iPhone app integrates Google AdMob for app-opening ads. Google may process IP addresses, approximate location derived from IP, device and app identifiers, ad interactions, and diagnostics to deliver and measure ads, prevent fraud, and operate its services. UsageScope requests non-personalized ads, disables the publisher first-party ID, and does not request App Tracking Transparency permission or read IDFA in app code. Non-personalized ads still involve data processing. AI service credentials, prompts, conversations, and synced token records are not sent to advertising providers.

Google's User Messaging Platform checks the consent status before ad requests and presents choices where required. Available choices can be reopened in Settings > Ads. An active Remove Ads subscription stops ad requests and display; app analytics and crash-report preferences remain separate. Purchases and subscription billing are handled by Apple; UsageScope receives product and entitlement information, not payment-card details. See Google's advertising policy.

When an eligible Mac is paired, the iPhone can activate a one-time 90-day pause of app-opening ads. The activation time is kept separately in protected local storage so disconnecting and pairing again does not restart the period.

Optional Cloudflare Relay Sync

The relay connects Mac to Android and Windows to either iPhone or Android. It is enabled only when you choose a mobile connection on your desktop and scan its temporary QR code. You do not need a separate UsageScope account. The desktop encrypts usage snapshots, token history, and shared API keys or access tokens with AES-GCM before uploading them to a Cloudflare Worker and D1 database. Windows sync records can include a random desktop identifier, app and operating-system version, service and account metadata, model usage and cost summaries, and the desktop's entitlement state. The encryption key travels through the QR code and is not sent to the relay. Refresh tokens, prompts, conversations, and raw CLI log files are not included.

The relay stores encrypted records, random connection identifiers, hashes of access credentials, record names and ordering, and expiration metadata. Request IP addresses are processed to enforce rate limits; the application stores only an hourly salted hash in short-lived rate-limit records. Cloudflare also processes network requests to operate the service.

Connections expire after 90 days without uploads. Synced token history covers up to 731 days. Revoking a relay connection on the desktop removes its active relay records; provider-managed backup retention may differ. Disconnecting on the phone removes the downloaded connection locally. Data already downloaded to an offline phone cannot be remotely erased immediately.

Android stores private records encrypted with a device-bound Android Keystore key. Resetting or reinstalling the phone app requires pairing again. Learn and public ranking requests are separate from private sync and do not send your service credentials.

On iPhone, the relay pairing key and credentials use protected Keychain storage; downloaded usage records are cached in the app's private storage.

When an eligible Mac is linked, Android can receive a one-time 90-day pause of app-opening ads. To avoid restarting this benefit after reinstalling or linking another Mac, the relay keeps an app-scoped hash derived from Android's device identifier and the first activation time. The raw identifier is never sent. This benefit record is retained after connection expiry or disconnection and is not used for advertising or analytics. An encrypted receipt is also kept on the phone for offline use. An active mobile ad-removal subscription takes priority and removes all ads while it remains active; the 90-day period continues to run.

Windows Purchases and Mobile Advertising Benefits

Microsoft Store handles Windows purchases. UsageScope keeps the product and entitlement verification state in protected storage on Windows, not payment-card or bank-account details. The encrypted mobile sync record contains the desktop's entitlement state, not its Store purchase evidence. The relay does not independently validate Microsoft Store purchases.

Connecting an eligible purchased Windows app can activate a one-time 90-day exemption from all ads on the connected iPhone or Android phone. A trial or free Windows connection does not qualify. The period starts at that phone's first successful activation of the Windows benefit and does not restart after reconnecting, restoring a purchase, or connecting another computer.

To preserve the first activation time, the relay keeps an app-scoped hash and that time. On iPhone, the hash is derived from a random identifier held in protected Keychain storage, not a hardware identifier. Android derives its hash from the app-scoped Android device identifier. Raw identifiers are not sent to the relay. The benefit record has no automatic expiration and remains after disconnection or connection expiry; it is not used for advertising targeting or analytics. A protected receipt on the phone supports offline checks. A mobile ad-removal subscription takes priority while active, and the 90-day period continues to run.

Optional Remote Usage Reset Alerts

If you enable remote reset alerts for a relay connection, the phone registers a Firebase Cloud Messaging push token, pseudonymous account keys, and enabled alert types. For delivery, the relay processes a pseudonymous account key, service identifier, event type, event identifier, and event time. It stores the push registration and deduplication metadata, not this event body. This notification metadata is separate from the encrypted sync records and is not end-to-end encrypted. Firebase Cloud Messaging, and Apple Push Notification service on iPhone, deliver these alerts. Service credentials, prompts, conversations, and token history are not included in the push message.

You can turn remote alerts off in the app's notification settings. Push registrations not refreshed for 30 days are excluded from delivery and removed during cleanup. Notification deduplication records expire after seven days. Local learning reminders do not require this push registration.

Android Learning Reminders and Advertising

Android stores completed lesson identifiers and revisions, reminder preferences, and notification history on your device. Learning reminders are generated locally from downloaded or bundled lessons, without a push token or remote push service. Completed lessons are skipped; a revised lesson may become available for learning again. Uninstalling the Android app removes this local learning history.

The Android app integrates Google AdMob for app-open ads. Google may process IP addresses, device and app information, diagnostics, and ad interactions to deliver and measure ads and prevent fraud. UsageScope does not send AI service credentials, prompts, responses, token history, or lesson completion records to AdMob. Android requests non-personalized ads, removes the advertising ID permission, and disables Google's publisher first-party ID. Non-personalized advertising still involves data processing.

Where required, Google's User Messaging Platform requests consent before advertising. Available privacy choices can be reopened from Settings > Ads. For Google's handling of advertising data, see Google's advertising policy.

Mobile App Activity Analytics and Diagnostics

Firebase Crashlytics collects crash reports and diagnostics to help us fix failures. This is enabled by default and can be disabled separately using Crash reports in the same settings. Reports include crash stack traces, app and operating system versions, and a random installation identifier. Custom diagnostic logs use fixed event names; they do not include credentials, service responses, account identifiers, or URLs. Turning this off stops future uploads and discards pending reports on the device; it does not delete reports already processed.

The iPhone and Android apps use Google Analytics for Firebase to measure daily active installations, sessions, and engagement. Collection is enabled by default. Turn it off in Settings (About on iPhone) > App analytics. This stops future analytics collection and resets the analytics identifier on that device; it does not erase reports already processed by Google.

Firebase uses a random app-instance identifier and basic app and device information, such as app version, operating system, and language. Google may derive a general location from masked IP addresses. The SDK also measures app purchase and subscription events, including product identifiers and prices. We do not set a user ID or send AI service account details, API keys, OAuth tokens, prompts, token history, or lesson completion records to Analytics.

Analytics does not collect Apple's advertising or vendor identifiers in this app. Advertising storage, advertising user data, and ad personalization are disabled for Analytics. AdMob has separate privacy controls. See Google's description of Analytics data collection.

7. Third-Party Services

The App communicates with third-party AI service APIs as listed above. Each service has its own privacy policy governing how they handle API requests:

• Codex Privacy Policy
• Anthropic Privacy Policy
• Google Privacy Policy
• xAI Privacy Policy
• Perplexity Privacy Policy

Website advertising measurement: The UsageScope website uses Reddit Pixel for limited advertising measurement. It measures visits to the website and clicks on links to the Mac App Store or Microsoft Store.

• Reddit technology: Reddit may use cookies or advertising identifiers when processing these events under its own privacy policy
• No directly identifying fields: UsageScope does not intentionally send email addresses, phone numbers, or other directly identifying fields through Reddit Pixel
• Advanced matching disabled: Reddit's automatic advanced matching feature is disabled

For more information about Reddit's data practices, see the Reddit Privacy Policy.

8. Children's Privacy

UsageScope is not directed at children under the age of 13. We do not knowingly collect any information from children.

Retention, Choices, and Privacy Requests

You can turn off mobile app analytics and crash reports independently, manage notifications and advertising choices in Settings, and stop optional sync or ranking. Local deletion, sync disconnection, and analytics opt-out affect different records; they do not automatically erase data already processed by a provider. UsageScope does not require a separate UsageScope sign-up account for basic use.

For access, correction, or deletion requests concerning information we can identify, contact the support address for your platform below. Explain the platform and feature concerned, and send only the minimum information needed to locate the record. Never send API keys, passwords, pairing QR codes, or access tokens. Requests are handled subject to applicable law and any retention necessary for security, billing, or legal obligations. Apple, Google, Cloudflare, and connected AI services process relevant data under their own policies, which may include processing outside your country.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated revision date. The current policy and revision date remain available here.

10. Contact

If you have any questions about this Privacy Policy, please contact us at:

Mac: usagescope@hello-support.com

Windows: usagescope-window@hello-support.com

iPhone / iOS: usagescope-ios@hello-support.com

Android: usagescope-android@hello-support.com

For setup help and platform-specific contact options, visit UsageScope Support.