Last updated: September 21, 2026
Account information. Your username and avatar from whichever provider you sign in with, GitHub or X, obtained through that provider's OAuth flow, along with read-only access to the email address on that account. No other GitHub scope is requested and your repositories are never accessed; on X we read your profile only, and never post, follow, or read your timeline. X does not release an email address for every account, and signing in still works when it does not. The country you select at signup is stored against your account.
A second provider, if you connect one. You can attach your other account to the one you already have, from Settings, so either one signs you in. Doing so stores the same username and avatar information described above for that second provider, and where a field on your profile is still empty, we fill it in from what that provider gave us. Anything you have already set is left alone.
Usage data. When you run sync, the CLI reports token counts (input, output, and cache creation), broken down by tool and model; an internal session identifier used solely to avoid counting the same activity twice across syncs; and, when the underlying tool reports them, an approximate activity timestamp and a per-session cost figure. All of this originates from ccusage's own local report on your machine. Nothing is read from the contents of your files, your code, or your terminal history.
Sync token. Stored only as a one-way cryptographic hash. The plaintext token exists solely on your own machine and cannot be recovered from what we store.
GitHub account signals. If you sign in with GitHub, or connect GitHub to an existing account, we look up that account's creation date, public repository count, and follower count directly from GitHub's API, using the access token from that one exchange. This happens once and is never refreshed afterward, is not shown on your profile, and is not used anywhere on the site today. Nothing equivalent is collected from X.
Profile content you add. A bio, a website link, an X handle, a LinkedIn URL, and an optional product listing (name, link, description, and logo), all supplied voluntarily through Settings.
Feedback submissions. The message itself; an optional reply email address; the page you submitted from; your browser's user agent string and window dimensions; an optional screenshot; and, if you were signed in, a link to your account. A one-way hash of your IP address is also recorded solely to enforce a submission rate limit — the address itself is never stored.
Cookies. A first-party session cookie that keeps you signed in, and a first-party cookie that remembers which builder referred you, for up to 30 days, so a later signup can be credited correctly. Neither is used for advertising or cross-site tracking.
To operate the leaderboards: computing rank, totals, and any active boost for the country you represent and for you individually. To render your public profile. To triage feedback and reply where you have asked to be reached. To attribute a referral to the builder who sent it. The GitHub account signals described above are collected to give a future anti-abuse system a baseline to check unusually fast-rising accounts against, rather than starting from zero; nothing reads or acts on them yet. Nothing collected here is sold, and nothing is shared with anyone outside the service providers named below, each of which processes it solely to operate TokenNations.
GitHub - authentication only, via OAuth. TokenNations receives your username, avatar, and read-only access to your email address; GitHub's own handling of that exchange is outside our control.
X - authentication only, via OAuth. TokenNations receives your username, profile image, and, where X releases it, your email address. We never post on your behalf or read your timeline. X's own handling of that exchange is outside our control.
Supabase - database, authentication, and file storage for screenshots and product logos.
Vercel - hosting, along with Vercel Analytics and Speed Insights, which report aggregate traffic and performance metrics without setting tracking cookies or identifying individual visitors.
Account and usage data are retained for as long as your account exists. A sync token's hash is discarded immediately upon regeneration or revocation. Feedback submissions are retained regardless of what later happens to the account that filed them, since a bug report should outlive the account that reported it — deleting an account clears its identifying link to any feedback you sent, but not the report itself.
You may review and edit your profile fields, country, and product listing at any time via Settings, and regenerate or revoke your sync token or sign out at any time from the same place. To request deletion of your account and associated personal information, contact us through the contact form. Token totals your account has already contributed to a country's board may be retained in de-identified form rather than deleted outright, consistent with the leaderboard's nature as a shared record rather than a personal one.
Authentication runs entirely through GitHub's or X's OAuth and Supabase Auth; TokenNations never sees or stores a password. Your sync token is stored only as a one-way cryptographic hash, so even TokenNations cannot recover the plaintext value. All traffic to and from the service is encrypted in transit. Screenshots and product logos are held in private storage, not publicly listed or directly browsable.
TokenNations is intended for developers old enough to hold a GitHub or X account in their own right and is not directed at children. We do not knowingly collect information from anyone under 13, and will delete any such information promptly if we become aware of it.
Supabase and Vercel may process data in countries other than your own. We rely on those providers' own safeguards and select providers that maintain a consistent standard of protection regardless of where processing occurs.
Updates to this policy are posted on this page, with material changes identified explicitly rather than incorporated without notice. Continued use of the service following any amendment constitutes acceptance of the revised policy.