Privacy policy

Who we are

Sixty AI, Inc. ("Tokematic", "we", "us") operates the Tokematic app and the account and sync service at api.tokematic.app. We are based in Washington State, USA. We control the personal information described in this policy.

What this policy covers

This policy covers the Tokematic desktop app and CLI (macOS, Linux and Windows), the iPhone and iPad apps and the web dashboard. It explains what we collect, why, where it goes, how long we keep it and the choices you have.

The credential collection, in plain terms

Tokematic's main job is to read your AI subscription status and usage so it can warn you as you approach your limits. How the desktop app finds credentials depends on the source settings you choose:

• By default (local CLI dotfiles, API keys and in-app sign-ins, with no extra macOS permissions). Out of the box, Tokematic reads only the local command-line sign-in files in your home folder (~/.claude.json, ~/.codex/auth.json, ~/.kimi-code/server.token, ~/.kimi-code/config.toml and ~/.kimi-code/credentials/*.json, ~/.kimi/config.toml, ~/.gemini/google_accounts.json and its local OAuth token files and ~/.zcode/config.json), API keys you add in Settings and provider accounts you sign in to directly inside Tokematic (such as Google in-app sign-in, stored in Tokematic's own Keychain items). If you already have local CLI sign-in files or in-app accounts on first launch, Tokematic starts immediately without showing a setup wizard or asking for access to your browsers or other apps' Keychain items. In this default mode, Tokematic checks only Keychain items it can read silently (kSecUseAuthenticationUIFail) and never triggers a macOS Keychain prompt for another app's items.
• Only if you turn on "Use browser and app sign-ins" (off by default). When you enable Use browser and app sign-ins in General Settings (or during the optional Setup Wizard) and confirm the Keychain prompt, the app also reads:
  • Browser cookies from Chrome, Brave, Edge, Arc and Firefox (including the account session cookie on openrouter.ai and ollama.com, read to learn your account email).
  • Sign-in tokens stored by the Kimi desktop app in ~/Library/Application Support/kimi-desktop.
  • Items in your macOS Keychain belonging to those browsers or command-line tools when reading them requires an interactive macOS Keychain prompt (such as browser Safe Storage keys or Claude Code-credentials).
• Only if you turn on "Use Safari sign-ins" (off by default). Reading Safari cookies is controlled by a separate Use Safari sign-ins toggle in General Settings and requires granting Full Disk Access in macOS System Settings. When enabled, the app reads Safari cookies, not your Safari saved passwords.

The app uses those credentials to sign in to the provider as you and read your usage. Your provider credentials never leave your device, unless you explicitly grant temporary debug access for a support ticket (section 6) or save a dedicated AI key for server-side status reports. In normal operation, your credentials are sent only to the provider's own service to authenticate you. We do not transmit them to our servers, to CloudKit or anywhere else.

This is session replay with your own credentials. The app identifies itself to the provider with the same client identity the credential was issued to: a command-line tool's own identity for command-line tokens, and a browser identity when you opt in to browser cookies. It does not impersonate a different user.

One narrow exception. When Tokematic detects that your Claude account may be past due, it creates a throwaway conversation on your Claude account, sends a single one-token message, reads the resulting error and deletes the conversation. This fires only on a billing cue and is cached for 30 minutes. It sends minimal content to Anthropic as the provider.

Tokematic can also write a short summary of a coding session, if you ask for one. To do that it hands the session's transcript to a summarizer: Apple Intelligence on this device when it is available, or the same command-line tool the session itself ran on (the Claude, Codex or Google Antigravity CLI), running locally on your Mac. A session is summarized only by that engine or by its own vendor's tool, never handed to a different vendor's. The transcript goes to that local process, not to our servers.

What we collect and why

We do not collect the prompts and responses inside your coding sessions unless your organization's contract includes Transcripts and you explicitly approve that contract on your device (section 5). By default, two things ride along as metadata: a session's first prompt becomes its title, and a summary you generate from its transcript (section 3) becomes its own record. Both travel encrypted under your group's key, the same way account names and labels do (section 5); the raw first prompt itself only ever leaves your device when your account is solo, not shared with a team, and everywhere else a derived topic label, names and specifics stripped, stands in for it. We do not collect your precise geolocation. The desktop app does not ask for location permission and never reads GPS or coordinates. To tell one place from another it reads the network your Mac is on: the router address, and the WiFi network name and access point only when macOS already allows the app to see them. It turns that into a short one-way code, so a place is known to the app as that code and the name you give it. The first time a place is seen, the app names it after the WiFi network or the router address until you rename it. We do not collect health information. We do not scan your files generally. By default the app reads only the specific CLI dotfiles in your home folder listed in section 3; it reads browser cookie stores and Kimi desktop-app storage only when you turn on Use browser and app sign-ins, and it uses Full Disk Access only to read Safari cookie stores when you also turn on Use Safari sign-ins.

Where your data lives and who can see it

On your device. Your credentials and your account records. Credentials live in Tokematic's own Keychain items or are read on demand from your home-folder CLI sign-in files (and, if you opt in, from browser stores and the Kimi desktop app). Account records and labels live in your system preferences and local database. Pace history on your device is a bounded window, roughly 90 days for a heavy user, with the oldest samples dropping off as new ones arrive. That window is how much history your device keeps; it is not how long our servers keep data, which section 7 sets out. The places the app has seen (their codes, the days each device was there and their names) live in a file on your Mac.

In iCloud, when iCloud sync is enabled. Your usage snapshots, sync records and preferences travel through your private iCloud database (iCloud.inc.sixty.tokematic, with an automatic one-way migration bridge from the legacy iCloud.industries.cloudy.tokematic container when upgrading from an earlier build) so your other Apple devices can set themselves up.

On our server (api.tokematic.app), for Solo accounts and organizations. When you sign in to a Tokematic account or sync is on, your usage data and session records travel to api.tokematic.app. Our server hosts both free Solo accounts (syncing across Mac, iPhone, iPad, the web dashboard and headless Linux or Windows collectors, plus personal API access and status reports) and Pro and Enterprise organizations. Unless an organization contract specifies Readable handling or you use a server-side feature that needs the plaintext (such as status reports in Server-assisted mode), the server stores sealed fields as ciphertext and serves them back to your clients.

Key custody modes and password resets. Your personal account has an encryption key that seals your account names, labels, session titles and summaries. You choose between two key custody modes in Settings › Security (and during account setup):

• Server-assisted (default). In addition to wrapping your encryption key under your password, your registered devices and eight one-time recovery codes, we store an encrypted backup copy of your key on our server (server_wrap), sealed with AES-256-GCM under our server's custody key. This lets you reset a forgotten password by email without needing a recovery code, unlock your encrypted history on the web and run server-side team and project status reports. Because our server holds that encrypted backup key, in theory we could decrypt your sealed personal data in Server-assisted mode, though we do not access it except to run features you ask for (such as unwrapping your key when you sign in or reset your password, or generating status reports).
• Total lockdown. You can switch your account to Total lockdown at any time in Settings › Security after verifying one of your eight saved recovery codes. Switching to Total lockdown deletes our server's backup copy of your encryption key (server_wrap). In Total lockdown, only your password, your signed-in devices and your eight recovery codes hold your encryption key; our server cannot decrypt your sealed personal fields and cannot recover them for you.

Depending on your custody mode and what you still have access to, there are four ways to reset a forgotten password:

1. By email in Server-assisted mode (default). Click the password reset link we send to your verified email address and set a new password. Our server uses its encrypted backup copy of your key to re-wrap your existing key under your new password, so you keep all encrypted history without needing a recovery code.
2. With a signed-in device (either mode). If you are still signed in on any Mac, iPhone, iPad or browser that holds your unlocked key and a registered device key, you can reset your password directly from Settings › Security (Reset with device) or approve an emailed reset from that device, with no recovery code required and no data loss.
3. With a recovery code (either mode). Click the emailed password reset link and enter one of your eight one-time recovery codes. That code unlocks and re-wraps your existing encryption key under your new password and is then marked used.
4. Reset without a code when locked out in Total lockdown. If you chose Total lockdown and have lost your password, all eight recovery codes and every signed-in device, neither you nor we can decrypt your existing personal history. You can still regain your account by choosing a no-code reset from the emailed reset link: this sets a new password, generates a fresh encryption key and eight new recovery codes and clears your unrecoverable personal encrypted history (with a review window first if your account has shared history, protected keys or holds).

Organization data contracts and your sharing choice. Every organization has a versioned data contract with two settings:

• What is collected: Facts (token counts, cost, model and duration), Brief (adds the topic label and summary headline), Content (adds the full generated session summary and work tags) or Transcripts (adds the session's prompts, responses and tool calls).
• Who can read it: Encrypted (sealed under the organization's key so our server cannot read the text) or Readable (readable by the server so the organization can run server-side search, reports or a public session log).

You control what your computer shares with an organization:

• When you enroll a computer in an organization, you see the organization's current data contract and choose whether to share Everything, Nothing (consume-only) or Custom (selected projects and categories) on that computer.
• If an organization admin lowers the contract (collects less or switches from Readable to Encrypted), the reduction takes effect immediately. If an admin raises the contract (collects more or switches from Encrypted to Readable), your computer continues under the previous revision until you explicitly approve the new revision, unless you have turned on automatic contract approval for that organization.
• You can pause or resume sharing, or switch to Nothing, at any time from the app or the tmatic CLI. Changing or stopping sharing applies to future uploads; it does not recall records already delivered to the organization.

Public session logs and commit session links. An organization linked to a public repository can enable a public session log. Even when an organization enables that setting, a session's log is published on the public page only if you have also granted your own member consent (public_log_consent) and the session belongs to that public repository. Either you (as the session's author) or an organization admin can remove a session's summary or public log at any time. Removal deletes the summary or public log content while keeping the numeric token and cost facts. Separately, if you or your organization enable Link sessions to commits through the Tokematic GitHub App, the app posts a compact commit table containing only the Session ID, model and session URL; our server never reads your repository source code.

What we can and cannot see. Under an Encrypted organization contract and in Solo spaces, your account names, labels, project names, session titles and generated summaries (headline, paragraph, narrative and lists) are encrypted before they leave your device. In Total lockdown, only you and your devices (and your team members, for records shared with a team) hold the key; our server cannot read them. In Server-assisted mode (the default), those fields are likewise encrypted on the wire and at rest in our database, and our server holds an encrypted backup of your key (server_wrap) so it can help you reset your password by email and run status reports you request. The manager of a team can read everything shared with the team because they hold the team key. Under a Readable organization contract that you have approved, the server can read the categories covered by that contract for the projects you chose to share.

To count and dedupe accounts, the server holds a one-way token for each provider account, made from a salted hash of the provider's account ID. It holds a second token for each device, made under your group key, so it can coordinate which device reads which provider without knowing which device it is. Your provider account ID, the last four characters of your key, your host name on usage reports and your device label are encrypted under your group key before they leave your device. Pace curve reports do not carry your host name at all. What the server can read is the provider, the usage numbers with their times, your Tokematic account sign-in profile (username, verified emails and linked OAuth identities), server-authoritative session work tags (customer, costCenter, workType, ticket and comment) when used in a team and the place code attached to each pace reading (section 4). One thing is still readable today on legacy approval flows: when you approve a web sign-in, the request names the browser and operating system that asked.

Sync on iCloud is encrypted under the same group key, so Apple holds no readable names, labels or identifiers from Tokematic either.

Your share code and device pairing. If you pair devices without a password account using a share code (for example PE84-KF7XQ9M2PDRW), the code has two halves: a short alias that identifies your group, and a secret body your devices use to derive both your access credential and your encryption key. For a share-code-only group (or an account in Total lockdown), the key half is never stored on our server.

• Approving a new device. Signing in or pairing a device shows an approval prompt, with a short confirmation code to compare, on a device you already have (or you can sign in with your password and unlock via Server-assisted custody, a recovery code or a signed-in device).
• Anyone you give a full share code or recovery code to can read your account names and see your data in their dashboard. Keep them secret like a password.
• Entering someone else's share code sends your data to their group too, and they can see your account names. You can leave a group at any time, which stops future sharing.
• If you use Total lockdown (or a share-code-only group) and lose your password, every recovery code and every signed-in device, your encrypted names and personal history are unrecoverable. In Server-assisted mode (the default), you can recover them by resetting your password by email.

Sharing, sale and advertising

We do not sell your personal information and we do not share it, in the specific sense California's CCPA and CPRA give those words. Under that law "sell" means giving personal information to a third party in exchange for money or other valuable consideration, and "share" means giving it to a third party for cross-context behavioral advertising. We do neither, and we do not rent or trade your personal information for any purpose.

Passing the minimum needed to run the service to the subprocessors below is a business-purpose disclosure, not a sale or a share. Each subprocessor processes the data only on our instructions and only to provide its service to us, under terms that forbid using it for anything else. That is why there is no sale or share to opt out of.

We share the minimum needed to run the service with these subprocessors:

• Cloudflare, hosting, database, object storage and edge network, US region.
• Apple iCloud and CloudKit, sync through your private iCloud container.
• Resend, transactional email delivery for password reset, signup verification, organization invitations and account notices.
• Stripe, payment processing, subscription management and billing portal for Tokematic Pro and Enterprise organizations. Stripe handles payment card details; we do not.

When you choose to connect an external account or integration, we also exchange the data needed to run that feature with the service you selected:

• Apple, Google, GitHub and GitLab, when you sign in with OAuth or link one of those accounts to your Tokematic profile (receiving your verified email address, provider identifier and display name).
• GitHub, when you or your organization install the Tokematic GitHub App and enable commit session links.
• Your chosen cost-export destination (such as an S3-compatible bucket or Google Sheets), when you or your organization configure scheduled FOCUS cost and usage exports.
• Your chosen AI provider, if you configure an AI key for status reports in Settings.

When it ships, we will also use:

• A support-automation AI inference provider, to help answer support requests. Support transcripts stay in our database on the retention schedule in section 7.

We may disclose information to respond to a valid legal request, to protect our rights or where required by law.

Support access is not end-to-end. If you grant Tokematic support access to debug a problem, that access is scoped, time-limited and revocable from the app. You choose one saved provider key, the support ticket it is for and how long the access lasts, up to 30 days, and the app shows the grant and its deadline until it ends. For the duration of that session our server holds that one key in usable form, so this is not the end-to-end model that protects your labels. Revoking it, us closing the ticket and the deadline passing each delete the key from our server.

How long we keep your data

When you ask us to delete your account, we disable it immediately. We hold the data for a short internal window, up to 30 days, so a legitimate party can respond if an ex-employee or an attacker triggered the deletion, and we notify you. After that window we delete the live data. Copies in our backups expire on a cycle we control and are gone within 90 days of the live deletion, so a hacked account cannot destroy recoverable data. An open issue extends deletion: if you have an open support ticket, we hold deletion until the ticket resolves.

If you stop using Tokematic, we notify you at 21 months of inactivity and delete your data at 24 months unless you log in or ask us to keep it. Inactivity means no product use and no support tickets. Not paying a subscription does not start deletion.

These periods are maximums. We may delete earlier. We keep data longer only where the law requires it or to resolve an open issue or security investigation, and only for as long as that requirement or investigation lasts.

Your choices

Choose where Tokematic looks for provider credentials. By default, the desktop app reads only the local command-line sign-in files in your home folder (~/.claude.json, ~/.codex/auth.json, ~/.kimi-code/, ~/.kimi/, ~/.gemini/ and ~/.zcode/), API keys you add in Settings and accounts you sign in to directly inside the app. It does not read your web browsers or the Kimi desktop app, and it does not trigger macOS Keychain prompts for other apps' items, unless you ask it to:

• Use browser and app sign-ins (off by default in General Settings): turn this on only if you want Tokematic to read browser cookies (Chrome, Brave, Edge, Arc and Firefox), the Kimi desktop app store and Keychain items that require a macOS Keychain prompt. Turn it off at any time to stop reading browser and desktop-app stores.
• Use Safari sign-ins (off by default in General Settings): turn this on and grant Full Disk Access only if you want Tokematic to read Safari cookies.
• Manual API keys and in-app sign-ins: you can always add or remove API keys and in-app sign-ins per provider in Settings.

Choose your key custody mode and reset your password. In Settings › Security, you can keep Server-assisted key custody (the default, where our server holds an encrypted backup of your key so you can reset your password by email and run server-side status reports) or verify one of your eight recovery codes to switch to Total lockdown (which deletes our server's backup copy of your key). You can reset a forgotten password by email (in Server-assisted mode), from any signed-in device that holds your unlocked key (Reset with device), with one of your eight recovery codes or (if locked out in Total lockdown) by resetting without a code and clearing unrecoverable personal history.

Manage sign-in methods, emails and account merge. In Settings › Profile, you can add or remove verified email addresses, connect or disconnect Apple, Google, GitHub and GitLab sign-in and merge two Tokematic accounts you own into one.

Turn off sync. Sync is on by default so your other devices set themselves up. You can turn it off in Settings, and the app stays local: no usage, no sessions, no summaries and no work tags of its own accord. Three things still reach us while sync is off, and only if you are signed in. Your Mac registers its own key with your account, once, so signing in works and so you can see and revoke the device from Settings. A tag you set yourself with the command line or in the app is delivered, because you asked for it. The app reads the work tags your team has already set, so the Sessions list can show them. Sign out and none of the three happens.

Control organization sharing. For each organization you join, you choose whether to share Everything, Nothing or Custom projects and categories on each computer, and you must approve any increase in the organization's data contract before it applies to you. You can pause sharing or remove a session's summary or public log at any time.

Turn off support access. Settings › About › Debug Access shows any live grant and revokes it, at any time.

Restrict processing or opt out of aggregate trends. In the web dashboard (Settings › Profile › Privacy), you can turn on Restrict processing of my data to pause non-essential processing of your account data while keeping your data stored. In both the Mac app and the web dashboard, you can turn on Leave my data out of aggregate trends so your usage is excluded from cross-user aggregate trends.

Survey and error diagnostics (both off by default). Settings has a separate survey choice (Help improve Tokematic, off by default). If you turn it on, the app sends plan changes and new products by provider, each with its day, and nothing that names you, an account or a device. General Settings also has Report unknown errors to Tokematic (off by default), which sends sanitized parser and machinery fault diagnostics when a provider changes its response format. Turning either switch off stops the sending.

Your rights and how to exercise them

You have the right to:

• Access the personal information we hold about you.
• Delete it.
• Correct it if it is wrong.
• Export it in a structured, portable format.
• Restrict processing of your personal information.
• Opt out of browser and app credential reads, of sync, of organization sharing, of public session logs, of the survey, of unknown-error reports and of aggregate trends.

To exercise any of these, use the self-service controls in the web dashboard (Settings › Profile › Privacy for data download, processing restriction, aggregate-trends opt-out and account deletion) or email privacy@tokematic.app. We verify your identity before we act. We respond within 30 days. If we need longer, we tell you why and take up to a further 60 days. If we deny a request, we tell you why and how to appeal. You can also complain to your state Attorney General.

The details we owe you

This section lists behaviors a careful reviewer would want to know. None of it is hidden; it is here so the policy matches the product.

• By default, the desktop app reads only local command-line sign-in files in your home folder (~/.claude.json, ~/.codex/auth.json, ~/.kimi-code/server.token, ~/.kimi-code/config.toml and ~/.kimi-code/credentials/*.json, ~/.kimi/config.toml, ~/.gemini/google_accounts.json and its local OAuth token files and ~/.zcode/config.json) plus API keys and in-app sign-ins stored in Tokematic's own Keychain items, and it checks other Keychain items only with user interaction disabled (kSecUseAuthenticationUIFail) so no macOS Keychain dialog is triggered.
• Only when you turn on Use browser and app sign-ins does the app decrypt Chrome, Brave, Edge and Arc cookies in memory using each browser's Safe Storage key, read Firefox cookies, byte-scan the Kimi desktop app's local storage files in ~/Library/Application Support/kimi-desktop or request interactive macOS Keychain access to items belonging to those browsers or command-line tools.
• Only when you turn on Use Safari sign-ins and grant Full Disk Access does the app read Safari cookie stores.
• When a command-line token refreshes, the app writes the new token back to the originating sign-in file in place. These are writes to files that belong to the command-line tools, not to Tokematic.
• To rotate the Claude command-line token, the app runs the Claude tool in a sandbox.
• When Use browser and app sign-ins is enabled, the app reads each browser profile separately, so multiple logins to one provider are discovered.
• The tokematic-probe creates and deletes a conversation on your Claude account, described in section 3.
• To summarize a session, the app runs Apple Intelligence on device or the session's own vendor CLI (Claude, Codex or Google's Antigravity CLI) locally, described in section 3. It never hands a session's transcript to a different vendor's tool.
• In Server-assisted key custody mode (the default), our server stores an encrypted backup of your encryption key (server_wrap) so you can reset a forgotten password by email and use server-side status reports. Switching to Total lockdown in Settings › Security after verifying a recovery code deletes that backup copy from our server (section 5).
• While the app runs, it polls our server for device and team-join approvals every 15 seconds, whether or not anyone is joining.
• The app reads the network your Mac is on each time it refreshes your usage, to record which place you are at (section 4).
• Your sync records transit your private iCloud container (iCloud.inc.sixty.tokematic, and during upgrade from an older Cloudy Industries build, the legacy iCloud.industries.cloudy.tokematic bridge). If a local migration verification check finds a row-count mismatch, the app offers an optional Report button that sends only table row counts and the app version (POST /v1/telemetry/migration), never your data.
• We keep raw IP addresses for about two hours for rate limiting, plus Cloudflare edge logs.
• Sync is on by default.

Children

Tokematic is not for anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

Security

All traffic to our servers uses TLS. Passwords are never stored in plaintext; we store a salted one-way cryptographic verifier (PBKDF2/HKDF), and API tokens and session tokens are stored as one-way hashes, with API tokens shown exactly once at creation. Registered devices use P-256 public-key signatures to authenticate device sign-ins and device-approved password resets. We encrypt your account names, labels, session titles and summaries before they leave your device. In Total lockdown, only your password, your registered devices and your eight one-time recovery codes hold the encryption key, so our server cannot decrypt sealed personal fields. In Server-assisted mode (the default), our server also holds an AES-256-GCM wrapped backup copy of your key (server_wrap) under the server's custody key so you can reset your password by email and run status reports. Under an approved Readable organization contract, the server can read the categories covered by that contract for the projects you chose to share. For provider accounts and devices, the server holds one-way tokens, and the one description still readable on legacy sign-in approvals is the browser and operating system named when you approve a web sign-in (section 5). We do not store your AI provider credentials on our servers in normal operation (the only exceptions are a temporary, revocable support debug grant you explicitly create in section 6 or a dedicated status-report AI key you configure in Settings).

Your California privacy rights

If you are a California resident, you have the rights above plus:

• The right to know what we collect and why, given in this policy.
• The right to limit the use of your sensitive personal information. We do not use sensitive personal information for secondary purposes.
• The right to opt out of sale or share. We do not sell or share.
• The right to non-discrimination for exercising your rights.

We do not sell or share personal information, so there is no "Do Not Sell or Share" link. We do not collect precise geolocation. The place codes described in section 4 come from the network your Mac is on, not from its location. We do not process sensitive personal information for secondary purposes.

Changes to this policy

We update this policy when we change what we do. We post the new version and note the date. If a change is material, we notify you.

Contact

Privacy questions and rights requests: privacy@tokematic.app.