01Who We Are
TokenWatch is an independent macOS application developed by Gokhan Gokova ("developer", "we", "us"). The app is a menu bar utility that helps you monitor your Claude.ai subscription usage, optional API costs, and Claude Code and Codex CLI activity from your local machine. TokenWatch is not affiliated with or endorsed by Anthropic, PBC.
02Data Collected and Stored
TokenWatch stores the following data locally on your device only. None of this data is accessible to the developer, and none of it is shared.
Claude.ai organization ID
To fetch your usage data without re-login on every launch.
Anthropic Admin API key (optional)
To retrieve cost reports when you enable cost tracking.
Trial install date and last-seen date
To track the 7-day free trial period and detect clock manipulation.
Claude.ai session cookies
To maintain your login session across app launches, managed by macOS in the same way as Safari.
App preferences
Refresh interval, menu bar mode and alert thresholds, so your settings are restored between sessions.
24-hour usage history snapshots
To render the sparkline usage chart in the menu bar popover.
Claude Code session log cache
To compute Claude Code analytics by reading your local session JSONL files. Files are read, never copied, never uploaded.
Codex CLI session data (local read)
If you grant access to the folder, TokenWatch reads the JSONL session files that
Codex CLI writes under ~/.codex/sessions. Access is granted by you
through a standard macOS folder picker and is kept as a security-scoped bookmark,
which you can revoke at any time in Settings. Parsing happens entirely on your Mac.
TokenWatch aggregates token counts, cached token ratios, model names, rate limit
snapshots, project paths and tool call outcomes, and keeps the result in memory and
in local app storage. The session files are opened read-only, are never modified,
and are never uploaded anywhere.
03Data We Do Not Collect Important
TokenWatch does not collect or have access to:
- Your name, email address, or any account credentials
- The content of your Claude.ai conversations or prompts
- The content of your Claude Code session messages or code
- The content of your Codex CLI session messages or code
- Your IP address or location data
- Device identifiers or hardware information
- Crash logs or diagnostic reports
- Usage analytics or behavioral data
There is no developer-operated backend server. No data is ever sent to a server controlled by the developer.
04Network Requests
The app makes outbound HTTPS requests directly from your device to the following Anthropic-operated services, using your own credentials:
- claude.ai: to read your subscription usage data (session percentage, weekly model limits) via the embedded browser session you establish. All requests are authenticated with your own session cookies.
- api.anthropic.com: only if you choose to enable optional cost tracking by providing an Anthropic Admin API key. Requests are read-only (billing cost reports). The key is used solely for this purpose.
TokenWatch never contacts OpenAI. Codex CLI usage is read from files already on your disk, so tracking Codex adds no network request at all.
Claude Code and Codex CLI analytics never make a network request. They are computed entirely by reading session JSONL files on your local machine. No request content, response data, or metadata is routed through or logged by any server operated by the developer.
05In-App Purchases
TokenWatch offers a one-time in-app purchase ("TokenWatch Pro") through Apple's StoreKit. Purchase processing, receipt validation, and refunds are handled entirely by the App Store. The developer never sees your payment information. The only purchase-related data the app reads is the StoreKit transaction receipt (whether you have purchased Pro), which Apple delivers to the app on your device.
06Third-Party Services and SDKs
TokenWatch has zero external dependencies. It is built entirely using Apple-provided frameworks: SwiftUI, WebKit, Foundation, Security, StoreKit, WidgetKit, and ServiceManagement. No third-party SDKs, analytics libraries, advertising networks, or crash reporting services are included.
One clarification about this website, which is not the app: the pages you are reading load their typefaces from Google Fonts, so your browser makes a request to fonts.googleapis.com and fonts.gstatic.com. That is a font request, not analytics; no script, cookie or identifier is set from it, and no usage data of yours is involved. The app itself loads no web fonts and makes no request of this kind.
07Data Retention and Deletion
All locally stored data is deleted when you:
- Use the "Log out" option in Settings, which removes session data and organization ID from the Keychain
- Use the "Remove" option in API Cost Tracking settings, which deletes the Admin API key from the Keychain
- Revoke Claude Code folder access in Settings, which clears the security-scoped bookmark to
~/.claude - Revoke Codex CLI folder access in Settings, which clears the security-scoped bookmark to
~/.codex/sessionsand discards the parsed session cache - Uninstall the app, which removes all UserDefaults data and the app sandbox container
Keychain items associated with the app can also be removed manually via
Keychain Access.app by searching for "com.gokhangokova.TokenWatch".
08App Sandbox and Security
TokenWatch runs in the macOS App Sandbox and has no blanket file system access. Reading Claude Code and Codex CLI logs requires you to pick those folders yourself. macOS then issues a security-scoped bookmark that grants access to that folder alone. Revoking it in Settings drops the bookmark, and the app loses access immediately.
The only entitlements requested beyond the default sandbox are outbound network
access (com.apple.security.network.client) and access to files you
select yourself (com.apple.security.files.user-selected.read-write),
which covers the ~/.claude and ~/.codex/sessions folders
you grant for local analytics, plus the file you choose when you export your usage
history to CSV. Log files themselves are opened read-only and are never modified.
The app does not access your file system beyond that, the microphone, camera,
contacts, or any other sensitive resources.
09Children's Privacy
TokenWatch is not directed at children under 13 and does not knowingly collect information from children. Use of the app requires an active Claude.ai subscription, which itself requires users to comply with Anthropic's Terms of Service.
10Changes to This Policy
If this Privacy Policy is updated in a material way, the "Last updated" date above will be changed and, where appropriate, users will be notified via the app's release notes.
11Contact
If you have questions or concerns about this Privacy Policy, please contact:
Gokhan Gokova
gokhan@gokhangokova.com
TokenWatch is an independent utility and is not affiliated with, sponsored by, or endorsed by Anthropic, PBC. "Claude" and "Claude.ai" are trademarks of Anthropic, PBC. Codex is a product of OpenAI, and TokenWatch is not affiliated with or endorsed by OpenAI. This app is provided "as is" without warranty of any kind.