Privacy

Last updated: 12 October 2026 (v1.5.1).

The plugin, skill and audit

tokenleak collects nothing. It has no telemetry, no analytics and makes no network requests.

• The rules are text added to your agent's context by a local hook. They stay between you and the AI provider you already use.
• The audit (tokenleak.py) reads transcript files your agent already wrote on your machine (~/.claude/projects, ~/.codex/sessions) and your instruction files (CLAUDE.md, AGENTS.md) to measure their size. It prints a report and writes nothing, unless you ask for an HTML report with --html FILE.
• It doesn't open credential stores, keychains or config files. Transcripts can contain secrets that once appeared in tool output; the audit reads them only on your machine. The report shows commands and file paths: add --redact before sharing it.

This website

The site is hosted on GitHub Pages and sets no cookies. Your browser fetches the star count from the public GitHub API. GitHub's privacy statement covers both.

Contact

Questions: open an issue on GitHub.