TokenTank is a macOS app with no user account and no telemetry. What the app reads stays on your Mac. We process personal data in three places only: when you visit this website, when you buy a licence, and when the app checks the licence key. This policy covers all three, and the app itself first.
Julius Troisi
Schloßhof 8
91275 Auerbach in der Oberpfalz
Germany
Email: support@tokentank.app
~/.claude/projects: token counts, model names, timestamps and the working directory. Message contents are not read.~/.codex/auth.json) when you adopt an account; from then on they live in the macOS keychain. The file is watched to show which account is signed in, and written only when you click.Everything lives under ~/Library/Application Support/dev.troisi.tokentank: configuration, utilisation history, sums per project and month, and state.json for extensions such as Raycast. Credentials, tokens and the licence key live in the keychain. The diagnostics report you can generate yourself carries no tokens, only their expiry dates, and shortens addresses.
Nothing else. No usage analytics, no crash reports, no advertising.
The iPhone app is optional and does nothing until you pair it. It queries no provider and never speaks to the licence service — there is no licence key on the iPhone, not even a field for one.
Only if you pair it. Your Mac shows a QR code under Settings → iPhone, you scan it with the phone, and from then on the Mac puts the board on our server after every poll, where the iPhone collects it. Until you pair, nothing leaves your Mac.
Encrypted, in a way that leaves us unable to read it: while pairing, Mac and iPhone agree on a key through the QR code (X25519, then ChaCha20-Poly1305). The public half travels across your screen, not across us; the derived key lives only in the keychains of your two devices. What we hold is ciphertext. We can neither read it nor alter it unnoticed — a changed figure fails decryption and is discarded.
What we store: the ciphertext, the time it was written, your licence identifier, the device names you see ("Julius's iPhone", "MacBook Pro"), and one access token per device — that one only as a SHA-256 hash. A board nobody collects within 48 hours is deleted. Unpair on either device and the whole record is deleted at once, not merely signed out. Legal basis: Art. 6(1)(b) GDPR.
On the iPhone only: the derived key and the access token in the keychain, and a copy of the newest board in the app group group.dev.troisi.tokentank, so the widgets can read it. The widgets never see the key — they read only the already decrypted board. Turn the sharing off on the Mac and the Mac deletes its file; on the iPhone the figures disappear the next time the app looks.
Legal basis: Art. 6(1)(b) GDPR (contract). The processing happens only if you switch the sharing on yourself.
Licences are sold through Stripe (Stripe Managed Payments). Stripe acts as merchant of record and is independently responsible for the payment; we never see payment details such as card numbers. Stripe's privacy policy applies. After the purchase Stripe sends us your email address, your name, the chosen plan (yearly or one-off) and the Stripe identifiers of customer, payment and, where applicable, subscription. With these we create your licence key and show it on the thank-you page; if you lose it, support sends it to the purchase email address. Legal basis: Art. 6(1)(b) GDPR (contract).
The licence service runs on Supabase (Supabase Inc., 970 Toa Payoh North, Singapore). Database and functions are hosted in the Frankfurt region (AWS eu-central-1), inside the EU. Stored per licence: key, status, plan, expiry date, the data from section 4, and per activation an instance identifier, the instance name and the time.
On activation the app sends the licence key and an instance name of the form "TokenTank on your Mac's name". The Mac's name may contain your first name. It tells the activations (up to three Macs) apart and lets support match them. About every three days the app checks with key and instance identifier whether the licence is still valid; deactivating deletes the activation. Legal basis: Art. 6(1)(b) GDPR.
Retention: as long as the licence is valid and up to three years afterwards for questions about the purchase. On request we delete the record earlier; invoices are held by Stripe under its own retention periods.
tokentank.app is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. On every request, including the app's update checks, Vercel processes in server logs the IP address, time, requested address, browser or app identifier and the server's response, to deliver the site and fend off attacks. Vercel is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition. Legal basis: Art. 6(1)(f) GDPR, our interest in secure operation.
The website sets no cookies, uses no analytics and loads fonts and scripts from tokentank.app only. The buy buttons lead to Stripe (section 4).
If you write to support@tokentank.app, we process what you send to answer your request and delete it once it is settled and no retention duty applies. Legal basis: Art. 6(1)(b) or (f) GDPR. Please do not send tokens or keys; the app's diagnostics report deliberately contains none.
Processors under Art. 28 GDPR: Vercel (hosting) and Supabase (licence service). Independent controllers: Stripe (payment) and the providers of your subscriptions (requests with your login). We pass data to no one else.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) (Art. 21). Write to the address in section 1. You may also complain to a supervisory authority; the one responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Last updated 10 September 2026. This policy is revised when the app or the services change; the current version is always the one published here.