Privacy
What Threadwell is
Threadwell measures AI token usage across the tools your team uses. A small agent runs on each machine and reads those tools’ own local logs; it ships a daily rollup to your workspace in the console.
What the agent collects
Measured usage and identity only: tool, model, project / working-directory name, the account email and organisation observed in the tool, machine hostname, OS user, token counts (with a fidelity tag — exact / approximate / estimated), and, for API-key lanes, cost.
What it never collects or transmits
- No prompt or message content. Only counts and labels.
- No credentials. API keys, OAuth/refresh tokens, JWTs and private keys never leave the machine. A credentials gate scans every batch and blocks the ship, fail-closed, if any secret-shaped string is present.
Controller & processor
For data about your team, your workspace is the controller and Threadwell is the processor, acting on your instructions. Our processing terms are in the Data Processing Addendum.
Where data is stored
Data is hosted on Supabase (Postgres) in the India (ap-south-1) region and served via Vercel. We can discuss other regions for specific contracts.
Sub-processors
Supabase (database, auth), Vercel (hosting), and Razorpay (payments). Each processes only what its function requires.
Retention & your rights
Workspace admins can export all of a workspace’s data as JSON and delete a tracked person or the entire workspace at any time from the console (Admin → Data & privacy). Deletion is immediate and irreversible. Data is retained for the life of the workspace unless you delete it sooner.
Cookies
Only a session cookie for keeping you signed in. No advertising or third-party tracking cookies.
Contact
Privacy questions: privacy@tokentracker.app.