1. Who We Are

Tokeven, LLC is a limited liability company organized under the laws of the State of Delaware. This Privacy Policy describes how Tokeven, LLC ("Tokeven," "we," "us," or "our") collects, uses, and protects information when you use the Tokeven platform, website, APIs, SDK wrappers, and related services (collectively, "the Service").

2. Information We Collect

Tokeven is built around a core principle: your instrumented AI traffic is metrics-only - we never see its prompts or completions, and we never touch your AI provider API keys. Two narrowly scoped opt-in tools that operate on prompt text you explicitly submit are described in Section 2.4. Here is exactly what we collect:

2.1 Account Information

When you create an account, we collect your email address and a bcrypt-hashed password. If you sign in via Google OAuth, we receive your email and display name from Google. We store your organization name, team role, and plan tier.

2.2 Usage Metadata

The Tokeven SDK wrapper and sidecar proxy run in your environment and send us usage metadata only. Every field our ingest endpoint accepts is listed below; it is declared with “forbid extra fields”, so a client that tries to send anything not on this list is rejected rather than quietly accepted. One further field, the actor label, is off by default and sent only if you turn it on - see Section 2.6.

·Event ID: a random identifier your client generates so a retry is not counted twice
·Timestamp: when the call happened
·Model ID: which model you called
·Provider name: Claude, ChatGPT, Gemini or Grok
·Modality: text, code, vision or audio
·Input token count: how many tokens went in
·Output token count: how many tokens came back
·Cache-read token count: tokens served from the provider's prompt cache
·Cache-write token count: tokens written to the provider's prompt cache
·Prompt length: a character count computed on your machine - never the text itself
·Request latency: how long the call took
·Batch flag: whether the call used the provider's discounted batch tier, so we price it correctly (only when the call has one)
·Event kind: whether the call was billed per-token by your provider or covered by a flat-rate subscription
·Session identifier: groups calls that belong to one working session (only when the call has one)
·Project label: a name you choose to group calls by project (only when the call has one)
·Tool name: the name of a tool the model called, where your client reports one - the name only, never its arguments (only when the call has one)
·Advisor used: whether you acted on a pre-send recommendation for this call
·Advisor available: whether a recommendation existed for this call at all - the denominator that makes the figure above meaningful (only when the call has one)
·Original model ID: the model you moved away from, when you took a recommendation - this is what a savings figure is measured against (only when the call has one)
·Original output token count: an upper bound your client reports so a savings figure cannot be overstated (only when the call has one)
·Attribution miss reason: a short code from a fixed list saying why a recommendation was not credited (for example, the model was unchanged) (only when the call has one)

2.3 What We Never Collect

We never collect, transmit, or store the content of prompts or completions from your instrumented traffic - the ingest schema has no field that could carry them. We never receive, hold, or process your AI provider API keys (Anthropic, OpenAI, Google, xAI). That remains true of the provider administrator credential used by tokeven reconcile(Section 2.6): it is read and used entirely on your own machine, and no Tokeven endpoint accepts one. The only credentials Tokeven stores are your account password hash and SHA-256 hashes of your write-only ingest tokens.

2.4 Opt-In Prompt-Text Tools

Two opt-in tools are the disclosed exceptions to Section 2.3, and both sit outside your instrumented traffic - neither is active unless you invoke it. (a) Prompt Revision (dashboard tool) sends text you paste to Anthropic to rewrite it, routed through Tokeven's server; it is used only to produce the revision - do not paste secrets. (b) advisor.improve() / tokeven improve (SDK/CLI) sends the prompt you are improving to Anthropic using your own API key, bypassing our servers entirely.

2.5 Contact Form

If you submit our contact form, we store the name, email address, optional company and message you type, so that a human can reply. This is the only place we hold contact details for someone who has no account, and it is unconnected to your instrumented traffic. We delete these submissions after 180 days, whether or not they were answered, and you can ask us to delete yours sooner at hello@tokeven.com. The form is our own: we do not use a third-party form or booking widget, so what you type reaches us and nobody else. See section 8 for the analytics we do run on our marketing pages.

2.6 Optional Identifiers You Choose to Send

Two things below are off by default and happen only if you turn them on. The first is a field on each usage event; the second is a separate command you run. Neither is derived from your prompts.

(a) Actor (TOKEVEN_ACTOR): a label naming who made a call, so your team can see who drives spend. You decide what it holds - a work email address, a username, or a service name like “build-agent-7”. If you set it to an email address, we store that address against each call and match it to a member of your organization. Leave it unset and your calls carry no personal identifier at all.

(b) Provider cost reports (tokeven reconcile): daily totals - provider, date, optionally model, and the amount charged - read from your AI provider's own billing report, so you can see what share of your real spend Tokeven measures. The provider administrator credential needed to read that report is used on your own machine and is never transmitted to us; Tokeven has no endpoint that accepts one. Only the daily totals are sent.

3. How We Use Your Information

We use collected information to: (a) provide and operate the Service, including dashboards, analytics, cost calculations, and savings tracking; (b) calculate verified savings under the gainshare pricing model; (c) send transactional emails (account verification, password resets, weekly digest summaries); (d) detect and prevent abuse, fraud, or violations of our terms; and (e) improve the Service based on aggregate, anonymized usage patterns.

4. Cost and Savings Calculations

Tokeven calculates costs server-side using token counts from your usage events and our maintained model pricing registry. Savings are computed as the difference between actual cost and the recommended alternative cost for events where you accepted a recommendation. These calculations use metadata only and do not require or involve prompt content.

5. Data Storage and Security

Your data is stored in PostgreSQL on AWS RDS with encryption at rest (AES-256) and in transit (TLS). Passwords are hashed with bcrypt (cost factor 12). Ingest tokens are stored as SHA-256 hashes with a 16-character prefix for identification. JWT access tokens expire after 15 minutes; refresh tokens expire after 7 days. Authorization headers and ingest token values are scrubbed from all server logs.

6. Data Sharing

We do not sell, rent, or trade your information. We share data only with: (a) infrastructure providers (AWS) that host and operate the Service under standard data processing agreements; (b) payment processors (Stripe) to handle billing; and (c) law enforcement or regulatory bodies when required by applicable law, subpoena, or court order. We will notify you of such requests unless legally prohibited from doing so.

7. Data Retention

Usage metadata is retained for the duration of your account. When you delete your account, all associated data (usage events, analytics, savings records, ingest tokens, and team memberships) is permanently deleted within 30 days. Anonymized, aggregate statistics may be retained indefinitely for Service improvement.

8. Cookies and Local Storage

The Tokeven dashboard uses a session cookie containing your JWT access token for route protection, set on login and cleared on logout. Your refresh token is a separate httpOnly cookie scoped to the auth route, which browser scripts cannot read; it is cleared when you sign out. We use browser localStorage to persist your short-lived access token and user profile for the duration of your session.

Our public marketing pages also load Google Analytics 4, which sets its own cookies to measure which pages and campaigns bring people to the site. We use it for aggregate traffic reporting only. It is not loaded on the embeddable widgets served under /embed, because those render inside our customers' own pages and it is not our place to measure their visitors. It never runs against your instrumented AI traffic, which stays metrics-only and never passes through a third party. We do not use advertising pixels, run ad retargeting, or sell or share any data with advertisers. If you would rather not be counted, Tokeven works normally with a tracker blocker or Do Not Track enabled.

9. Your Rights

You may: (a) export your data at any time via the dashboard export feature (CSV or JSON); (b) revoke ingest tokens at any time to stop data collection; (c) delete your account and all associated data through the account settings page; and (d) request a copy of the personal data we hold about you by emailing hello@tokeven.com. We will respond within 30 days.

10. Children

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 16, we will delete it promptly.

11. International Transfers

The Service is hosted in the United States (AWS us-east-2). If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Service. Continued use after changes constitutes acceptance of the updated policy.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict of law principles. Tokeven, LLC is organized under the laws of the State of Delaware.