Privacy & what ships

TokenTracker is governed, never covert.

What ships

• Telemetry: numbers only — token counts, calls, tool/model/project, identity (account/machine/person), estimated cost.
• Knowledge (opt-in): redacted session transcripts, distilled trajectories, working-style, decisions.

What never ships

• Credentials. Secrets are redacted to typed placeholders ([secret:…]) on the endpoint before anything leaves the machine, and a defense-in-depth scanner blocks any raw-credential-shaped string from being sent at all.

Governance

• Content capture is org-controlled (a collection policy) — off until an org opts in.
• Redaction happens on the endpoint; the server stores only the redacted form.
• Row-level security: a viewer sees only their own raw content; broader access is an explicit, audited grant.
• Your data is yours: export and delete are available (Admin → Data & privacy); a person or a whole tenant can be removed.

Internal deployments may choose to show real names/paths (only credentials stay secret); a sold deployment runs with a processor/DPA posture.