Privacy Policy

UsageMeter — browser extension & dashboard by PiloteCode
Last updated: November 6, 2026

UsageMeter is an independent third-party tool for Claude.ai. Not affiliated with, endorsed by, or sponsored by Anthropic, PBC. Claude™ is a trademark of Anthropic, PBC.

1. Who we are

UsageMeter is a browser extension and a web dashboard published by PiloteCode. This policy covers the extension (Chrome, Edge, Firefox), the usagemeter.app website and the UsageMeterLink desktop companion. UsageMeter is an independent third-party tool: it is not affiliated with, endorsed by or sponsored by Anthropic, PBC.

Data controller: PiloteCode, contactable at contact@usagemeter.app. For any question about this policy or to exercise your rights, that address reaches a human. We do not have a designated Data Protection Officer — our processing does not meet the thresholds of art. 37 GDPR.

2. Data collection, use, storage and sharing at a glance

The short answers. Each one is detailed further down this page.

• Collection: your Claude usage figures and reset times, token counts, the labels of your Claude accounts (email, name, organization ID, plan), your settings, a random device identifier and your IP address; if you create a UsageMeter account, its email, name, password and subscription details. Conversations are counted in your browser, not collected.
• Use and processing: to show your limits, warn you before you reach them, sync your devices, run your account and subscription, and protect the service. Unnamed totals also feed two public statistics pages. Never for advertising, and never for anything unrelated to the extension.
• Storage: in your browser's extension storage on your device and, once you sign in, on our servers in the European Union (Hetzner, Germany), reached over HTTPS. Retention periods are listed under “How long we keep it”.
• Sharing: we never sell your data. It goes only to the service providers listed under “Who we share your data with”, each for one stated purpose, and to other people only when you publish something yourself (a share card, a public widget, the leaderboard, a team).
• Your choice: signing in is optional. Until you do, only technical data leaves your browser (a random identifier, the version number, your IP address, A/B test and feature counters). Signing in starts the sync, signing out stops it, and you can have everything deleted at any time.

3. What we collect

Only what the features need. Some of it stays on your device; what reaches our servers is described in “Cloud sync” and in the sections after it:

• Usage percentages and reset times: read from the same claude.ai endpoint the interface uses (5-hour window, weekly windows, per-model and per-product limits), with the share of the week each product used (Claude Code, chats, Cowork) and your usage-credit spend against its monthly cap when Claude reports them. Numbers and timestamps only.
• Measured message cost: for each message you send, the percentage jump it caused, plus the token counts of the reply, reported by the Claude stream or counted on your device. This is what powers the token estimates (the ≈ tokens behind each limit); it contains no text. The extension also adds up a monthly estimate at API prices, which stays in your browser. It only reaches our server if you open its share page, to draw the card, and it is only kept if you create the link.
• Claude account identity: email, display name, organisation ID, account UUID and plan tier, so the multi-account switcher can label and switch between accounts. If you open the sign-up form, your email and display name fill it in: nothing leaves your browser until you create the account.
• Claude session cookie: read and re-set locally to switch accounts. It stays on your device and is stripped before anything is sent to our servers.
• Your settings: language, theme, font, meters, notification and feature preferences.
• Device identifier: a random UUID generated on install, used to tell this installation apart: its XP and, once you are signed in, its synced data. It is not derived from your hardware or your browser.
• UsageMeter account: if you create one, your email, name, optional avatar, plan, and the subscription identifiers Stripe gives us. A password you choose is sent over HTTPS when you sign in and stored only as a hash; signing in with Google, GitHub or Discord uses none.
• Activity ping: every 15 minutes the extension sends its random identifiers (one for the ping, one for the install) and its version number, so the site can display a live count of active installs and credit XP to the install. Once you sign in, your access token goes with it, to credit your account. No page, no URL and no usage figure is attached to it.
• Third-party AI meters: if you enable the ChatGPT or Grok meters, the same kind of usage numbers for those services, read the same way.
• Claude Code statistics: if you install the UsageMeterLink companion, per-day token totals, model names and project names read from your local Claude Code transcripts, plus, for the last 8 days, the time, model, project (as a fingerprint, never its path) and token counts of each turn, so the live 5-hour and weekly figures can merge all your PCs and be split by project. The transcripts themselves are never uploaded.
• Invitation and partner links: if you arrive through a friend's invitation (?ref=) or a partner link (?via=), the code is remembered (see Cookies) so the offer applies and the partner can be credited if you subscribe.
• Partner programme: only if you become a UsageMeter partner, your payout method and payout address, and the commissions your link earned (amounts and dates).
• Web sign-ins: for each session opened on usagemeter.app, the IP address and browser (user agent) you signed in from, and its dates. They serve the security of your account.
• Orders and payments: if you subscribe, the date and starting point of each order (site, extension, email), the version of the terms of sale you accepted, the 24-hour window of the welcome offer when it applies to you, the amounts, currencies and dates of the payments received, and a record that the emails the law requires were sent (order confirmation, reminder before the first payment, cancellation receipt). The card itself stays with Stripe.
• IP address: every request to our servers carries it, as with any website. It serves to limit abuse, in short-lived counters deleted once their time window has passed, and is kept with your web sign-ins. We keep no location: where a country code comes with a request, it only picks the language and currency of a page.
• Unnamed counters: how many browsers saw or clicked a message in the popup (such as the request for a review), with no identifier.

We do not fingerprint your browser. Earlier versions derived the device identifier from a canvas render and your GPU; since v1.4.11 it is a plain random UUID, and the fingerprinting code has been removed from the extension.

4. What never reaches our servers

The code to send these does not exist:

• The content of your conversations: prompts, replies, attachments, titles, claude.ai projects.
• Your browsing history, or anything from sites other than claude.ai. The optional ChatGPT and Grok meters send only usage numbers, and the optional Claude button on Google sends nothing to us.
• Advertising or profiling trackers without your consent. Meta and Google are only loaded after your “yes”, never in the extension nor on account or checkout pages, and no data from the extension is ever sent to an advertising platform. No Google Analytics, no session recorder, no browser fingerprinting.
• Your payment card. Stripe handles checkout on its own pages; we only ever see the resulting subscription identifier.
• Your Claude password, or any Claude API key.

5. What the extension does with your conversations

The extension handles the text of your conversations only in your browser, in these cases:

• Token counts: for the conversation open on claude.ai, the extension requests it from claude.ai with your own session and counts its text on your device with a built-in tokenizer. Only the counts are kept; the text is discarded once counted. On claude.ai pages it also reads Claude's own responses as they arrive, only to pick up the limit and token fields.
• Queued messages: if you queue a message for when a limit returns, its text, its conversation and the page address stay in your browser's storage until the message is sent to Claude in your session, or until you remove it.
• Export: if you export a conversation, the file is built in your browser and saved on your computer.
• Continue in a new chat: if you click it under a heavy conversation, its latest messages and the titles of its artifacts are put together in your browser and wait in its storage, ten minutes at most, for the new chat to paste them in its message box; they are erased once pasted. Nothing is sent: you read the text and send it yourself.
• “Ask Claude”: the text you select, or a preset you wrote, goes to claude.ai when you use the right-click entry. Presets are your own text and sync with your account. With the optional Claude button on Google, your search query goes to claude.ai when you click it.

The text of your conversations never reaches our servers.

6. How we use your data

Every use serves the extension's single purpose, showing and acting on your Claude limits, and what keeps it running:

• Show your limits, pace, forecasts and token figures in the extension, on the dashboard and in the desktop companion.
• Sync your settings and history across your browsers and computers, once you sign in.
• Send the alerts and reminders you turned on, without showing the same one twice.
• Run your account, subscription and payments, and send the emails they require.
• Protect the service and your account against abuse, with your IP address, sign-in records and rate limits.
• Improve token estimates and the extension itself, with measurements, A/B tests and unnamed counters.
• Publish unnamed totals on two public pages: limits today and the plan barometer.
• Send product news by email, unless you unsubscribe.

We never sell your data. Data from the extension is never used or transferred for advertising, for purposes unrelated to its single purpose, or to determine creditworthiness or for lending.

7. Cloud sync

Cloud sync is what signing in gives you: the web dashboard, the desktop companion and continuity across your devices are built on it. It runs against your UsageMeter account: signing in is your choice, until then none of the following leaves your browser, and signing out stops it. What travels once you are signed in:

• Settings, feature preferences, meter and indicator choices, themes and customisations.
• Notification preferences.
• Claude / provider account list: email, name, organisation ID, plan tier. The session cookie is removed before sending and is additionally stripped again server-side.
• Usage cache and usage history: percentages, reset times and timestamps, the weekly share of each product and the usage-credit figures.
• Calibration: your measured observations (tokens sent, percentage moved), so a new browser inherits your calibration instead of starting over.
• Your saved "Ask Claude" prompt presets.

No conversation content is ever synced. When you sign in, this browser is linked to your account so your other devices see the same state. Copies that versions before 1.7.8 sent without an account are no longer updated and stay attached to their device identifier only. You can ask for a copy of all of it, or for its deletion, from your account's privacy page — each request is confirmed by a member of the team.

8. Features tied to your account

Some features process more data, only when you use them:

• Limit hits: when a Claude limit reaches 100% (an extension reading, a “429” refusal from claude.ai, or a block UsageMeter Link sees in Claude Code), we record the time, the limit, its reset time and the Claude organisation id, for your history of blocks and the plan advisor. These records are also counted together, with no name or account shown, for the public limits-today page. Kept for 400 days.
• Alerts: so that you never get the same alert twice, your devices (extension, UsageMeter Link) tell the server which alerts they have already shown; these records are kept for 9 days. Your alert settings are kept with your account.
• Reply prices: so that no wrong figure is shown, the extension asks the server whether Claude Code used tokens during a reply (the number of turns, nothing else).
• Claude Code (UsageMeter Link): besides token totals, the app sends aggregates per day and per model: the share of sub-agents, MCP servers, skills, plugins, effort level and entry point, tokens re-read after a break, and the Cowork sessions of Claude Desktop. The names of skills, MCP servers, plugins and custom agents are replaced by a fingerprint unless you choose to send them in the app. Never a file path, never prompt content.
• Team (Team plan): if you join a team and choose to share your figures, its owner sees your session and week percentages, your pace, your Claude plan, your Claude Code tokens and your credits, and can export them; the Slack or Discord recap only names you if you turned that on. You can stop sharing at any time.
• Share cards and public widgets: a “My week” card or a widget is published only if you create it, with only the figures you chose (never your email, accounts, projects or computer names), and you can take it down at any time. The public leaderboard lists only accounts that turned it on: their public name or page ID, their Claude Code tokens for the month and the same tokens at API prices.
• Weekly recap: an email that sums up your Claude week; one click unsubscribes you.
• Account language: the site's language when you sign up and sign in, so that we write to you in your language.
• Founder licence: your seat number and purchase date, kept with your payments.
• Several Claude accounts: UsageMeter Link reads, in Claude Code’s own settings file, only which Claude account Claude Code is signed into (its organization id and the e-mail or organization name Claude Code shows), to show that account’s limits, tell you when it changes and split your Claude Code tokens by account. It never reads your credentials or anything else in that file, and the e-mail is only shown to you, never on a widget.
• Widget loads: each time one of your public widgets is fetched, we count it per day with the kind of client (GitHub’s image proxy, Notion, a website’s domain, a direct visit), with no IP address and no browser details, to know whether widgets are used. We may also note public pages that embed them, such as a GitHub README found with GitHub’s public code search. Kept 400 days, erased with your account.
• Experiments (A/B tests): to improve the extension, an install may be shown one of two versions of a screen, such as a sign-in reminder. We record which version it saw and whether it led to a sign-in, a sign-up or a subscription, under a hashed identifier of the install (never the identifier itself); once you sign in, this is linked to your account. Erased from your account with it.
• Limit alert: if you leave your email address on a page about Claude’s limits, that address and the language of the page, to confirm it and to email you when Anthropic changes the limits. Nothing else is sent.
• Plan barometer: the token ceilings measured on your account are also counted together with those of other accounts on the same plan, with no name or account shown, for the public plan barometer.

9. Why we are allowed to process it (legal bases)

Under art. 6 GDPR, each purpose has its own basis:

• Performance of a contract (art. 6.1.b): running the meters, syncing your settings and history across your devices, managing your account and your subscription.
• Legitimate interest (art. 6.1.f): the anonymous active-install count, protecting the service and your account against abuse (including the IP address and browser of your sign-ins), keeping the licence check honest, and keeping proof of orders and of the legally required emails in case it has to be shown. No profile is built.
• Legal obligation (art. 6.1.c): keeping invoices and recorded payments for the period accounting and tax law requires, and giving you the information the law requires (order confirmation, right of withdrawal, cancellation).
• Consent (art. 6.1.a): the optional ChatGPT / Grok meters and the desktop companion, which do nothing until you turn them on or install them. You can withdraw that at any time by turning them off.
• Consent (art. 6.1.a): ad measurement, personalised advertising, the partner programme (um_via cookie) and Google AdSense ads on our articles — only if you accept them, and withdrawable at any time with the “Cookies” link.
• Legitimate interest (art. 6.1.f): the aggregate counters of campaign links, arrivals on campaign pages and partner clicks, with no cookie or identifier (daily totals, nothing about the person), and the optional “How did you hear about us?” question.
• Legal obligation (art. 6.1.c and 7.1): the proof of your cookie choices — a random identifier, the date and the purposes chosen, without IP address or account.
• Consent (art. 6.1.a): the limit alert, given by confirming your address in the email we send you; you withdraw it by unsubscribing from any alert.
• Legitimate interest (art. 6.1.f): the public plan barometer, built from measurements we already hold and shown only as medians of at least 5 accounts.

10. How and where your data is stored

In two places. On your device, the extension keeps a full local copy of what it shows, in your browser's extension storage, which websites and other extensions cannot read. On our servers, only what the sections above describe:

• Your settings, themes, meters and feature preferences.
• Usage history for the charts (capped, and compacted on write).
• The Claude session cookies of your saved accounts — needed to switch between them, and never sent anywhere.
• Your measured calibration and per-turn token log.
• Your UsageMeter access token, if you signed in.
• Messages you queue for later, until they are sent or you remove them.
• The latest messages of a conversation you continue in a new chat, ten minutes at most, until they are pasted.
• On our servers: your account, synced data and usage figures, in a database in the European Union (Hetzner, Germany), sent over HTTPS. Passwords are stored only as a hash, and Claude session cookies are never stored there. Retention periods are listed under “How long we keep it”.

11. Cookies

usagemeter.app sets the cookies it needs to work: session, language, remembering your choices and, if you open a friend's link, their invitation offer. The others — ad measurement, personalised advertising, the partner programme, ads on our articles — are set only with your consent, collected by our banner or, in Europe, by Google's consent message. The full list, the durations, our partners and your choices are on the “Cookie policy” page.

• Necessary, no consent needed: your session once signed in, the site's language, your cookie choices (um_consent) and, if you open a friend's link, their invitation offer (um_ref, 30 days, which you can remove from the pricing page).
• Only with your consent: ad measurement (um_attr and the cookies of Meta and Google), personalised advertising, the partner programme (um_via) and Google AdSense ads on our articles and guides. Never on account or checkout pages, never in the extension.
• Changing your mind: the “Cookies” link at the bottom of every page or the icon in the bottom-left corner; “Refuse all” withdraws everything in one click.
• Stripe sets its own cookies on its checkout pages, under Stripe's policy, never on ours.

The extension itself sets no cookie of its own. It reads and re-sets the claude.ai session cookie locally, and only to switch between your own accounts. The invitation and partner cookies only exist if you arrived through such a link, and you can delete them at any time from your browser settings.

See the cookie policy →

12. Advertising and campaign measurement

Only if you accept “Ad measurement” (and “Personalised advertising” for Meta), we record which ad or link brought you and what followed: a click on “Add the extension” or a request for the link by email, the install seen by the page, sign-up, checkout started, trial, first payment. We share with Meta and Google the clicks on “Add” and link requests, sign-ups, checkouts started, trials and first payments — never the install, a renewal or a refund — including your email address, hashed before sending when you gave it to us, which they can match with your account on their side. Meta Platforms Ireland and we are joint controllers for collecting and sending this data (art. 26 GDPR); Google Ireland acts as an independent controller. Nothing from the browser extension is ever sent to an advertising platform.

• Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time with the “Cookies” link.
• The essence of our arrangement with Meta: we inform you and collect your consent; Meta answers for what it then does with the data, as a controller. You can exercise your rights over this joint processing with us or with Meta; we pass on to Meta, within 7 days, the requests that concern it.
• Retention: um_attr cookie and click identifiers, 90 days; campaign attached to your account, 25 months after sign-up at most, or until you withdraw consent or delete the account; log of what was sent to the platforms, 13 months, without its content.
• Transfers: Meta and Google may process this data in the United States, under the EU–US Data Privacy Framework, upheld by the EU General Court on 3 September 2025.
• Withdrawal: nothing more is sent under that choice, pending sends are cancelled and your account’s attribution is erased. What was already sent stays with Meta or Google, where you can manage it (links in the cookie policy).
• Ads on our articles: if you accept “Ads on this site”, Google AdSense may show and measure ads on our articles, guides, comparisons, tools and reference pages — never on the home page, pricing, download, your account or checkout. Google acts as an independent controller.
• In Europe (EEA, UK, Switzerland), these choices are collected by Google's consent message, certified for the IAB TCF framework; we keep only the result and a fingerprint of it.

13. Partner programme and invitations

If you arrive through a partner's link (creator, blog…) and accept “Partner programme”, we remember their code for 60 days (um_via cookie, the last link wins) so they earn a commission if you subscribe; without your consent no cookie is set and the visit is only counted in their statistics. The partner only sees a masked address (e.g. ma***@gmail.com) and the amounts paid. A partner code typed at checkout credits them too, without any cookie. A friend's invitation link is remembered for 30 days (um_ref cookie) only to apply the offer you opened, without consent; you can remove it from the pricing page.

14. The link sent by email

On a phone, you can ask to receive the install link by email, to open it on your computer. We send the link once, with no follow-up, and we do not keep your address. The one exception: if you accepted “Ad measurement” and Meta, its hashed form goes with that event to Meta, then is erased within 30 days.

15. “How did you hear about us?”

After you sign up, we may ask you once how you heard about UsageMeter. Answering is optional (“Don’t ask again” is enough); the answer is kept with your account and deleted with it. It only tells us which channels work, in overall figures, with no tracker. Legal basis: legitimate interest.

16. Live support

The chat bubble in the bottom-right corner loads nothing until you click it. On click, the Pilote Support widget opens (PiloteCode, the same publisher as UsageMeter, support.pilotecode.com): it then receives the page address and title, the page you came from, your screen size, your language and time zone, and keeps the conversation and a visitor identifier in your browser’s local storage (“ps:…” keys). The first replies may be written by an AI assistant acting on our behalf. The live view of your page never starts without your consent, given each time. Conversations are kept as long as needed to follow up on your request.

17. Browser permissions, one by one

Each permission the extension requests, and what it is actually for:

• storage — save your settings, history and meters locally.
• cookies — read and switch the claude.ai session cookie for the multi-account switcher.
• notifications — the session-full alert and the connection-expiry reminder, both optional.
• alarms — schedule the periodic usage refresh and the sync.
• contextMenus — the "Ask Claude" right-click entry.
• sidePanel — open UsageMeter in the browser's side panel.
• scripting — inject the meters and tools into the claude.ai pages.
• webRequest — detect the rate-limit response Claude returns, so the countdown is accurate.
• Host access to claude.ai — read usage and display the interface.
• Host access to usagemeter.app — sign in, check your plan and sync.
• Optional host access to chatgpt.com and grok.com — requested only if you enable those meters, and revocable from your browser.
• Optional host access to Google search pages (www.google.com and 24 other Google domains) — requested only if you turn on the Claude button on Google, and revocable from your browser.

18. How we read Claude usage

The extension calls the same usage endpoints claude.ai calls, from your own logged-in browser session, and reads the percentages back. It never uses the Claude API on your behalf, never acts as a proxy, and sends a message to Claude only if you queued it yourself. When a reply finishes, it re-reads that endpoint to measure the percentage the message cost — that measurement is a number, produced entirely on your machine.

19. No data sharing with Anthropic

UsageMeter is an independent third-party tool. We do not share, sell or transmit any Claude-related data to Anthropic, PBC, or to anyone else, beyond what your own browser session already does when you use claude.ai. Specifically:

• We do not forward conversations, prompts or responses to Anthropic or to any other server.
• We do not transmit Claude authentication cookies or session tokens to any third-party service.
• We do not access Claude API keys on your behalf.
• We do not proxy Claude and do not redistribute Claude-generated content.

20. Chrome Web Store Limited Use

UsageMeter's use of information collected by its browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. No data from the extension is used for advertising or sent to an advertising platform, not even in aggregate. When it is installed, the extension may only tell the open usagemeter.app tab that it is installed, without any identifier or data; if you accepted “Ad measurement”, the site records the install for its own statistics and never passes it on.

21. Who we share your data with

We never sell your data. These service providers receive only what they need for one stated purpose, and none of them receives conversation content:

• Hetzner Online GmbH (Germany, EU): hosting for the site, the API and the database.
• Stripe Payments Europe (Ireland, EU): subscriptions and payments. Stripe is its own controller for payment data; we never see your card.
• Our own mail server (PiloteCode, mx.pilotecode.com): account emails (verification, password reset, subscription notices) and, unless you opt out, product news, sent from no-reply@usagemeter.app. No outside email provider receives your address.
• Discord (United States): private notifications to the team for account events (new subscription, data request, partner payout request), which can include your email address and, for a payout, its destination. If you choose “Sign in with Discord”, Discord also tells us your email and name.
• Gravatar / Automattic (United States): the popup builds an avatar URL from an MD5 hash of your account email. That hash reaches Gravatar when the popup opens. It is only used to display a picture, and it stops if you set an avatar on your account.
• Google (United States): only if you choose "Sign in with Google". Google then tells us your email and name.
• GitHub (United States): only if you choose "Sign in with GitHub". GitHub then tells us your email and name.
• Meta Platforms Ireland (Ireland; United States): only if you accept “Ad measurement” and “Personalised advertising” — the events of our campaigns (see “Advertising and campaign measurement”). Joint controller with us for collecting them, then sole controller.
• Google Ireland (Ireland; United States): Google Ads only with “Ad measurement”; Google AdSense only with “Ads on this site”; in Europe, Google's consent message. Independent controller.
• Affiliate partners: only if you arrive through their link and accept “Partner programme”, or type their code — a masked address and the amounts paid.
• Pilote Support (PiloteCode, same publisher): only if you open the chat — see “Live support”.
• Other people: only what you publish yourself, such as a share card, a public widget, the leaderboard, or the figures you share with a team you joined.

22. International transfers

Your data is hosted in the European Union (Hetzner, Germany) and stays there. A few of our providers may process limited data in the United States: Gravatar (an MD5 hash of your email, only to show an avatar), Google and GitHub (only if you sign in with them), Discord (the team's internal notifications) and Stripe's global infrastructure for payments. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Only with your consent, Meta and Google may also process in the United States the data of our campaigns and of the ads (see “Advertising and campaign measurement”), under the same EU–US framework, upheld by the EU General Court on 3 September 2025.

23. How long we keep it

Nothing is kept longer than it is useful:

• Account and synced data: for as long as your account exists, then deleted when you delete it, except what follows, which the law or proof requires us to keep.
• Usage history and token statistics: rolling 24 months, then deleted.
• Per-turn token counts (Claude Code and claude.ai): 8 days; the daily totals above keep the long-term history.
• Weekly per-product usage history: 120 days.
• Partner-link visits: the keyed IP hash is erased after 90 days; the visit count stays, without any identifier.
• Activity pings: the individual pings are pruned after 30 minutes; only aggregate hourly counts, which identify nobody, are kept.
• Local data on your device: until you clear it or uninstall the extension; you are in control of that copy.
• Payments, invoices and partner commissions: kept for the period accounting and tax law requires (10 years in France), including after your account is deleted, when they are detached from it.
• Record of billing notices (reminder before the first payment, cancellation receipt): kept without your email address for the limitation period of contract claims, including after your account is deleted.
• Your deletion request: kept (account ID, email, dates) to prove it was carried out.
• Opt-out register: an address that unsubscribed from marketing emails stays on it, so it never receives them again.
• Service activity log (team actions, payment statistics): kept for the security and running of the service; after deletion, the identifier it holds no longer points to any account.
• Your cookie choices: um_consent cookie 6 months; proof of each choice (random identifier, date, purposes, no IP or account) 5 years.
• Ad measurement: um_attr cookie and click identifiers 90 days; campaign attached to your account 25 months after sign-up at most, or until you withdraw consent or delete the account; log of what was sent to the platforms 13 months, without its content.
• Partner programme: um_via cookie 60 days; counters of campaign links, arrivals on campaign pages and partner clicks 25 months, aggregated.
• Your answer to “How did you hear about us?”: as long as your account.
• Limit alert: your address until you unsubscribe, then 30 days; an address that is never confirmed is deleted after 30 days.

24. Your rights

Under the GDPR you have the right to:

• Access your data and get a copy of it (art. 15 and 20): file the request from your account's privacy page; once a member of the team confirms it, the full JSON export is downloadable there for a week.
• Correct it (art. 16): from your account, or by writing to us.
• Erase it (art. 17): file the request from the same page; once confirmed, your account and the data attached to it are deleted, except what the law or proof requires us to keep (see "How long we keep it").
• Restrict or object to processing (art. 18 and 21), including our legitimate-interest processing.
• Withdraw consent at any time, for anything based on consent, without affecting what was done before.
• Lodge a complaint with a supervisory authority: in France, the CNIL (cnil.fr).
• Withdraw your cookie consent in one click, at any time, with the “Cookies” link at the bottom of every page; for the data sent to Meta in our joint processing, you can contact us or Meta.

Every export or deletion request is reviewed by a human before anything is produced or erased — a safeguard against a stolen session wiping an account, not a hurdle. We answer within one month, as art. 12 requires, and usually within a few days; you are emailed at each step.

25. Deleting everything

Go to usagemeter.app/account/privacy and file a deletion request (you will be asked to type DELETE). A member of the team confirms it; you are emailed, and only then are your account, synced settings, usage history, token statistics, linked accounts, devices, referrals and orders erased. Payments and commissions stay, detached from your account, for bookkeeping. Nothing changes in the meantime, and you can withdraw the request by writing to us. Cancel an active subscription first, so Stripe stops billing. To clear the local copy in your browser, uninstall the extension. If you would rather we handled everything by email, write to contact@usagemeter.app.

26. Children

UsageMeter is not aimed at children under 16 and we do not knowingly collect their data. If you believe a child has given us data, write to contact@usagemeter.app and we will delete it.

27. Security

The measures that protect what we hold:

• Everything between the extension, the site and our servers travels over HTTPS; the database only accepts authenticated connections.
• Claude session cookies are stripped before sync leaves your browser, and stripped again server-side: they are never written to our database.
• Access tokens are scoped to the extension and expire, and a password reset revokes all of them along with every open web session; passwords are hashed, never stored in clear.
• A Google or GitHub sign-in joins an existing account only once that account's address has been proven, so nobody can take over an account created with your address.
• Every public API endpoint is rate-limited.
• In the event of a breach affecting your rights, we notify the supervisory authority within 72 hours and inform you directly when the risk is high.

28. Changes to this policy

We may update this policy. The date at the top of this page is the date of the current revision, and material changes are announced in the extension's changelog. If we ever start collecting something new that requires your consent, we will ask for it before collecting anything.