[legal]
Privacy Policy
Effective
This Privacy Policy explains what personal data Burnstate handles, where it goes and what you can do about it. It applies to the Burnstate app for Mac and its widgets, the website burnstate.dev and the burn report pages on it (together, the “Services”).
Burnstate comes in three editions: the direct edition from burnstate.dev, the Setapp edition and the Mac App Store edition. Two people operate them:
- The Setapp edition, the website and the waitlist: Yozhef Serhiiovych Hisem, an individual based in Chop, Zakarpattia Oblast, Ukraine.
- The direct edition and the Mac App Store edition: Serhii Khvala, an individual based in Chortkiv, Ternopil Oblast, Ukraine.
In this policy, “Burnstate”, “we” and “us” mean the operator of the edition you use, or of the website when you use the website. That operator is the controller of the personal data described here. You can reach either of us at support@burnstate.dev.
Setapp, operated by MacPaw Way Ltd., handles your Setapp account, subscription and payments under the Setapp Privacy Notice. Apple handles your Mac App Store purchase under the Apple Privacy Policy. Creem’s merchant of record, Armitage Labs OÜ, sells the direct edition’s license under the Creem Privacy Notice. None of them is covered by this policy. Please read this policy together with our Terms of Use.
- Burnstate works out your numbers on your Mac and asks each provider you connect directly, with the sign-in you already have there or one you make in Burnstate.
- Your sign-ins, prompts, code and session transcripts never leave your Mac, except as a request to the provider a sign-in belongs to, or inside an AI insight you ask for.
- We, the people behind Burnstate, don’t receive your usage, sign-ins or logs. The only personal data we get is what you send us by email and, if you buy a direct license, your order, email address and license key from Creem.
| [data] | [what it includes] | [what burnstate does] |
|---|---|---|
Your tools’ sign-ins | For providers you connect: Claude Code’s login from the macOS Keychain or ~/.claude/.credentials.json, the Codex CLI’s ChatGPT login in auth.json in ~/.codex or $CODEX_HOME, the Cursor app’s login from its local database, and the Vercel CLI’s token and current team. If Claude Code has no working login, also your claude.ai session cookie, from the Claude app or a browser | Reads them to ask each provider for your usage. Never copies them elsewhere, and never rewrites or renews them. Reading a browser’s cookies can show a macOS Keychain prompt. Burnstate lets that prompt appear only when you connect, sign in or refresh, never in the background |
Sign-ins you make in Burnstate | The ChatGPT and Cursor logins you sign in to through Burnstate, and the AI Gateway API key you paste | Keeps them in its own items in the macOS Keychain and sends each only to its provider. Renews the ChatGPT and Cursor logins, and deletes a provider’s login when you disconnect it. When you have both, uses them instead of your tools’ sign-ins |
Session logs | The transcripts and running-session files Claude Code and Codex keep in ~/.claude and ~/.codex, which include your prompts, code and the models’ replies | Reads them to count tokens, estimate cost, and list your sessions with their prompts and status. Moves a transcript to the Trash only when you delete that session |
Permission prompts and questions | The session ID, working folder, tool name and the tool’s full input: a shell command, a file path with the text of an edit, a URL, an MCP tool’s arguments or Claude Code’s questions | Receives them from the hook over a local connection and holds them in memory while the card is open. Never writes them to disk or sends them anywhere |
Coding tools | Which versions of Claude Code and Codex you have, how they were installed, and your login shell’s PATH | Uses them to find the tools, offer updates and run the updater when you ask, and to run Claude Code when you sign in to Claude or its login needs renewing |
Usage history and settings | The last usage numbers, a year of Setapp AI credit spend, your preferences, archived sessions, your burn report handle and the hook’s token. In the direct edition, also your license key, its activation ID and your Mac’s name | Keeps them in the app’s own storage on your Mac, shared with its widgets |
Removing Burnstate and its data from your Mac removes all of this except the sign-ins you made in Burnstate, which macOS keeps in the Keychain. Disconnect each provider first, or search Keychain Access for dev.burnstate.login and delete the items it finds. We have no copy.
The direct and Setapp editions run outside the macOS App Sandbox so they can read these files, and they read only the locations listed here.
The Mac App Store edition runs inside the App Sandbox. It reads these files only after you allow access to your home folder in the standard macOS open panel, and it keeps that permission in its own storage. It reads Claude Code’s login only from the macOS Keychain or ~/.claude/.credentials.json, never a claude.ai cookie, and it doesn’t look up, update or run your coding tools.
Burnstate talks to these destinations, and to no others. Each request to a provider goes straight from your Mac, never through us. Usage is checked about every five minutes, and tool versions every six hours.
| [destination] | [what is sent] | [why] |
|---|---|---|
Claude Code’s sign-in token, to api.anthropic.com. If that login is missing, expired or rate limited, your claude.ai session cookie, to claude.ai | To read your Claude Code session, weekly and per-model limits. In the direct edition, also the AI insights you ask for, sent by Claude Code when it answers them | |
Your ChatGPT sign-in token and account ID, to chatgpt.com. When you sign in through Burnstate, the requests that finish your sign-in, and later Burnstate’s refresh token, to auth.openai.com | To read your Codex session and weekly limits, and to sign in and renew Burnstate’s own ChatGPT login | |
Your Cursor sign-in token, to cursor.com. When you sign in through Burnstate, the requests that finish your sign-in, and later Burnstate’s refresh token, to api2.cursor.sh | To read your included usage and, when you build a burn report, your usage events for up to the past year. To sign in and renew Burnstate’s own Cursor login | |
The Vercel CLI’s token and current team, or the AI Gateway API key you pasted, to ai-gateway.vercel.sh | To read your AI Gateway credit balance, and to check a new key once before Burnstate saves it | |
A request for Claude Code’s changelog and Codex’s releases | Only when you ask what’s new in your tools | |
The name of a tool’s package, such as Claude Code or Codex | To tell you when a new version is out | |
Your package manager | Whatever npm, pnpm, bun, Homebrew or the tool’s own updater sends to its servers | Only when you check a Homebrew install or tap update |
A request for your AI credit balance, the questions you ask for AI insights, that you opened the panel, and app usage data collected by the Setapp Framework | Credits, AI insights, licensing and Setapp’s own analytics | |
Burnstate (burnstate.dev) | In the direct edition: your license key and your Mac’s computer name, to burnstate.dev | To activate your license, to check once a day that it’s still valid, to open Creem’s customer portal for a subscription, and to deactivate it. burnstate.dev passes the request to Creem. For a one-time license it stores nothing. For a subscription it keeps a SHA-256 fingerprint of the key with Creem’s IDs for the license, the subscription, the customer and the product, so it can ask Creem whether the subscription is paid |
The same license key and Mac name, passed on by burnstate.dev. Your Mac doesn’t contact Creem itself | To check the key. Creem keeps the activation record, with the key, your Mac’s name and the time, with your order |
To sign in to Codex or Cursor, Burnstate opens the provider’s sign-in page in your browser, and what you enter there goes to that provider. When Burnstate runs Claude Code to sign in or renew its login, Claude Code talks to Anthropic as it always does.
The direct edition talks to every destination above except Setapp, and to burnstate.dev for its license check. That is the only Burnstate server it talks to.
The Mac App Store edition talks only to api.anthropic.com, OpenAI, Anysphere and Vercel, as listed above. It never contacts claude.ai, GitHub, the npm registry, a package manager or Setapp. Apple handles its downloads, purchase and updates. If you agreed in macOS to share analytics with app developers, Apple gives that edition’s operator crash reports and usage statistics that don’t identify you, under the Apple Privacy Policy.
Like any web request, these reveal your IP address to the host. The providers already hold this data as part of your account and handle it under their own privacy policies. Setapp says the data its framework collects isn’t used for tracking.
A burn report is built on your Mac. It holds up to a year of daily token, cost and request counts per provider, the models you used, the hours of the day you work, your plan names, the handle you chose and, in the Setapp edition, the Setapp AI credits you spent each day since Burnstate began tracking them.
Burnstate packs the report into the link after the #. Browsers never send that part to a server, so burnstate.dev never receives your report. It’s decoded in the browser of whoever opens the link. Anyone with the link can see it, and so can any app you paste it into. Report pages ask search engines not to index them.
Copying a report as an image happens on your device, too.
Burnstate can answer up to three questions with AI. Nothing is asked until you tap for an answer, or until a session ends if you turn on summaries of ended sessions in settings. Where a question goes depends on who answers it, which you pick in settings:
- Setapp AI, in the Setapp edition: the question goes from your Mac to Setapp AI, operated by MacPaw Way Ltd., which passes it to the model you pick, from Anthropic or OpenAI.
- Claude Code, in the direct edition, where it’s the default: Burnstate runs your own Claude Code on your Mac with the model you pick (Haiku, Sonnet or Opus), without tools and without saving a session. Claude Code sends the question to Anthropic with its own login, and it counts against your Claude plan or is billed to you.
- Apple Intelligence, on Macs that support it: the model on your Mac answers, and the question never leaves it.
The direct and Setapp editions offer all three insights. The Mac App Store edition answers only with Apple Intelligence, and offers how to spend less and session summaries.
| [insight] | [what the question contains] |
|---|---|
How to spend less | The providers you connected and their plans, your current limits and how much of each window has passed, 30 days of token, cost and request totals, which models you used, your busy hours, and the Setapp AI credits you spent |
What’s new in your tools | The installed and latest versions of Claude Code and Codex, with their public release notes |
Session summary | The session’s title, folder, branch, timing, model and tool counts, and a shortened excerpt of what you typed and what the agent replied, without tool output. It can include code, file paths and anything you pasted into the session |
Answers are kept in memory until you quit Burnstate. When Setapp AI answers, Setapp handles the questions under the Setapp Privacy Notice and passes them to the model provider under its terms. We don’t receive them, and we don’t control whether Setapp or the provider logs or keeps them. When Claude Code answers, Anthropic handles the questions under the Anthropic Privacy Policy and your Claude plan’s terms. Don’t ask for a summary of a session that holds secrets or other people’s personal data you aren’t allowed to share.
burnstate.dev sets no cookies, runs no analytics or ads, and serves its fonts itself.
The site is hosted on Vercel, our processor. To serve and protect it, Vercel handles standard request data: your IP address, browser, the page you asked for and the time.
The site also answers the direct edition’s license checks. It passes each one to Creem. For a one-time license it stores nothing. For a subscription it keeps the record described above in a database hosted by Supabase, our processor. That record holds no name, email address, payment detail or Mac name, and we delete it when you ask at support@burnstate.dev. Vercel keeps the request data for a short time, as with any page.
Creem’s merchant of record, Armitage Labs OÜ (registry code 16977866, Rotermanni 14, Tallinn 10111, Estonia), sells you the direct edition’s license. At checkout, Creem collects your name, email address, billing address, payment details and IP address, under the Creem Privacy Notice. It charges you, collects tax, and emails you the receipt, the invoice, your license key and a link to its customer portal.
From Creem, we receive your order, your email address and your license key. We never see your card. We use them to check your license, answer you and handle refunds.
Each time you activate the key on a Mac, Creem records the key, your Mac’s name and the time with your order. When you deactivate a Mac, Creem marks that activation as ended.
If you join the waitlist on burnstate.dev, we keep the email address you enter. We use it to confirm you joined, and then to tell you when Burnstate is available on Setapp. We don’t add it to a newsletter, share it or sell it.
The list is stored with Resend, our processor, which also sends that email. Every email from the list has an unsubscribe link, and you can ask us at support@burnstate.dev to delete your address at any time.
If you are in the EEA, the UK or Switzerland, we rely on these legal bases under the GDPR and UK GDPR for the little data we handle ourselves.
| [purpose] | [data] | [legal basis] |
|---|---|---|
Serve and secure the website | Request data handled by Vercel | Legitimate interests |
Sell and check your direct license | Your order, email address, license key and Mac’s name, and for a subscription Creem’s IDs for it | Performance of our Terms of Use |
Tell you when Burnstate is available | The email address you give us on the waitlist | Consent, which you can withdraw at any time |
Answer your emails | What you send us | Performance of our Terms of Use; legitimate interests |
Comply with the law and defend legal claims | Any data we hold, as needed | Legal obligation; legitimate interests |
On your Mac, data stays until you delete it. Website request data is kept by Vercel for a short time under its policy. Waitlist addresses are kept until you unsubscribe or ask us to delete them, and no longer than 6 months after Burnstate is available on Setapp. Your emails are kept for up to 2 years after the conversation ends. Purchase data is kept by Creem under its policy and tax law.
Requests to providers and to burnstate.dev go over HTTPS. Permission prompts travel only over a local connection on your Mac, protected by a token unique to your install. The license endpoint on burnstate.dev is Burnstate’s only server. The one thing it stores is the subscription record described above.
Vercel, Resend and some providers are in the United States and other countries outside the EEA. Where required, transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
Depending on where you live, you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong;
- delete your data;
- restrict or object to how we use it.
Most of your data never reaches us, so you control it directly: disconnect a provider in Burnstate, or remove the app and its data. Creem holds your purchase data, and you can reach it through its customer portal. For anything else, email support@burnstate.dev. We answer within 30 days, free of charge.
If you are in the EEA or UK, you can also complain to your local data protection authority. California residents have the rights described in the CCPA. We don’t sell or share personal data for advertising.
The Services are not meant for children under 13, or under 16 where local law sets that age. We do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we will delete it.
We may update this policy as Burnstate changes. Before Burnstate sends data anywhere new, we’ll update this page first. We’ll post the new version here with a new effective date.
Setapp edition, website and waitlist: Yozhef Serhiiovych Hisem (individual), Chop, Zakarpattia Oblast, Ukraine
Direct edition and Mac App Store edition: Serhii Khvala (individual), Chortkiv, Ternopil Oblast, Ukraine
Email for both: support@burnstate.dev
Something unclear?
Write to us and a person reads it and replies.