Privacy

CreditBar runs on your Mac. It has no accounts, no sign-in and no analytics. We do not have a copy of your API keys, your balances or your usage, because there is nowhere for them to go.

The only time the app talks to us is when you activate a licence, and that request is described in full below.

Your API keys live in the macOS Keychain, one item per account. The config file holds a reference to the item, never the secret itself. Removing an account deletes its Keychain item and its history.

Your settings and account labels sit in a plain file at ~/.config/creditbar. Usage history is a JSON Lines file in the same folder: numbers and timestamps, nothing else. You can read it, and you can delete it at any time without breaking the app.

Some rows read files another tool on your Mac already wrote, rather than calling an API. Nothing from them is transmitted anywhere.

The debug log redacts secrets before writing. If you send us one, check it first anyway.

Requests to the providers you connected, and nothing else. Each request is checked against that provider's own list of allowed hosts before the connection opens, and again on every redirect, so a key cannot be sent to a host its provider never declared. Settings lists every endpoint the app is able to call.

Those requests go to the provider under your own API key, on your own account, and are covered by that provider's privacy policy rather than ours.

If you connect an AI agent to the built-in MCP server, that agent can read your balances, spend and revenue, and may pass them to its own model provider. Nothing is shared until you set that up, and the agent never sees your keys.

Activating a licence sends three things to our licence service: your licence key, a machine identifier, and a machine name.

The machine identifier is a SHA-256 hash of your Mac's hardware UUID with a fixed salt, truncated. It lets a licence be tied to a machine without us holding the hardware UUID itself.

The machine name is whatever your Mac is called in Sharing settings. On many Macs that is a personal name, such as "Priya's MacBook Pro", so it is worth knowing that it is sent. It is used so you can tell your own devices apart. Rename your Mac before activating if you would rather it were not.

Our licence service stores none of this. It checks the key against our payment provider and returns a signed entitlement to your Mac. There is no database behind it.

Payments are processed by Dodo Payments, who act as merchant of record. They collect what a payment requires, including your email address and billing details, under their own privacy policy. We never see or store your card details.

We use the email you gave them only to send your licence key and anything that goes wrong with it.

Static pages with no analytics, no tracking pixels and no cookies set by us. Our hosting provider keeps ordinary server logs, including IP addresses, for security and reliability.

Delete ~/.config/creditbar to remove your settings and history. Remove the Keychain items, or the accounts inside the app, to remove your keys. Uninstalling leaves nothing on any server of ours.

For anything to do with your purchase or licence, or to ask what we hold, write to privacy@creditbar.app.

If this page changes in substance, the date below changes with it. Material changes will be noted in the app's release notes rather than made quietly.