1. Who We Are

Tokeven, LLC is a limited liability company organized under the laws of the State of Delaware. This Privacy Policy describes how Tokeven, LLC ("Tokeven," "we," "us," or "our") collects, uses, and protects information when you use the Tokeven platform, website, APIs, SDK wrappers, and related services (collectively, "the Service").

2. Information We Collect

Tokeven is built around a core principle: your instrumented AI traffic is metrics-only - we never see its prompts or completions, and we never touch your AI provider API keys. The opt-in tools that operate on text you explicitly submit are described in Section 2.4. Here is what we collect:

2.1 Account Information

When you create an account, we collect your email address and a bcrypt-hashed password. If you sign in with Google, GitHub, or Microsoft, we receive your email address from that provider (and, where the provider supplies it, your display name) together with the provider's account identifier for you; we never receive your password for that provider. We store your organization name, team role, and plan tier. If you subscribe to a paid plan, Stripe collects your payment details and we store only the Stripe customer identifier that links your organization to it. If an admin declares which AI subscription plans your organization pays for (Settings › AI Plans), we store the plan, monthly price and seat count they enter, and use them only to show the plan-versus-API-price comparison on your dashboard.

So you can see and sign out your active sessions (Settings › Profile), each sign-in records your browser's user-agent string and a coarse network prefix (the first three parts of an IPv4 address, or the first half of an IPv6 address) - never your full IP address. These records are deleted 30 days after the session expires. When you run tokeven init, the approval page shows the coarse network prefix (IPv4 /24, IPv6 /48) the request came from, so you can tell whether it is yours; that request record is deleted a day after it expires.

2.2 Usage Metadata

The Tokeven SDK wrapper and sidecar proxy run in your environment and send us usage metadata only. Every field our ingest endpoint accepts is listed below; it is declared with “forbid extra fields”, so a client that tries to send anything not on this list is rejected rather than quietly accepted. One further field, the actor label, is off by default and sent only if you turn it on - see Section 2.6.

·Event ID: a random identifier your client generates so a retry is not counted twice
·Timestamp: when the call happened
·Model ID: which model you called
·Provider name: Claude, ChatGPT, Gemini or Grok
·Modality: text, code, vision or audio
·Input token count: how many tokens went in
·Output token count: how many tokens came back
·Cache-read token count: tokens served from the provider's prompt cache
·Cache-write token count: tokens written to the provider's prompt cache
·One-hour cache-write token count: the part of the cache-write count written with a one-hour lifetime, which the provider bills at a higher rate
·Prompt length: a character count computed on your machine - never the text itself
·Request latency: how long the call took
·Batch flag: whether the call used the provider's discounted batch tier, so we price it correctly (only when the call has one)
·Speed tier: which processing speed your provider served (e.g. standard, flex, fast, ultrafast), so faster-and-pricier calls are priced correctly (only when the call has one)
·Original speed tier: when you accept a suggestion to drop to a slower, cheaper speed tier, the tier you would otherwise have used, so the saving is priced exactly (only when the call has one)
·Moved to batch: when you accept a suggestion to send calls through a provider's batch API instead, a yes/no flag so the saving is priced exactly (only when the call has one)
·Web searches: how many web searches your provider ran for the call (a count only, never the query or results), so its per-search fee is priced (only when the call has one)
·File searches: how many hosted file searches your provider ran for the call (a count only, never the query or results), so its per-call fee is priced (only when the call has one)
·Audio input tokens: how many of the input tokens were audio (a count only, never the audio), so audio is priced at its own rate (only when the call has one)
·Audio output tokens: how many of the output tokens were audio (a count only, never the audio), so audio is priced at its own rate (only when the call has one)
·Cloud platform or gateway: whether the call went through AWS Bedrock, Google Vertex, Azure or a gateway such as OpenRouter rather than the provider directly (only when the call has one)
·Gateway charge: what a gateway such as OpenRouter reported charging for the call, a dollar amount only, so we can show what you actually paid (only when the call has one)
·Event kind: whether the call was billed per-token by your provider or covered by a flat-rate subscription
·Session identifier: groups calls that belong to one working session (only when the call has one)
·Project label: a name you choose to group calls by project (only when the call has one)
·Tool name: the name of a tool the model called, where your client reports one - the name only, never its arguments (only when the call has one)
·Advisor used: whether you acted on a pre-send recommendation for this call
·Advisor available: whether a recommendation existed for this call at all - the denominator that makes the figure above meaningful (only when the call has one)
·Original model ID: the model you moved away from, when you took a recommendation - this is what a savings figure is measured against (only when the call has one)
·Original output token count: an upper bound your client reports so a savings figure cannot be overstated (only when the call has one)
·Attribution miss reason: a short code from a fixed list saying why a recommendation was not credited (for example, the model was unchanged) (only when the call has one)

2.3 What We Never Collect

We never collect, transmit, or store the content of prompts or completions from your instrumented traffic - the ingest schema has no field that could carry them. We never receive, hold, or process your AI provider API keys (Anthropic, OpenAI, Google, xAI). That remains true of the provider administrator credential used by tokeven reconcile(Section 2.6): it is read and used entirely on your own machine, and no Tokeven endpoint accepts one. The credentials Tokeven stores are: your account password as a bcrypt hash; SHA-256 hashes of your write-only ingest tokens, dashboard share links, team invitations, and one-time sign-in and password-reset codes; and, if you create a webhook endpoint, that endpoint's signing secret, which we must keep in usable form to sign each delivery.

2.4 Opt-In Tools That Process Text You Submit

The following tools are the disclosed exceptions to Section 2.3. All of them sit outside your instrumented traffic, and none is active unless you use it. Do not submit secrets to any of them. (a) Prompt Revision (dashboard tool) sends text you paste to Anthropic to rewrite it, routed through Tokeven's server; it is used only to produce the revision. (b) advisor.improve() / tokeven improve (SDK/CLI) sends the prompt you are improving to Anthropic using your own API key, bypassing our servers entirely. (c) The dashboard AI assistant, available to signed-in users, sends the messages you type in a conversation, together with the assistant's earlier replies in that conversation, through Tokeven's server to Google's Gemini API to generate a response. We do not store those conversations on our servers; your conversation history is kept in your own browser. If you share a conversation, the transcript travels inside the link itself, so anyone holding the link can read it.

2.5 Contact Form, Invite Requests and Invites

If you submit our contact form, we store the name, email address, optional company and message you type, so that a human can reply. If you request an invite, we store the email address, role, optional company and the answers you give (providers used, a spend range, how you use AI, and anything you choose to tell us), plus any teardown figures your browser attaches, so that a human can review the request. If a Tokeven user invites you, we store your email address and who invited you, so that we can send you the invitation and credit them when you join. These are the only places we hold contact details for someone who has no account, and none of them is connected to instrumented traffic. Contact-form submissions, invite requests and unused invitations are deleted after 180 days; an invitation that was used is kept with the account it created, and deleted with it. You can ask us to delete yours sooner at hello@tokeven.com. These forms are our own: we do not use a third-party form or booking widget, so what you type reaches us and nobody else. See section 8 for the analytics we do run on our marketing pages.

During the beta, signed-in users may be asked the same three short questions at sign-up, after 7 days and after 30 days (an estimate of their AI spend, a 1–5 confidence rating, and a free-text answer). We store the answers with the account, alongside the spend Tokeven measured for that organization at the time, to see whether the product helped. Answering is optional, and the answers are deleted with the account.

2.6 Optional Identifiers You Choose to Send

Two things below are off by default and happen only if you turn them on. The first is a field on each usage event; the second is a separate command you run. Neither is derived from your prompts.

(a) Actor (TOKEVEN_ACTOR): a label naming who made a call, so your team can see who drives spend. You decide what it holds - a work email address, a username, or a service name like “build-agent-7”. If you set it to an email address, we store that address against each call and match it to a member of your organization. Leave it unset and your calls carry no personal identifier at all.

(b) Provider cost reports (tokeven reconcile): daily totals - provider, date, optionally model, and the amount charged - read from your AI provider's own billing report, so you can see what share of your real spend Tokeven measures. The provider administrator credential needed to read that report is used on your own machine and is never transmitted to us; Tokeven has no endpoint that accepts one. Only the daily totals are sent.

2.7 Free Teardown Tool

The teardown tool works without an account. The usage data you paste is analyzed in memory and is not stored. For each run we keep a record of: the input format and whether the analysis succeeded; row counts; the provider names and model IDs that appeared in your data; the spend and savings figures we showed you; whether you entered a company name; and, if you entered an email address, a shortened SHA-256 hash of it. The hash is pseudonymous, not anonymous: it is not the address itself, but anyone who already knows your address could compute it and match it. We use it only to count repeat runs. That record does not contain the company name or email address. Our server logs, which are kept for up to 90 days, record the company name you entered together with the same hash and the top-line figures. If you run tokeven teardown --open, the command sends the same usage numbers you would otherwise paste (model IDs and token counts, never prompt text) and we also keep the report we showed you, without any company name, for 7 days so the link it opens keeps working. After that the report is deleted and only the run record above remains.

2.8 Pods

Pods are optional, invite-only groups. Nothing is shared unless you join one. If you join, the other members of that pod see only: a display name (a random pseudonym unless you choose another), the percentage of your tracked calls that used the pre-send advisor, the number of consecutive days you used it, and whether you were active in the period shown. They never see your email address, spend, call or token counts, models, providers, the times you made calls, or any prompt content. A percentage is shown only once you have made enough calls in the period for it not to reveal how much you use AI, and a pod's combined figure is shown only once enough members are ranked that it cannot be traced to one person. A pod's creator sees exactly what every other member sees. If two pods agree to a matchup, each sees only the other's combined figure. Leaving a pod removes your figures from it straight away. Joining a pod never changes your account, your organization, or what you are billed. Pod invite links are stored only as SHA-256 hashes. We record which invite you accepted so we can credit the person who invited you; they learn that their invite was used, not who used it. They also see a count of how many of the people you go on to invite start using Tokeven, never who those people are. If your organization receives the weekly digest, your copy also lists your own standing in your pods. It is never sent to anyone else.

3. How We Use Your Information

We use collected information to: (a) provide and operate the Service, including dashboards, analytics, cost calculations, and savings tracking; (b) calculate verified savings under the gainshare pricing model; (c) send transactional emails (account verification, password resets, budget alerts, and weekly digest summaries to organization admins); (d) detect and prevent abuse, fraud, or violations of our terms; and (e) improve the Service based on aggregate, anonymized usage patterns.

4. Cost and Savings Calculations

Tokeven calculates costs server-side using token counts from your usage events and our maintained model pricing registry. Savings are computed as the difference between actual cost and the recommended alternative cost for events where you accepted a recommendation. These calculations use metadata only and do not require or involve prompt content.

5. Data Storage and Security

Your data is stored in PostgreSQL on AWS RDS with encryption at rest (AES-256) and in transit (TLS). Passwords are hashed with bcrypt (cost factor 12). Ingest tokens are stored as SHA-256 hashes with a 16-character prefix for identification. JWT access tokens expire after 15 minutes; refresh tokens expire after 7 days. Authorization headers and ingest token values are scrubbed from all server logs.

6. Data Sharing

We do not sell, rent, or trade your information. We share data only with the service providers listed below, each for the purpose stated, and with law enforcement or regulatory bodies when required by applicable law, subpoena, or court order. We will notify you of such requests unless legally prohibited from doing so. If you join a pod, its members see the limited figures described in Section 2.8. You choose to share those, and we do not share them with anyone else.

·Amazon Web Services: hosts and operates the Service, including its databases, logs, and content delivery.
·Stripe: processes payments and billing for paid plans.
·Resend: delivers our emails, so it receives your email address and the content of the emails we send you.
·Google Analytics: measures traffic on our public marketing pages (Section 8).
·Google (Gemini API): generates responses for the dashboard AI assistant from the messages you send it (Section 2.4(c)).
·Anthropic: rewrites text you submit to Prompt Revision (Section 2.4(a)), and produces the Weekly Analysis for paid organizations from aggregated per-model usage figures - token counts, call counts, and cost, never prompt content.
·Google, GitHub, and Microsoft: authenticate you when you choose to sign in with one of them (Section 2.1).
·Sentry: receives error reports from our backend so we can fix faults: the failing request's route and a stack trace. We strip request bodies, cookies, credentials and IP addresses before anything is sent.

7. Data Retention

Individual usage events, and the daily summaries derived from them, are deleted 365 days after the call they describe, whether or not your account is still open. Contact-form submissions, invite requests and unused invitations are deleted after 180 days (Section 2.5). Server logs are kept for up to 90 days.

When your organization is deleted, access ends immediately. Within 30 days we delete its usage events, summaries, provider cost reports, ingest tokens, and user accounts, and remove the organization's name and billing identifiers from our records. We keep the billing records we need for accounting, tax, and dispute purposes - your savings history and the per-call evidence behind each gainshare invoice - and we may keep aggregated, de-identified statistics that cannot be linked back to you or your organization. Teardown run records (Section 2.7) are not linked to an account.

8. Cookies and Local Storage

The Tokeven dashboard uses a session cookie containing your JWT access token for route protection, set on login and cleared on logout. Your refresh token is a separate httpOnly cookie scoped to the auth route, which browser scripts cannot read; it is cleared when you sign out. We use browser localStorage to persist your short-lived access token and user profile for the duration of your session.

Our public marketing pages also load Google Analytics 4, which sets its own cookies to measure which pages and campaigns bring people to the site. We use it for aggregate traffic reporting only. It is not loaded in the dashboard, account settings, or sign-in pages, or on the embeddable widgets served under /embed, because those render inside our customers' own pages and it is not our place to measure their visitors. Before a page address is reported to Google Analytics we remove its query string and fragment, keeping only campaign (utm_) parameters. Google Analytics never sees your instrumented AI traffic, which stays metrics-only. We do not use advertising pixels, run ad retargeting, or sell or share any data with advertisers.

Google Analytics does not act on the browser Do Not Track signal. If you would rather not be counted, block it with a tracker blocker or Google's Analytics opt-out browser add-on; the site works normally either way.

9. Your Rights

You may: (a) export your usage data from the dashboard export feature (CSV or JSON) if your organization is on a paid plan, or, on any plan, request a copy of your data by emailing hello@tokeven.com; (b) revoke ingest tokens at any time to stop data collection; (c) have your organization deleted - account admins can delete it from Settings, and any user can request deletion by emailing hello@tokeven.com - after which its data is deleted as described in Section 7; and (d) request a copy of the personal data we hold about you by emailing hello@tokeven.com. We respond to emailed requests within 30 days.

10. Children

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 16, we will delete it promptly.

11. International Transfers

The Service is hosted in the United States (AWS us-east-2). If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Service. Continued use after changes constitutes acceptance of the updated policy.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict of law principles. Tokeven, LLC is organized under the laws of the State of Delaware.