Privacy

Effective 2026-09-24. This page describes the app as built; the rules below are enforced in code, and the source is public so you can check.

The short version

Keysrs runs on your Mac. There is no account. We do not receive your prompts, your keys, or your identity, and we receive usage data only if you turn on "share to compare" (off by default; see below). There is no license check: unless you turn that on, the app never contacts us.

What the app reads on your Mac

• Usage records that Claude Code, OpenAI Codex CLI and Grok CLI write to your home folder (session logs and usage caches). Only counts and metadata are kept; prompt content is not stored.
• The per-request usage records Droid writes to ~/.factory/logs/: only the [Agent] Streaming result lines of droid-log-single.log and its dated rotations are read, keeping their token counts, model, session id and timestamp. Nothing under ~/.factory/sessions/ is read, and Droid's transcripts, its login files, and every other record in its log (the ones that carry message content) are never opened.
• Claude's subscription limits, from the cache Claude Code keeps and, when you ask for it, through Claude Code's own /usage command using its existing login. Refreshing in the background every five minutes is off unless you turn it on at first launch or from the menu. No model request is made and no credentials are read.
• API keys you add yourself. They are stored in the macOS Keychain under your login and are read back only after a Touch ID or login-password prompt.

The app never reads other tools' authentication files (for example ~/.codex/auth.json or ~/.grok/auth.json), never opens provider websites, and never uses browser cookies or sessions.

Update check

From version 0.10, the app can check GitHub for a newer release. It is off by default: it runs when you choose Check for Updates, or at launch and once a day if you turn on Automatically Check for Updates. It asks GitHub's public releases API for the latest version number and download address, sends no cookies and nothing from your data, and downloads nothing. From version 0.11, choosing Update Now downloads the release's disk image from GitHub and installs it in place after checking its checksum and Apple signature; the download happens only when you click Update Now. GitHub, not us, receives the request and the download under GitHub's privacy statement.

What stays on your Mac

• The usage catalog (an SQLite database in Application Support) holds counters and metadata only. Key values never enter it. Gateway request bodies never enter it.
• The dashboard and its API bind to 127.0.0.1 only and are not reachable from other machines.

Optional "share to compare"

It is off by default. The welcome window asks once, with the box unticked, and the dashboard's Privacy dialog shows the destination, what is waiting to be sent (with a preview you can download) and lets you turn it off at any time. Turning it off stops collection and discards unsent reports. Nothing from before you opted in is ever summarized.

While it is on, the app sends one report per day to https://analytics.keysrs.com, a server we run ourselves. A report contains only:

• the app version, macOS major version, CPU architecture, the UTC day it covers and a random report ID;
• how many times fixed app features were used that day (for example a dashboard pane opened, or a key added or copied);
• per tool (Claude Code, Codex, Grok, Droid), provider and public model name: prompt, model-call and token totals for the day;
• for calls through the app's local gateway: request and token totals per provider and model, never per key;
• the highest plan-limit percentage seen that day for each plan window, rounded to 5, and whether it reached 100%.

It never contains prompts, responses, key values or key names, project, session or agent names, file paths, account IDs, dollar amounts, exact times or any persistent device or user identifier. A provider outside the app's published list is sent as "other", and a model name that is not a public one (for example a fine-tune or deployment name) is sent as "unknown".

In return the dashboard shows a Compare line: how your typical day compares with the days others have shared. For that, the app downloads a table of shared totals from the same server at most once a day; that request carries nothing about you. The server keeps reports for 30 days and does not store IP addresses or request logs. Cloudflare, which carries the connection, necessarily sees the connecting IP address. Reports are not anonymous in a strict sense and are not end-to-end encrypted. The full schema is in the source repository.

This website

This site uses PostHog for page-view counts and one click event (the download button), tagged with the ?ref= label of the link you arrived by, if it had one. It runs without cookies or browser storage, so it cannot recognise you on a return visit, and it records no session replays, no form input and no identity. IP addresses are used by PostHog to derive a coarse location and are not stored with the event. Fonts load from Google Fonts. There are no other third-party scripts. It is served by Cloudflare, which logs requests for security and operational purposes under Cloudflare's privacy policy.

Contact

Questions about privacy: support@keysrs.com.