Privacy

Local mode collects nothing

The command line tool, the desktop application and the web app all run on your machine, and in local mode there is no account and no service behind them. There is nothing to collect because there is nowhere for it to go.

• Connectors read files your installed tools already wrote, read only. They never rewrite, repair or migrate what they open.
• Provider credentials are held by your operating system credential store. OpenLimiter never copies one into a cache, an export, a diagnostic or a log.
• The app sends no telemetry, no usage, no diagnostics, no identifiers and no prompt content anywhere.
• No sign in is required to use any local feature. Everything you can see locally is free, and Pro sells alerts, history, phone access, extra accounts and spend tracking above the free ceiling.

The account

An account is only needed for the hosted parts: syncing your quota between your devices, and Pro. Sign in runs on Supabase, which hosts the database and the authentication for the hosted service.

• You can sign in with GitHub, with Google, or with a magic link sent to your email address. Which one you pick is your choice and you can link another later.
• The account holds your email address, the identifier the sign in provider returns, the time you created the account and the time you last signed in.
• There is no password, so there is no password to leak. GitHub and Google never hand over your password either, only a confirmation that you are you.
• Each device you sign in on gets a label, a creation time and a last seen time, so you can see the list and revoke any device from it.

What sync actually sends

Sync exists so a number you already have on one machine is visible on another. It carries the reading and nothing around it.

• One row per meter: which provider, which meter, which window, a bounded usage percentage, when the window resets, when the reading was observed, an opaque account identifier and the device that sent it.
• It never carries a prompt, a response, a file name, a file path, source code, a project name, a repository, a provider credential or a provider message.
• Your current snapshot is kept for seven days. It is replaced every time a newer reading arrives.
• Sync is on from the moment you sign in, because that is what signing in is for. You can turn it off in settings, and with it off the readings stay on the device that took them.

Pro history and forecast

Pro keeps the readings you already sync so a longer window can be drawn and a burn forecast can be calculated from it. It is the same bounded rows, kept for longer.

• A rolling ninety days while Pro is active. Day ninety one is not queryable, because it is not there.
• A gap stays a gap. Nothing is interpolated, estimated across a missing period, or invented to make a chart look continuous.
• When Pro ends, the hosted history is kept for thirty days so you can export it, and during that time it is not readable by history, forecast or alerts. At the end of day thirty it is purged.
• History held locally by the desktop application is yours and is untouched by any of this. Ending Pro never deletes it.

Alerts on the desktop, by email and by push

Every alert is part of Pro. It can tell you when a window crosses sixty, eighty or ninety percent, and when it resets. A desktop notification is drawn by the application on your own machine, email is delivered by Resend, and push by your browser or operating system push service.

• By default a message carries only the product name, the provider name, the level as sixty, eighty, ninety or reset, one generic line, and a link to the signed in product. No exact percentage, no amount, no model, no project, no budget and no forecast date.
• A detailed email is a separate opt in that you have to accept. It may add the exact percentage, the amount, the budget and the forecast date for your own data. If the fields ever change, the consent version changes and detail goes back to off until you accept it again.
• Push never has a detailed mode, whatever the email setting says. A push payload never carries usage detail, so a locked screen never shows one.
• Each channel is switched off separately. Turning one off suppresses work not yet handed to a provider, and a single message already accepted by a provider may still arrive.

API spend keys, in beta

The API spend meter reads your own billing or balance figures from the provider that owns them. It is a labelled beta and it is best effort observation, so it can be delayed, incomplete, corrected or unavailable.

• The key you give it is stored in your operating system keyring, in a namespace of its own. There is no readback: after you save it, nothing in the interface can show it to you again.
• The key is sent only to the fixed HTTPS host of the provider it belongs to. Redirects are rejected, requests and errors are redacted, and the size and duration of every call are capped.
• The key is never sent to OpenLimiter, never stored on the hosted service, and never appears in a log, an analytics property, a crash report or a support record.
• Removing a source deletes its key from the keyring immediately and offers to delete the samples it produced.

Payments and tax

Pro is sold by Lucas Costa and paid through Stripe. Card details are entered on Stripe and never reach OpenLimiter, which receives only the outcome and the identifiers it needs to keep your access in step with your subscription.

• Stripe holds your payment method, your billing address and your invoices. OpenLimiter stores the customer and subscription identifiers, the plan, the status and the period dates.
• Tax is calculated automatically at checkout, which is why a billing address is collected. The address is used for tax and invoicing and for nothing else.
• A full refund is available on request within fourteen days of any charge. A confirmed full refund ends Pro immediately and leaves your local data untouched.
• Billing and tax records are kept as long as tax law requires, which is longer than the product windows below. Account deletion pseudonymises the link between you and a record that has to stay.

This website

The website and the app are two different things with two different answers, and it would be dishonest to give them one.

• The website counts page views without cookies. It is Vercel Web Analytics, and what it produces is a count of how many people opened which page.
• No cookie is set to track you, no profile is built, and nothing follows you to another site. The only cookies here are the one that remembers the language you chose and the one that remembers you closed a banner.
• The app sends nothing. There is no analytics of any kind in the desktop application, the command line tool or the web app.
• Your browser's language header is read to offer you a translated page. The offer is a banner you can take or close, and it never moves you off the page you asked for.

Who else touches the data

Seven services are involved in the hosted parts. Each one sees only what its job needs, and each one is named here so the list can be checked rather than trusted.

Where this applies and why we may do it

OpenLimiter is sold by Lucas Costa and is offered worldwide, and it is written to the European and United Kingdom data protection rules and to the Brazilian LGPD, because those are the strictest of the markets it serves. Wherever you live, the same reasons apply.

• To perform the agreement with you: the account, sync, Pro history, routing context and billing. Without these there is no product to deliver.
• With your consent: detailed alert emails and push notifications. Both are optional, both are off until you turn them on, and both can be withdrawn without losing anything else.
• For legitimate interests: keeping the service secure, preventing abuse of the sign in and the sync endpoints, and counting page views on this website without cookies.
• To meet a legal obligation: keeping the billing and tax records that tax law requires.

The hosted services run on infrastructure that may sit outside your country. Where personal data leaves the European Economic Area or the United Kingdom, it travels under the standard contractual clauses those services publish.

How long each thing is kept

Every window below is a real limit in the system rather than an intention. Deleting your account overrides the active product windows, and three things sit outside that: anything on your own machine, which is not ours to remove, encrypted backup copies, which expire on their own schedule after the primary rows go, and the billing and tax records the law requires, which are pseudonymised rather than deleted.

Your rights, and the controls that deliver them

A right you cannot exercise is not a right, so each one below is a control in the product rather than a request you have to write.

• Export everything the hosted service holds about you, as a machine readable archive with an accessible table beside it. Provider keys are never in it, because they were never there.
• Delete your account. Your product data goes within twenty four hours, encrypted backup copies expire within thirty days, and nothing local is touched.
• See every device signed in to your account, including a phone paired by QR, and revoke any of them. A revoked device loses hosted access immediately.
• Turn email or push off separately, at any time, without affecting the other.
• Withdraw consent for detailed emails or for push. Withdrawing it stops the detail, not the account.
• Complain to your local data protection authority if you think this is being handled badly. You do not have to come to us first.

Deletion runs from the account screen, and it asks you to sign in again first because it cannot be undone. If you would rather it were done for you, write to the address below and say delete my account.

Children

OpenLimiter is a developer tool and is not directed at children. It is not knowingly offered to anyone under sixteen, and no account is created for one. If you believe a child has created an account, write to the address below and it will be removed.

Changes, and how to reach a person

This page changes when the product changes. When a change alters what is collected, where it goes, or how long it is kept, the date below moves and the change is described in the changelog rather than made quietly.

Questions, requests and complaints go to lucas@lucaswebsystems.com, and a person reads them. The rules for using the site itself are in the terms and conditions.

This policy takes effect with version 1.2.0. Last updated on 4 September 2026.