Privacy

Last updated July 27, 2026

Usage Radar is local-first. Raw prompts, raw conversations, source code, and provider credentials remain on your device by default. We do not sell personal data, use it for advertising, or take a percentage of your AI spend.

Data classification

1. Local-only sensitive data: agent logs, raw prompts, conversations, source code, local file paths, and provider credentials.
2. End-to-end encrypted synchronized data: available only after explicit paid-plan opt-in and device-key enrollment. Normal backend and administrator access must not include decryption keys.
3. Customer-approved cloud-readable aggregates: only in cloud-intelligence mode: period, provider, model, token totals, and micro-USD cost.
4. Account and billing data: email, plan, invoices, receipts, billing address supplied to Stripe, and entitlement state.
5. Operational security logs: request IDs, coarse security signals, webhook status, and redacted errors.
6. Optional product analytics: a small allowlist of adoption events, disabled unless you consent.

Local ingestion

The local connector reads supported usage fields and serves normalized metrics on loopback. The browser can also read a folder you explicitly select through the browser file-access API. Neither path grants silent filesystem access. Prompts and source code are excluded from normalized output.

• The connector binds to 127.0.0.1, validates Host and Origin, and exposes read-only usage endpoints.
• Session identifiers are replaced with keyed pseudonyms. File paths and project names are removed from connector output.
• Fresh installs are local-only. They make no usage-sync request until you deliberately pair a device from your account.

Optional account and sync

Account creation is optional. Existing aggregate pairing is initiated only with a short-lived code from your account and can be stopped by revoking the device or deleting its local pairing file. Detailed encrypted sync is not activated until device-key enrollment and recovery are available; the product must not represent allowlisted aggregate sync as end-to-end encryption.

Privacy-max mode keeps detailed records end-to-end encrypted and requires a trusted enrolled device to compute alerts and reports. Cloud-intelligence mode additionally exposes the five aggregate field groups listed above. Consent version, timestamp, and approved fields are recorded, and you can revoke the mode.

Provider reconciliation

Provider requests are direct from your browser when the provider permits them, or local through the connector. The production relay is disabled by default, so provider keys do not enter Usage Radar servers. A future cloud reconciliation mode would require separate consent and KMS-backed secret storage.

Billing, location, and attribution

Stripe processes payment details; Usage Radar does not receive full card numbers. We may store product, price, coupon, billing country, billing region, billing city, landing page, referrer, UTM fields, and coarse country/region supplied by hosting headers at checkout. Browser GPS is never requested. Raw IP addresses are not retained as product analytics; security records use a keyed hash and configurable expiry.

Product analytics

Analytics is first-party, off by default, and limited to named adoption and conversion events. Payload validation rejects repository names, model-session content, provider keys, prompts, and dashboard values. Motion, hover, and decorative animation are not analytics events.

Retention, export, and deletion

You can select cloud retention, export account data, revoke devices, and delete the cloud account from /account/privacy. Local files remain under your control. Billing, tax, fraud, dispute, and security records may be retained when law or a legitimate security obligation requires it; those records are access-restricted and not reused for product analytics.

Contact

Privacy requests: legal@autopayradar.com. Security reports: security@autopayradar.com.