Anonymous version statistics privacy policy

What the check-in sends

• Each check-in contains exactly six fields: schema (the number 1), UTC day (YYYY-MM-DD), a fresh random daily token, app version, brand, and distribution channel. It contains no other app data.

• The random token rotates every UTC day. A failed request reuses it only within the same UTC day. If the app version changes that day, a later check-in can reclassify the same record. The check-in JSON payload and D1 raw or aggregate datasets contain no stable installation or device ID, and the service is not designed to link installations across UTC days. This statement does not cover Cloudflare's separate network-boundary processing, which is disclosed below.

• The service keeps at most one deduplicated active-installation record per token per UTC day. Retries do not increase the count.

What reporting never sends

Reporting never sends: name or account details; email; a persistent identifier; system or hardware information; session titles; prompts, messages, or history; quota or usage values; token counts or cost estimates; file paths; credentials; or API or authentication tokens.

Processing and Cloudflare's network boundary

The Worker sees the original token only in memory, then computes a date-domain-separated SHA-256 hash before D1. The original token is never written to D1 or the app's custom logs.

Cloudflare handles HTTPS, security controls, and rate limiting and therefore processes the source IP at its network boundary. The Worker passes the source IP only to a best-effort Workers RateLimit binding; it does not write the IP to D1 or custom logs. Cloudflare infrastructure, CDN, WAF, and network-error logging may retain operational data under Cloudflare's terms; we do not claim that those layers are log-free.

Retention and access

Live raw rows are deleted after the next successful closed-day aggregation. Operational failures can delay that cleanup, so this is not an exact one-hour promise. After deletion, D1 Time Travel may still restore database state for 7 days on the Free plan or 30 days on a Paid plan. Aggregates contain only day, version, brand, channel, and counts, are retained for 400 days, and appear only in a private maintainer dashboard.

When reporting runs

Reporting starts automatically in eligible production builds and runs at most once per UTC day for each version context. Local QA and builds without an approved reporting context do not send check-ins. Anonymous rows cannot be individually found or deleted because no stable ID or deletion handle exists; they follow the live raw-row and D1 Time Travel retention above.

Other app networking

Session and history data stays in the app's local SQLite database. If you use live Codex or Claude Code quota refresh, Quota Monitor contacts the corresponding provider services. This traffic is separate from anonymous version statistics and is governed by the provider's privacy terms.

This website

The website stores only your language choice in localStorage. It uses no cookies, client analytics, or third-party UI runtime. Cloudflare processes network data at the boundary described above.