Limits Monitor (“the app”) is developed by Vadim Semenko (“we”, “us”), trading as ZeroSix Studio. This policy describes exactly what the app reads, what it sends, and to whom. Short version: there is no account, no analytics, and no server of ours anywhere in the picture.
What the app reads
Two things, and nothing else.
One Keychain item
The app reads a single item from your macOS Keychain — Claude Code-credentials — which the Claude Code CLI created when you signed in to it. Access is read-only, the item is never modified or deleted, and no other Keychain item is requested or touched. macOS asks for your permission the first time; if you decline, the app says so and shows no live numbers.
Your local Claude Code logs, only if you grant them
Cost history is computed from the logs the Claude Code CLI already writes to ~/.claude on your Mac. The app cannot read that folder on its own: you choose it in a standard macOS open panel, and macOS gives the app a read-only, security-scoped bookmark for it. Granting this is optional — live quota monitoring works without it, and you can revoke it at any time in System Settings → Privacy & Security.
What leaves your Mac
One request, to one address. The app sends the OAuth token it read from the Keychain to Anthropic’s official API — https://api.anthropic.com/api/oauth/usage— and receives your current quota figures back. That is the app’s only network destination.
Nothing else leaves the machine. Your logs, your project names, your costs and your settings are never uploaded. There is no server of ours between you and Anthropic, no account to create, no telemetry, no analytics SDK, no crash reporting service and no advertising identifier. The app contains no third-party SDK of any kind.
What you send to Anthropic is governed by Anthropic’s privacy policy — the same policy that already covers your use of Claude Code, because it is the same credential and the same account.
What is stored on your Mac
The app keeps a local database (SwiftData, inside its own App Group container) with the readings it has taken and an index of your log files, so that a second launch does not have to re-read gigabytes of logs. Your settings — layout, palette, glyph style, notification preferences — are stored in the standard macOS preferences for the app. All of it lives on your Mac and is removed when you delete the app.
The token itself is never written to disk by the app: it is read from the Keychain when a request is made, and no copy of it is kept.
Seeing it for yourself
The app has a built-in inspector — What is read? — that lists every item it read and the exact address it was read from, with that address taken from the running code rather than typed into a label. If this page and the inspector ever disagreed, the inspector would be the one telling the truth.
Sandboxing
The app is sandboxed and notarised by Apple. Its entitlements are limited to outgoing network access, read-only access to a folder you pick yourself, and its own App Group container. It cannot read the rest of your disk, and it has no ability to run code on your behalf.
Children
The app is a developer utility. It is not directed at children and collects no information from anyone, of any age.
Revoking access
Keychain access can be withdrawn in Keychain Access → Claude Code-credentials→ Access Control. Folder access can be withdrawn in System Settings → Privacy & Security → Files and Folders. Either one stops the live readings; nothing else about your Mac or your Claude Code account changes. Deleting the app removes its local database with it.
Changes to this policy
If the app ever starts collecting anything, this page changes first and the change is dated. As of today the app collects nothing, and that is a design decision, not an oversight.
Questions about any of this go to [email protected] and are answered by a person.