Policy · privacy
Privacy, field by field
This page is a field list rather than an essay, because a privacy claim you cannot check is a slogan. Three tables: what the shipped app holds, what this website collects, and what is planned but not built. They are kept structurally separate so shipped behaviour and future intent can never be read as the same claim.
The app, today
What the shipped macOS app holds and what leaves your Mac. Only enabled providers perform authenticated work; Claude, Codex and Copilot execute fixed, resolved local binaries with fixed arguments, minimal environments, bounded output, deadlines, cancellation and child-process cleanup, and never invoke a shell.
| Field | Stored? | Leaves this Mac? | Detail |
|---|---|---|---|
| Provider choices, validated meter IDs, placements | Yes macOS preferences | No | Which providers you enabled and where each limit appears. Held in the standard macOS preferences system. |
| Bounded presentation metadata | Yes macOS preferences | No | A meter’s sanitized name, period, model pool, short label, order, role and dynamic status — enough to draw the meter, nothing more. |
| Fired-alert record | Yes macOS preferences | No | Meter IDs, alert kinds and window reset times, so a notice fires once per limit per window even across relaunches. It contains no usage readings. |
| Usage readings | No unless local history is on | No | The percentages the meters draw. Not persisted at all unless you turn on Store Usage History on This Mac, which is off by default. |
| Local usage history (opt-in, off by default) | No until you enable it | No never, enabled or not | When enabled: meter ID, timestamp, percent used, window reset time and a non-secret session fingerprint, in an owner-only SQLite file. Retained 90 days. Plain-text export and permanent deletion are in Settings. |
| Credentials, API keys, provider tokens | No | No | There are none to hold: no API keys, no separate login, no hosted account. Recovery flows open the provider’s own local CLI or app, and Dipstick never receives or stores credentials from them. |
| Cursor access token | No memory only, never written | Yes one allowlisted Cursor endpoint | Read from Cursor’s local state database read-only and kept in memory. It can be sent to exactly one allowlisted Cursor HTTPS endpoint — the same monthly usage request the installed client makes. That session refuses redirects, cookies and caching and caps the response at one megabyte. |
| Raw provider responses | No | No | Parsed in memory into meter values and discarded. |
| Transcripts and terminal content | No | No | The Claude Code transcript is parsed in memory and never logged or persisted. The status-line helpers ignore conversation text, session identifiers, transcript paths, working directories and model metadata by construction. |
| Account identifiers and local paths | No | No | Not persisted or logged. Copilot’s returned login is hashed for account continuity; Antigravity’s fingerprint is HMAC-derived for stale-data isolation. |
| Update check | No | Yes the request itself, and nothing else | Exactly one request that is not a provider refresh: an unauthenticated GET to api.github.com/repos/scottdflorida/dipstick-releases/releases/latest, at most once every 24 hours, sending nothing but the request itself. Nothing is downloaded or installed automatically. Turn it off with Check for Updates Automatically. |
| App analytics or telemetry | No | No | The shipped app has no inbound server, analytics, telemetry, cloud account or third-party package. |
02 / 05 · This website
This website
The entire allowlist for this website is four coarse events. It is enforced by a four-member union type in src/lib/analytics.ts, and the beacon body is a JSON object with exactly one key. There is no session, no visitor identifier, no cookie, and no third-party script anywhere on this site. Collection is off until the collector exists.
| Event | Stored? | Leaves this Mac? | Detail |
|---|---|---|---|
| visitor | No collection is off | No collection is off | A page was loaded. No path, no referrer, no identifier, no cookie. |
| download | No collection is off | No collection is off | A download link was activated. |
| checkout | No collection is off | No collection is off | A checkout control was activated. |
| purchase | No collection is off | No collection is off | A purchase completed, reported by the license service — not by your browser. |
There is no cookie on this site, no third-party script, no embedded font, no analytics vendor and no tracking pixel. Every request a page makes is to this domain.
03 / 05 · Not shipped
Future and opt-in — not shipped
The commerce contract describes bounded app analytics for a later release. None of it exists in the app today. If it ships, it is opt-in, stops immediately when turned off, and uses exactly the envelope and event fields below. Activation and recovery work whether analytics are on or off.
| Field or event | Stored? | Leaves this Mac? | Detail |
|---|---|---|---|
| schema | No not shipped | No not shipped | Integer. Always 1. |
| event | No not shipped | No not shipped | One value from the closed event list below. No free-form event names. |
| occurred_at | No not shipped | No not shipped | Unix seconds. |
| installation_id | No not shipped | No not shipped | A random UUIDv4 generated on first opt-in. It is not a device identifier. There is no hardware ID, serial number, or MAC address, and reinstalling creates a new value. |
| app_version | No not shipped | No not shipped | The Dipstick version, such as 0.1.0. |
| macos_major | No not shipped | No not shipped | The macOS major version only, such as 26. Never the full version string. |
| arch | No not shipped | No not shipped | Exactly arm64 or x86_64. |
| setup.completed | No not shipped | No not shipped | providers: an array containing only exposed provider names: claude, codex, cursor, copilot, or antigravity. |
| meter.first_live | No not shipped | No not shipped | provider: one exposed provider name. |
| provider.state | No not shipped | No not shipped | provider: one exposed provider name. state: a normalized diagnostic code, never provider-controlled text. |
| trial.state | No not shipped | No not shipped | state: exactly started, active, or expired. |
| activation.state | No not shipped | No not shipped | state: exactly none, licensed, or failed. reason appears only for failed and is exactly unknown_code, revoked, rate_limited, server_error, network_error, bad_token, or needs_newer_app. |
| update.adopted | No not shipped | No not shipped | from_version and to_version. |
| feature.adopted | No not shipped | No not shipped | feature: exactly history, activity_lines, alerts, pace_display, menu_bar_mode, or provider_accents. |
| crash.reported | No not shipped | No not shipped | signature: a normalized crash signature. |
| support.bundle_generated | No not shipped | No not shipped | No event-specific fields. |
These events never carry an email address, email hash (eh), license ID (lid),
license code, entitlement token, IP address recorded by the app, full macOS version, hostname, username,
or file path. Activation and recovery are product functions. They carry none of this analytics envelope
and continue to work when analytics are off.
04 / 05 · The floor
Never collected, by either.
Neither the app nor this website collects any of the following. This list is the same one the launch plan holds the product to, reproduced without softening.
- usage percentages
- limits
- token balances
- raw provider responses
- account identifiers
- repository paths
- terminal content
- captured pages
The one request that is not a provider refresh
The app makes exactly one request that is not a provider refresh: an unauthenticated GET to api.github.com/repos/scottdflorida/dipstick-releases/releases/latest, at most once every 24 hours. It sends
nothing but the request itself — no account, machine, usage or provider data — and reads only the latest
published tag and release-page link so the popover can offer an Update button. Nothing is downloaded or
installed automatically. Turn it off with Check for Updates Automatically in Settings.
05 / 05 · Local history
The one thing that writes readings to disk, and only if you ask.
Local usage history is off by default. When you turn on Store Usage History on This Mac, the app keeps meter readings — the meter ID, a timestamp, the percent used, the window reset time, and the non-secret session fingerprint that separates accounts — in an owner-only SQLite file.
The per-install key that derives that fingerprint is stored separately and is marked excluded from backup, so a Time Machine copy or a support export of the history file does not carry the key that partitions it.
Samples are retained for 90 days, never leave this Mac, and Settings offers plain-text export and permanent deletion. History is what sharpens the pace projection from a whole-window average to your recent burn rate, and it is what Activity Lines require.
Questions about any of this: support@dipstick.tools. Suspected vulnerabilities go to security@dipstick.tools instead — see security reporting.