CostBar privacy policy

Effective October 12, 2026.

CostBar reads the API credentials you enter and requests cost reports directly from OpenRouter, Anthropic, or OpenAI. Reports include the saved key's daily, weekly, monthly, and lifetime usage for OpenRouter, organization cost buckets for Anthropic and OpenAI, and account credit balances when an OpenRouter management key can read them. CostBar normalizes these reports to USD totals. It does not read prompts, completions, conversation content, or your other files.

Keys are stored only in the macOS Keychain. They are held in memory while an authenticated request runs and sent over HTTPS only to the selected provider. The app does not write keys to files, preferences, screenshots, logs, or analytics. Redirects are refused. Keys are not synced by CostBar.

Non-secret preferences, budgets, notification identities, and cached cost totals remain in the app's sandbox container on this Mac. Remove key in Settings deletes that provider's Keychain entry and cached totals. Removing the app does not automatically remove Keychain entries; use Remove key first. Diagnostic --smoke mode writes a local report of checks and uses a temporary credential that it deletes. --screenshots writes local images containing labelled documentation samples, not your keys.

CostBar sends nothing to the developer. There are no ads, analytics, tracking, developer servers, or third-party SDKs that collect data. Your connected provider receives your authenticated read-only requests and the network metadata needed to serve them under its own privacy policy.

Notifications are local and optional. Launch at login is optional and off by default. You can turn either off in Settings. For support, open Support in the app. It opens the hosted support page; you can also email lipmichal@gmail.com. Do not send API keys in support requests.

Sample mode uses bundled neutral documentation examples and makes no network requests. It never reads your live provider credentials. The optional supplied demo key is saved, read, updated and removed using separate Keychain items; connected demo items are removed when you exit Sample mode. Sample budgets, reports and simulated alert identities stay in memory and are discarded on exit. Send Sample notification explicitly requests macOS permission and sends a labeled local test notification; macOS controls banner visibility.