Privacy Policy

01Who we are

UsageMeter is a browser extension and a web dashboard published by PiloteCode. This policy covers the extension (Chrome, Edge, Firefox), the usagemeter.app website and the UsageMeterLink desktop companion. UsageMeter is an independent third-party tool: it is not affiliated with, endorsed by or sponsored by Anthropic, PBC.

Data controller: PiloteCode, contactable at contact@usagemeter.app. For any question about this policy or to exercise your rights, that address reaches a human. We do not have a designated Data Protection Officer — our processing does not meet the thresholds of art. 37 GDPR.

02What we collect

Only what the features need. Everything below is either kept on your device, or sent to our servers as described in the next section:

• Usage percentages and reset times: read from the same claude.ai endpoint the interface uses (5-hour window, weekly windows, per-model and per-product limits), with the share of the week each product used (Claude Code, chats, Cowork) and your usage-credit spend against its monthly cap when Claude reports them. Numbers and timestamps only.
• Measured message cost: for each message you send, the percentage jump it caused, plus the token counts the Claude stream itself reports. This is what powers the token estimates (the ≈ tokens behind each limit); it contains no text.
• Claude account identity: email, display name, organisation ID, account UUID and plan tier, so the multi-account switcher can label and switch between accounts.
• Claude session cookie: read and re-set locally to switch accounts. It stays on your device and is stripped before anything is sent to our servers.
• Your settings: language, theme, font, meters, notification and feature preferences.
• Device identifier: a random UUID generated on install, used to attach synced data to an installation before you sign in. It is not derived from your hardware or your browser.
• UsageMeter account: if you create one, your email, name, optional avatar, plan, and the subscription identifiers Stripe gives us.
• Anonymous activity ping: every few minutes the extension sends its random identifier and its version number so the site can display a live count of active installs. No page, no URL and no usage figure is attached to it.
• Third-party AI meters: if you enable the ChatGPT or Grok meters, the same kind of usage numbers for those services, read the same way.
• Claude Code statistics: if you install the UsageMeterLink companion, per-day token totals, model names and project names read from your local Claude Code transcripts, plus, for the last 8 days, the time, model and token counts of each turn, so the live 5-hour and weekly figures can merge all your PCs. The transcripts themselves are never uploaded.
• Invitation and partner links: if you arrive through a friend's invitation (?ref=) or a partner link (?via=), the code is remembered (see Cookies) so the offer applies and the partner can be credited if you subscribe.
• Partner programme: only if you become a UsageMeter partner, your payout method and payout address, and the commissions your link earned (amounts and dates).
• Web sign-ins: for each session opened on usagemeter.app, the IP address and browser (user agent) you signed in from, and its dates. They serve the security of your account.
• Orders and payments: if you subscribe, the date and starting point of each order (site, extension, email), the version of the terms of sale you accepted, the 24-hour window of the welcome offer when it applies to you, the amounts, currencies and dates of the payments received, and a record that the emails the law requires were sent (order confirmation, reminder before the first payment, cancellation receipt). The card itself stays with Stripe.

We do not fingerprint your browser. Earlier versions derived the device identifier from a canvas render and your GPU; since v1.4.11 it is a plain random UUID, and the fingerprinting code has been removed from the extension.

03What we never collect

These are not "disabled by default" — the code to do them does not exist:

• The content of your conversations: prompts, replies, attachments, titles, projects.
• Your browsing history, or anything at all from pages other than claude.ai, chatgpt.com and grok.com (and only when you enable those meters).
• Advertising or profiling trackers without your consent. Meta and Google are only loaded after your “yes”, never in the extension nor on account or checkout pages, and no data from the extension is ever sent to an advertising platform. No Google Analytics, no session recorder, no browser fingerprinting.
• Your payment card. Stripe handles checkout on its own pages; we only ever see the resulting subscription identifier.
• Your Claude password, or any Claude API key.

04Cloud sync

Since v1.4.11 sync is part of the product and has no on/off switch: the web dashboard, the desktop companion and multi-device continuity are all built on it. It runs against your UsageMeter account when you have one, and against your random device identifier when you do not. What travels:

• Settings, feature preferences, meter and indicator choices, themes and customisations.
• Notification preferences.
• Claude / provider account list: email, name, organisation ID, plan tier. The session cookie is removed before sending and is additionally stripped again server-side.
• Usage cache and usage history: percentages, reset times and timestamps, the weekly share of each product and the usage-credit figures.
• Calibration: your measured observations (tokens sent, percentage moved), so a new browser inherits your calibration instead of starting over.
• Your saved "Ask Claude" prompt presets.

No conversation content is ever synced. Before you sign in, the data is attached to your device identifier only; when you sign in, the device is linked to your account so your other devices see the same state. You can ask for a copy of all of it, or for its deletion, from your account's privacy page — each request is confirmed by a member of the team.

05Features tied to your account

Some features process more data, only when you use them:

• Limit hits: when a Claude limit reaches 100% (an extension reading, a “429” refusal from claude.ai, or a block UsageMeter Link sees in Claude Code), we record the time, the limit, its reset time and the Claude organisation id, for your history of blocks and the plan advisor. Kept for 400 days.
• Alerts: so that you never get the same alert twice, your devices (extension, UsageMeter Link) tell the server which alerts they have already shown; these records are kept for 9 days. Your alert settings are kept with your account.
• Reply prices: so that no wrong figure is shown, the extension asks the server whether Claude Code used tokens during a reply (the number of turns, nothing else).
• Claude Code (UsageMeter Link): besides token totals, the app sends aggregates per day and per model: the share of sub-agents, MCP servers, skills, plugins, effort level and entry point, tokens re-read after a break, and the Cowork sessions of Claude Desktop. The names of skills, MCP servers, plugins and custom agents are replaced by a fingerprint unless you choose to send them in the app. Never a file path, never prompt content.
• Team (Team plan): if you join a team and choose to share your figures, its owner sees your session and week percentages, your pace, your Claude plan, your Claude Code tokens and your credits, and can export them; the Slack or Discord recap only names you if you turned that on. You can stop sharing at any time.
• Share cards and public widgets: a “My week” card or a widget is published only if you create it, with only the figures you chose (never your email, accounts, projects or computer names), and you can take it down at any time.
• Weekly recap: an email that sums up your Claude week; one click unsubscribes you.
• Account language: the site's language when you sign up and sign in, so that we write to you in your language.
• Founder licence: your seat number and purchase date, kept with your payments.
• Several Claude accounts: UsageMeter Link reads, in Claude Code’s own settings file, only which Claude account Claude Code is signed into (its organization id and the e-mail or organization name Claude Code shows), to show that account’s limits, tell you when it changes and split your Claude Code tokens by account. It never reads your credentials or anything else in that file, and the e-mail is only shown to you, never on a widget.
• Widget loads: each time one of your public widgets is fetched, we count it per day with the kind of client (GitHub’s image proxy, Notion, a website’s domain, a direct visit), with no IP address and no browser details, to know whether widgets are used. We may also note public pages that embed them, such as a GitHub README found with GitHub’s public code search. Kept 400 days, erased with your account.
• Experiments (A/B tests): to improve the extension, an install may be shown one of two versions of a screen, such as a sign-in reminder. We record which version it saw and whether it led to a sign-in, a sign-up or a subscription, under a hashed identifier of the install (never the identifier itself); once you sign in, this is linked to your account. Erased from your account with it.

06Why we are allowed to process it (legal bases)

Under art. 6 GDPR, each purpose has its own basis:

• Performance of a contract (art. 6.1.b): running the meters, syncing your settings and history across your devices, managing your account and your subscription.
• Legitimate interest (art. 6.1.f): the anonymous active-install count, protecting the service and your account against abuse (including the IP address and browser of your sign-ins), keeping the licence check honest, and keeping proof of orders and of the legally required emails in case it has to be shown. No profile is built.
• Legal obligation (art. 6.1.c): keeping invoices and recorded payments for the period accounting and tax law requires, and giving you the information the law requires (order confirmation, right of withdrawal, cancellation).
• Consent (art. 6.1.a): the optional ChatGPT / Grok meters and the desktop companion, which do nothing until you turn them on or install them. You can withdraw that at any time by turning them off.
• Consent (art. 6.1.a): ad measurement, personalised advertising, the partner programme (um_via cookie) and Google AdSense ads on our articles — only if you accept them, and withdrawable at any time with the “Cookies” link.
• Legitimate interest (art. 6.1.f): the aggregate counters of campaign links, arrivals on campaign pages and partner clicks, with no cookie or identifier (daily totals, nothing about the person), and the optional “How did you hear about us?” question.
• Legal obligation (art. 6.1.c and 7.1): the proof of your cookie choices — a random identifier, the date and the purposes chosen, without IP address or account.

07What stays on your device

The extension keeps a full local copy of everything it shows, in your browser's extension storage. It is not readable by websites or by other extensions:

• Your settings, themes, meters and feature preferences.
• Usage history for the charts (capped, and compacted on write).
• The Claude session cookies of your saved accounts — needed to switch between them, and never sent anywhere.
• Your measured calibration and per-turn token log.
• Your UsageMeter access token, if you signed in.

08Cookies

usagemeter.app sets the cookies it needs to work: session, language, remembering your choices and, if you open a friend's link, their invitation offer. The others — ad measurement, personalised advertising, the partner programme, ads on our articles — are set only with your consent, collected by our banner or, in Europe, by Google's consent message. The full list, the durations, our partners and your choices are on the “Cookie policy” page.

• Necessary, no consent needed: your session once signed in, the site's language, your cookie choices (um_consent) and, if you open a friend's link, their invitation offer (um_ref, 30 days, which you can remove from the pricing page).
• Only with your consent: ad measurement (um_attr and the cookies of Meta and Google), personalised advertising, the partner programme (um_via) and Google AdSense ads on our articles and guides. Never on account or checkout pages, never in the extension.
• Changing your mind: the “Cookies” link at the bottom of every page or the icon in the bottom-left corner; “Refuse all” withdraws everything in one click.
• Stripe sets its own cookies on its checkout pages, under Stripe's policy, never on ours.

The extension itself sets no cookie of its own. It reads and re-sets the claude.ai session cookie locally, and only to switch between your own accounts. The invitation and partner cookies only exist if you arrived through such a link, and you can delete them at any time from your browser settings.

09Advertising and campaign measurement

Only if you accept “Ad measurement” (and “Personalised advertising” for Meta), we record which ad or link brought you and what followed: a click on “Add the extension” or a request for the link by email, the install seen by the page, sign-up, checkout started, trial, first payment. We share with Meta and Google the clicks on “Add” and link requests, sign-ups, checkouts started, trials and first payments — never the install, a renewal or a refund — including your email address, hashed before sending when you gave it to us, which they can match with your account on their side. Meta Platforms Ireland and we are joint controllers for collecting and sending this data (art. 26 GDPR); Google Ireland acts as an independent controller. Nothing from the browser extension is ever sent to an advertising platform.

• Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time with the “Cookies” link.
• The essence of our arrangement with Meta: we inform you and collect your consent; Meta answers for what it then does with the data, as a controller. You can exercise your rights over this joint processing with us or with Meta; we pass on to Meta, within 7 days, the requests that concern it.
• Retention: um_attr cookie and click identifiers, 90 days; campaign attached to your account, 25 months after sign-up at most, or until you withdraw consent or delete the account; log of what was sent to the platforms, 13 months, without its content.
• Transfers: Meta and Google may process this data in the United States, under the EU–US Data Privacy Framework, upheld by the EU General Court on 3 September 2025.
• Withdrawal: nothing more is sent under that choice, pending sends are cancelled and your account’s attribution is erased. What was already sent stays with Meta or Google, where you can manage it (links in the cookie policy).
• Ads on our articles: if you accept “Ads on this site”, Google AdSense may show and measure ads on our articles, guides, comparisons, tools and reference pages — never on the home page, pricing, download, your account or checkout. Google acts as an independent controller.
• In Europe (EEA, UK, Switzerland), these choices are collected by Google's consent message, certified for the IAB TCF framework; we keep only the result and a fingerprint of it.

10Partner programme and invitations

If you arrive through a partner's link (creator, blog…) and accept “Partner programme”, we remember their code for 60 days (um_via cookie, the last link wins) so they earn a commission if you subscribe; without your consent no cookie is set and the visit is only counted in their statistics. The partner only sees a masked address (e.g. ma***@gmail.com) and the amounts paid. A partner code typed at checkout credits them too, without any cookie. A friend's invitation link is remembered for 30 days (um_ref cookie) only to apply the offer you opened, without consent; you can remove it from the pricing page.

11The link sent by email

On a phone, you can ask to receive the install link by email, to open it on your computer. We send the link once, with no follow-up, and we do not keep your address. The one exception: if you accepted “Ad measurement” and Meta, its hashed form goes with that event to Meta, then is erased within 30 days.

12“How did you hear about us?”

After you sign up, we may ask you once how you heard about UsageMeter. Answering is optional (“Don’t ask again” is enough); the answer is kept with your account and deleted with it. It only tells us which channels work, in overall figures, with no tracker. Legal basis: legitimate interest.

13Live support

The chat bubble in the bottom-right corner loads nothing until you click it. On click, the Pilote Support widget opens (PiloteCode, the same publisher as UsageMeter, support.pilotecode.com): it then receives the page address and title, the page you came from, your screen size, your language and time zone, and keeps the conversation and a visitor identifier in your browser’s local storage (“ps:…” keys). The first replies may be written by an AI assistant acting on our behalf. The live view of your page never starts without your consent, given each time. Conversations are kept as long as needed to follow up on your request.

14Browser permissions, one by one

Each permission the extension requests, and what it is actually for:

• storage — save your settings, history and meters locally.
• cookies — read and switch the claude.ai session cookie for the multi-account switcher.
• tabs — reload claude.ai after an account switch and open the pages the buttons point to.
• notifications — the session-full alert and the connection-expiry reminder, both optional.
• alarms — schedule the periodic usage refresh and the sync.
• contextMenus — the "Ask Claude" right-click entry.
• scripting — inject the meters and tools into the claude.ai pages.
• webRequest — detect the rate-limit response Claude returns, so the countdown is accurate.
• Host access to claude.ai — read usage and display the interface.
• Host access to usagemeter.app — sign in, check your plan and sync.
• Optional host access to chatgpt.com and grok.com — requested only if you enable those meters, and revocable from your browser.

15How we read Claude usage

The extension calls the same usage endpoint claude.ai calls, from your own logged-in browser session, and reads the percentages back. It never uses the Claude API on your behalf, never sends a prompt, and never acts as a proxy. When a reply finishes, it re-reads that endpoint to measure the percentage the message cost — that measurement is a number, produced entirely on your machine.

16No data sharing with Anthropic

UsageMeter is an independent third-party tool. We do not share, sell or transmit any Claude-related data to Anthropic, PBC, or to anyone else, beyond what your own browser session already does when you use claude.ai. Specifically:

• We do not forward conversations, prompts or responses to Anthropic or to any other server.
• We do not transmit Claude authentication cookies or session tokens to any third-party service.
• We do not access Claude API keys on your behalf.
• We do not proxy Claude and do not redistribute Claude-generated content.

17Chrome Web Store Limited Use

UsageMeter's use of information collected by its browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. No data from the extension is used for advertising or sent to an advertising platform, not even in aggregate. When it is installed, the extension may only tell the open usagemeter.app tab that it is installed, without any identifier or data; if you accepted “Ad measurement”, the site records the install for its own statistics and never passes it on.

18Who else touches your data (sub-processors)

The complete list. None of them receives conversation content:

• Hetzner Online GmbH (Germany, EU): hosting for the site, the API and the database.
• Stripe Payments Europe (Ireland, EU): subscriptions and payments. Stripe is its own controller for payment data; we never see your card.
• Resend (email delivery): account emails (verification, password reset, subscription notices) and, unless you opt out, product news. To send those, your email address, first name and opt-out status are kept in Resend's contact list, and removed when you delete your account (or at the next hourly sync if Resend cannot be reached at that moment).
• Discord (United States): private notifications to the team for account events (new subscription, data request, partner payout request), which can include your email address and, for a payout, its destination.
• Gravatar / Automattic (United States): the popup builds an avatar URL from an MD5 hash of your account email. That hash reaches Gravatar when the popup opens. It is only used to display a picture, and it stops if you set an avatar on your account.
• Google (United States): only if you choose "Sign in with Google". Google then tells us your email and name.
• GitHub (United States): only if you choose "Sign in with GitHub". GitHub then tells us your email and name.
• Meta Platforms Ireland (Ireland; United States): only if you accept “Ad measurement” and “Personalised advertising” — the events of our campaigns (see “Advertising and campaign measurement”). Joint controller with us for collecting them, then sole controller.
• Google Ireland (Ireland; United States): Google Ads only with “Ad measurement”; Google AdSense only with “Ads on this site”; in Europe, Google's consent message. Independent controller.
• Affiliate partners: only if you arrive through their link and accept “Partner programme”, or type their code — a masked address and the amounts paid.
• Pilote Support (PiloteCode, same publisher): only if you open the chat — see “Live support”.

19International transfers

Your data is hosted in the European Union (Hetzner, Germany) and stays there. A few of our providers may process limited data in the United States: Gravatar (an MD5 hash of your email, only to show an avatar), Google and GitHub (only if you sign in with them), Discord (the team's internal notifications) and Stripe's global infrastructure for payments. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Only with your consent, Meta and Google may also process in the United States the data of our campaigns and of the ads (see “Advertising and campaign measurement”), under the same EU–US framework, upheld by the EU General Court on 3 September 2025.

20How long we keep it

Nothing is kept longer than it is useful:

• Account and synced data: for as long as your account exists, then deleted when you delete it, except what follows, which the law or proof requires us to keep.
• Usage history and token statistics: rolling 24 months, then deleted.
• Per-turn token counts (Claude Code and claude.ai): 8 days; the daily totals above keep the long-term history.
• Weekly per-product usage history: 120 days.
• Partner-link visits: the keyed IP hash is erased after 90 days; the visit count stays, without any identifier.
• Anonymous activity pings: the individual pings are pruned after 10 minutes; only aggregate hourly counts, which identify nobody, are kept.
• Local data on your device: until you clear it or uninstall the extension; you are in control of that copy.
• Payments, invoices and partner commissions: kept for the period accounting and tax law requires (10 years in France), including after your account is deleted, when they are detached from it.
• Record of billing notices (reminder before the first payment, cancellation receipt): kept without your email address for the limitation period of contract claims, including after your account is deleted.
• Your deletion request: kept (account ID, email, dates) to prove it was carried out.
• Opt-out register: an address that unsubscribed from marketing emails stays on it, so it never receives them again.
• Service activity log (team actions, payment statistics): kept for the security and running of the service; after deletion, the identifier it holds no longer points to any account.
• Your cookie choices: um_consent cookie 6 months; proof of each choice (random identifier, date, purposes, no IP or account) 5 years.
• Ad measurement: um_attr cookie and click identifiers 90 days; campaign attached to your account 25 months after sign-up at most, or until you withdraw consent or delete the account; log of what was sent to the platforms 13 months, without its content.
• Partner programme: um_via cookie 60 days; counters of campaign links, arrivals on campaign pages and partner clicks 25 months, aggregated.
• Your answer to “How did you hear about us?”: as long as your account.

21Your rights

Under the GDPR you have the right to:

• Access your data and get a copy of it (art. 15 and 20): file the request from your account's privacy page; once a member of the team confirms it, the full JSON export is downloadable there for a week.
• Correct it (art. 16): from your account, or by writing to us.
• Erase it (art. 17): file the request from the same page; once confirmed, your account and the data attached to it are deleted, except what the law or proof requires us to keep (see "How long we keep it").
• Restrict or object to processing (art. 18 and 21), including our legitimate-interest processing.
• Withdraw consent at any time, for anything based on consent, without affecting what was done before.
• Lodge a complaint with a supervisory authority: in France, the CNIL (cnil.fr).
• Withdraw your cookie consent in one click, at any time, with the “Cookies” link at the bottom of every page; for the data sent to Meta in our joint processing, you can contact us or Meta.

Every export or deletion request is reviewed by a human before anything is produced or erased — a safeguard against a stolen session wiping an account, not a hurdle. We answer within one month, as art. 12 requires, and usually within a few days; you are emailed at each step.

22Deleting everything

Go to usagemeter.app/account/privacy and file a deletion request (you will be asked to type DELETE). A member of the team confirms it; you are emailed, and only then are your account, synced settings, usage history, token statistics, linked accounts, devices, referrals, orders and your email contact at Resend erased. Payments and commissions stay, detached from your account, for bookkeeping. Nothing changes in the meantime, and you can withdraw the request by writing to us. Cancel an active subscription first, so Stripe stops billing. To clear the local copy in your browser, uninstall the extension. If you would rather we handled everything by email, write to contact@usagemeter.app.

23Children

UsageMeter is not aimed at children under 16 and we do not knowingly collect their data. If you believe a child has given us data, write to contact@usagemeter.app and we will delete it.

24Security

The measures that protect what we hold:

• Everything travels over HTTPS; the database is not reachable from the public internet.
• Claude session cookies are stripped before sync leaves your browser, and stripped again server-side: they are never written to our database.
• Access tokens are scoped to the extension and expire, and a password reset revokes all of them along with every open web session; passwords are hashed, never stored in clear.
• A Google or GitHub sign-in joins an existing account only once that account's address has been proven, so nobody can take over an account created with your address.
• Every public API endpoint is rate-limited.
• In the event of a breach affecting your rights, we notify the supervisory authority within 72 hours and inform you directly when the risk is high.

25Changes to this policy

We may update this policy. The date at the top of this page is the date of the current revision, and material changes are announced in the extension's changelog. If we ever start collecting something new that requires your consent, we will ask for it before collecting anything.