Small data footprint.
Effective 23 August 2026
What TokenGauge processes
When you continue with ChatGPT, the login integration provides an account identifier and may provide your name, email address, and plan name. That identity can be your TokenGauge sign-in and can also power lab requests you explicitly run. Authentication credentials are encrypted at rest and kept on the TokenGauge server for up to seven days after the last activity that renews the connection. Raw tokens are never sent to the browser or exposed by TokenGauge routes or components.
Your TokenGauge account
We store your identity reference, plan entitlement, launch-offer eligibility, and optional method-tracking statuses. If you choose the separate email login, we also store your name, verified email address, password hash, sessions, and security settings. Session security records can include an IP address and browser user-agent. Passwords are hashed rather than stored. Authenticator secrets and recovery codes are encrypted by the account system. Verification and password-reset links are sent through our configured mail provider.
Provider connections
If you save an API key, TokenGauge encrypts it separately for your account using authenticated AES-256-GCM encryption. The browser receives only a four-character hint, never the stored plaintext. Keys are decrypted only for a lab request you initiate and can be removed from Settings.
Experiments
Your prompts and generated answers pass through this server to the model source you select so the A/B lab can work. They are returned to your browser and are not stored in the TokenGauge database. We retain only the provider, model, strategy label, timestamp, and aggregate input, output, and total token counts. Cache and reasoning counts can be returned for the current result but are not retained in the experiment table.
Payments
Stripe processes payments. TokenGauge sends Stripe an opaque billing identifier and, if your connected profile provides one, your email address. We retain Stripe customer, checkout, and payment identifiers needed to grant access, handle refunds, and prevent duplicate fulfilment. We do not receive full card details.
Anonymous product counters
TokenGauge keeps daily aggregate counts for selected page visits, account or pricing actions, and checkout creation or failure. These counters do not store IP addresses, browser identifiers, cookies, form contents, prompts, outputs, or account identifiers. A browser tab suppresses repeat page counts during its current session using session storage; that marker is not sent to the server. You can turn future anonymous counts off in this browser below. That preference is stored only in your browser and is checked before both page and action events.
Anonymous product counting
Turn off future aggregate page and action counts in this browser. The choice stays in local storage and is never sent to TokenGauge. It does not affect account security records, payments, or requests you deliberately run.
Service enquiries
The fixed-scope TokenGauge pages and Fablgen work desk require no account. You can use an inline form or open a public-scope template in your own mail application. Inline forms send the fields directly to the [email protected] Proton mailbox and do not save their contents in the workbench database. To limit abuse, the server temporarily processes a keyed, non-reversible representation of the connecting address in memory for up to one hour; it is not written to the database or included in the enquiry email. The mailbox keeps enquiries only as needed to assess fit, scope the work, reply, and meet legal obligations. Do not include credentials, private source, prompts, outputs, customer data, unpublished content, recovery material, payment details, or security findings in the initial enquiry.
Control and retention
Settings provides a self-service JSON export of the account data TokenGauge can associate with you. It deliberately excludes provider-key plaintext and ciphertext, authentication secrets, internal billing identifiers, prompts, outputs, and anonymous counters. The same page removes every optional provider credential, experiment record, and method status from the active workbench database in one operation. Verified-email users can also delete their whole TokenGauge login in Settings after re-entering the current password and an exact confirmation phrase. That operation deletes the login, sessions, 2FA record, ChatGPT link, provider connections, experiment totals, method statuses, and Launch 100 place from the active database; it removes name and email from TokenGauge's local billing ledger while retaining opaque payment references needed for refunds, accounting, fraud prevention, disputes, and legal obligations. ChatGPT-managed users control that identity through ChatGPT and can still erase TokenGauge workbench data here. Mode-600 local and offsite operational database backups can retain an earlier copy for up to 14 days before automatic rotation removes it. For help with a deletion or retained payment record, email [email protected]. Disconnecting ChatGPT removes the local ChatGPT session, while signing in again with the same identity restores access still attached to it.
Third parties and infrastructure
The service relies on Cloudflare for the public network edge, Stripe for payment processing, Proton for account-email delivery, an open-source Login with ChatGPT integration, and whichever model provider you explicitly connect for lab requests. Cloudflare can process connection metadata such as IP address, request time, route, and browser details under its own privacy practices. The respective third-party terms and privacy practices apply.