Privacy Policy

Tokens counts how many tokens you spend on AI coding tools and ranks that publicly. To do it we need an account — your email address and a password — and the usage totals our CLI computes on your machine.

The CLI reads the session files your AI coding tools already write to disk and adds them up locally. Only the totals are uploaded — token counts, cost figures, model names, client names and timestamps. The contents of those sessions never leave your machine: not your prompts, not the model's replies, not your code, not your file paths, not your repository or directory names.

You can verify this rather than trust it. The CLI is open source, one parser per client, and tokens submit --dry-run prints the exact payload without uploading anything.

Tokens (tokens.camp).

From you, when you register. Your email address, a username, and a password we store only as a PBKDF2 hash. We send verification and password-reset mail through Resend. If you add social links to your public GitHub profile, we may refresh a snapshot of them (such as a personal site or social handles) to display on your Tokens profile.

From the CLI, when you submit. Daily totals of tokens and estimated cost, broken down by AI coding client and by model, with the dates they belong to. Each submission is attributed to a device you name, so the same day reported from a laptop and a desktop is not double-counted.

To keep you signed in. A session record holding a hashed session token, its expiry, and the browser user-agent string of the session. Personal API tokens you create for the CLI, with the name you gave them and when they were last used.

If an account is banned. The time of the ban and the reason for it.

• Prompts, completions, or any conversation content.
• Source code, file contents, file paths, repository names or directory names.
• Your GitHub repositories, issues, or any private GitHub data.
• Payment details. Tokens is free and takes no payments.

• To build your public profile and place you on the leaderboard — the purpose of the service.
• To keep you signed in and to authenticate CLI submissions.
• To detect and act on fabricated submissions, which is what keeps the ranking meaningful.
• To answer you when you contact us.

We do not use your data to train machine-learning models, and we do not profile you for advertising.

Tokens is a public leaderboard, so this matters more here than on most sites. Your username, display name, avatar, usage totals, per-client and per-model breakdown, daily history, device names and rank are visible to anyone, including people who are not signed in, and are served through our public API, embeddable cards and share images.

Your email address is never shown publicly and is not part of any API response.

Because profiles are public, anyone can view them without signing in.

One cookie, tt_session, set only after you sign in. It is HTTP-only, Secure, SameSite=Lax, and expires after 30 days. It exists solely to keep you signed in.

There are no advertising cookies, no analytics cookies, and no third-party trackers on this site. We do not run Google Analytics or any comparable product.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have never done either.

We rely on a small number of infrastructure providers who process data on our behalf:

• Cloudflare — hosting, edge caching and network protection for the site and API.
• Neon — the managed PostgreSQL database where the records above are stored.
• Resend — delivers account email (verification and password resets).
• GitHub — public profile pages only: the optional source of the social links and avatar images we display. Not a login provider.

We may also disclose information where the law requires it, or where it is necessary to investigate fraud or abuse of the leaderboard.

Data is stored in the United States. If you use Tokens from outside the United States, you are sending your information there.

Profile and usage data is kept while your account exists, because a leaderboard with a gap in its history is not a leaderboard. Sessions expire after 30 days. Expired device-authorisation codes are short-lived and cleared automatically.

Deleting your account removes your profile, submissions, daily breakdown, devices, sessions and API tokens. Records of banned accounts are retained as evidence of the ban, with usernames partially masked.

These are built into the product; you do not have to ask us:

• Delete your usage data but keep your account — Settings, or tokens delete-submitted-data from the CLI.
• Delete your account and everything attached to it — Settings.
• Revoke API tokens at any time — Settings.
• Stop submitting — stop the background service; nothing is sent unless the CLI sends it.

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the right to know what personal information we collect and how we use it, to request a copy of it, to request correction of inaccurate information, to request deletion, and to opt out of the sale or sharing of personal information.

On that last point there is nothing to opt out of: we do not sell or share personal information, and we do not process sensitive personal information for purposes requiring a right to limit.

The categories we collect map to the CCPA as: identifiers (email address, username, avatar URL); internet or network activity (submission timestamps, session user-agent); and commercial-adjacent information in the form of your self-reported AI tool usage totals. Sources, purposes and recipients are described in the sections above.

Use the controls in Settings. We will not discriminate against you for exercising any of these rights. You may use an authorised agent; we may ask for proof of their authority.

The same Settings controls serve those requests. Where a state law provides an appeal process for a refused request, you may appeal by replying to our response.

Tokens is not directed to children. You must be at least 13 to use it, and at least 16 if you are in a jurisdiction that sets that threshold. We do not knowingly collect information from children below those ages. If you believe a child has created an account, contact the operator of tokens.camp and we will remove it.

Session tokens are stored hashed, never in plaintext. Traffic is served over HTTPS. The session cookie is HTTP-only, so page scripts cannot read it. No system is perfectly secure, and we cannot guarantee absolute security, but if we discover a breach affecting your personal information we will notify affected users and any regulator the law requires.

If this policy changes materially we will update the date at the top of this page and, where the change is significant, say so on the site. Continuing to use Tokens after a change means you accept the updated policy.

tokens.camp