Privacy
policy
Updated October 14, 2026 · Optional usage analytics consent added. The Korean text governs.
Your Claude Code and Codex log files never leave your computer. To see your card and join the ranking you sign in, and then the totals the ranking needs and your account details are stored on the server.
When you are not signed in
- Log files are read only by your browser or by the collector on your computer. The results stay only in this browser (IndexedDB, localStorage).
- On Windows the collector also reads Claude Code logs that have since been deleted, from the previous versions Windows keeps (restore points). It only reads them, never changes or moves them, and opens no other files.
- You can see the ranking, but your card and collecting need you to sign in.
- This browser contacts the site's server to get the site's files, the ranking, the exchange rate and the Codex reset record. It sends no logs or results. The server gets the exchange rate from Naver. Turning on reset alerts sends an alert address; sending a guest inquiry also stores the inquiry and browser identifier (see the relevant sections below).
- Fonts come from jsDelivr and Google Fonts, which then see your browser's connection details (such as its IP address).
What is stored when you sign in
| Sign-in account number | The account number GitHub or Google gives, which of them you signed in with, and when the account was made. |
|---|---|
| The email address of the account you signed in with, received and stored at sign-in: GitHub's verified primary address, or a verified Google address. If none comes, you enter it at sign-up. It is never shown, and used only to confirm the account's owner or to contact you about the account. | |
| Name, date of birth, gender | Entered with your consent under "Sign-up details" after your first sign-in. Without consent you cannot join the ranking, but making cards and viewing the ranking still work. Your name and date of birth are never shown. The name is used only to confirm the account's owner; the age band worked out from your date of birth, and your gender, are used only to decide which age and gender rankings your nickname appears in (since your nickname appears on those rankings, others can tell your age band and gender). You can change them any time under "Edit sign-up details". People under 14 cannot sign up: if the date of birth entered is under 14, it is confirmed once more and then the account and its records are deleted. |
| ID | A unique public ID chosen at sign-up. Shown with your nickname on rankings and used to add friends. You can change it in sign-up details; it is deleted with your account. |
| Nickname | Your public name on the ranking. We initially use your Google profile name or GitHub username. If it cannot be used or is already taken, we generate a nickname instead. You can change it on the sign-up screen or in your profile settings. |
| Bio and website | An optional short bio and website URL. These are public in your ranking profile. Clear them in profile settings at any time; retained until you remove them or delete the account. |
| Profile photo address | The address of your GitHub or Google account photo, refreshed at each sign-in. You can turn it off with "Show profile photo" under "Settings" next to your name. |
| Country and region | Until you pick them, filled in from where you connect from (the country and province Cloudflare reports). You can change them or clear them with "Not set" under "Settings" next to your name. |
| Age band | Worked out from your date of birth, and updated by itself after your birthday. |
| School | Stored only if you enter it. |
| Usage totals | Token counts per device, by month and model (the last 36 months). The days of each month you used them and the ChatGPT plan name written in the Codex logs are sent too, used only to draw your card on a phone exactly as on the computer, never for the ranking or for anyone else. No conversation content, file names or project names are sent. |
| Device details | A value telling devices apart, a device name such as "Windows PC", and when it last sent. The value is a one-way hash of the computer name, user name and home folder when collected by the terminal command, or a random value this browser made when collected from a folder. |
| Session hashes | Session IDs turned into values that cannot be turned back (up to 64 per service), so one computer's records are never counted twice. They are not the session IDs themselves. |
| Friends | Friends added by ID or existing invite links. |
| Sign-in key | A random value made for each account, to check that a sign-in cookie belongs to it. |
| Collector key | A random value for each account that goes into its collect command, used only to tell that a result came from your own command. |
| Results passing through | While the page where you pressed "Run now" or "Start" waits, the result of the collector that button ran (token totals, model names, dates, the plan name, hashes telling computers and sessions apart) passes through the server to that page. The collector first asks only whether a page is waiting, and sends the result only if one is. It is deleted as soon as the page has it; one never picked up is deleted at the next visit after 10 minutes. Running a pasted command does not go through the server. |
Codex reset alerts
| What is stored | When you turn alerts on on the Resets page, the server stores the alert address your browser's push service made for this browser (the push subscription address) and when it was stored. It works without signing in and is not tied to any account. No name or email is taken. |
|---|---|
| What it is for | Only for sending an alert when the next reset is found. An alert carries nothing: the browser that receives it reads the latest reset from this site itself and shows it. |
| When it is deleted | At once when you press "Stop alerts"; if the server cannot be reached then, at the next alert. If you block alerts in the browser or clear the site's data so the address is gone, the push service says so at the next alert, and it is deleted then. |
| What is read from X | To gather reset news, the server reads the public posts of OpenAI's Codex lead @thsottiaux through the X API. Only the number, time and text of posts announcing resets are stored and shown on the Resets page. Nothing about visitors is sent to X. Pressing "View on X" takes you to X, whose policy applies from there. |
What is public
The ranking can be seen without signing in. It shows your nickname, ID, profile photo (unless hidden), the amount at API list prices (Claude and Codex apart) and your token count.
Pressing a name on the ranking also shows that person's amount by month (the last 12) and by model. If you turn off "Show monthly and per-model detail" in your account settings or in that window, others see only what the ranking shows.
If your country, region, age band, gender or school is set, your nickname appears on the ranking split by it. These are not written next to your name, but anyone who opens those rankings can tell which country, region, age band, gender or school you belong to. Your name, date of birth and email never appear anywhere. Country and region are set from where you connect even if you never enter them, so clear them with "Not set" if you do not want that.
School names, how many take part from each school, and their total amounts are public too. A friends' ranking is seen only by the signed-in person and their friends.
Your exported ranking image includes your nickname, rank, tier and usage, without other participants’ nicknames.
What it is used for
- Used for account management, creating and viewing cards across devices, calculating and displaying rankings, friend features and duplicate detection. Email and name are used only to confirm account ownership or contact you about your account. Inquiry data is used to handle inquiries and prevent spam. With separate consent, usage data may also be used for the analytics and service improvements described below. We do not use it for advertising or marketing, sell personal data, or provide it to outside businesses for their independent use.
- The server works out the amounts again from the public price lists. The plans and exchange rate you change on this page are not stored.
- Reset alert addresses are used only to send reset alerts.
Usage analytics and service improvement
Only with optional consent in sign-up or profile settings, the operator may use previously uploaded usage data for the purposes below. This consent does not collect additional logs or browsing history.
| Data used | Uploaded monthly token totals by service and model, and their equivalents at public API prices. Your account number is used to check consent, but analysis data excludes names, email addresses, public IDs, nicknames, photos, dates of birth, gender, location, school, friends, inquiries, device identifiers and subscription plans. Conversation contents and raw logs are not collected. |
|---|---|
| Purposes | Analyze service and model usage shares and monthly trends, improve cost and token calculation accuracy, and improve card and ranking features. This does not include identifying or reidentifying people, personalized advertising or sharing analysis data externally. |
| Retention and use | From consent until withdrawal, deletion of the relevant usage records or account deletion, whichever comes first. No separate per-person analytics copies are retained. After withdrawal, original records for cards and rankings remain under the existing retention rules; use 'Leave the ranking' or 'Delete account' to remove them. |
| Declining and withdrawing | Declining does not restrict sign-up, cards, rankings, friends or inquiries. In your profile, open 'ID · Sign-up details', uncheck the optional consent and save to withdraw immediately. Existing members are not automatically opted in, and a policy update does not expand an earlier consent. |
| Consent record | The current choice, consent time and notice version (2026-10-14) are stored with your account. Withdrawal clears the time and version and sets the choice to declined. Account deletion also deletes this setting. |
Ranking record review
To prevent ranking manipulation, we compare uploaded monthly totals and submission times and store review flags and evidence of large volumes or rapid growth. Administrators review them; flags alone do not establish manipulation or automatically exclude anyone. Review records are deleted with the account. Raw logs and conversations are not collected.
Keeping and deleting
- Kept until you delete your account. Contact inquiries store your account ID, subject, message, reply, status and creation/update times. Only the author and designated administrator can read them, solely to handle the inquiry. Deleting your account also deletes inquiries and replies. We separately store the sign-in provider’s verified email to check administrator access.
- Guest inquiries require an email for handling the inquiry and contacting you if needed; the consent time is also stored. Declining prevents guest inquiry submission. The email and consent record are retained until inquiry deletion is requested and are accessible only to the author and designated administrator. The entered email is not verified and grants no sign-in or inquiry access. Inquiry type is also stored with the inquiry. Guest inquiries use a random browser cookie (one year from the last visit) to access inquiries and replies. We store a hash of that cookie, plus a secret-keyed hash of the connection IP address to prevent spam; the raw IP is not stored with inquiries. Guest inquiries are retained until deletion is requested at contact@tokenwhale.dev. Clearing or losing the cookie removes access. Signing in does not convert guest inquiries into account inquiries.
- Leave the ranking deletes your usage totals, device details, session hashes and scores at once.
- Account management → Delete account at the bottom of your profile settings deletes all of the above, your friends and the account at once. For an account the operator hid from the ranking, only the sign-in account number and the hidden mark are kept, so the hiding continues if the same account comes back; its email, name, date of birth, gender, photo, country, school, records and friends are all deleted.
- Deleting removes the data from the database at once. No copies are kept elsewhere, so it cannot be brought back.
- The sign-in cookie lasts 30 days. Signing out removes it from this browser.
- A reset alert address is deleted at once when you press "Stop alerts"; if the server cannot be reached then, at the next alert. If the browser drops the address, it is deleted at the next alert too.
Your rights
- You can see and change your details any time: nickname, photo, country and school under "Settings" next to your name; email, name, date of birth and gender under "Edit sign-up details".
- To stop the processing, press "Leave the ranking"; to delete everything, "Delete account". Both take effect at once.
- For anything you cannot do yourself, ask through the contact below. It will be handled promptly and you will be told the result.
Contact
The person responsible for personal data is the site's operator. For questions, or to ask to see, correct or delete your data, write to contact@tokenwhale.dev.
Inquiry security check
We use Cloudflare Turnstile to prevent automated inquiries. When enabled, Cloudflare processes connection IP and browser signals, and our server validates a one-time token. We do not store the token or send your inquiry or sign-up details to the verification service.