whereToken reads local coding-agent ledgers on the machine that runs it. Local analytics do not leave the machine; local-first remains the core. Community Rank, only when WHERETOKEN_COMMUNITY_URL is set and participation is on, sends anonymous daily aggregates (UUID, local date, token total, optional API-equivalent estimated cost, client version). There is no public WHERETOKEN_COMMUNITY_URL — that is a remote deploy blocker. The optional cost field is never an actual bill; a missing price is omitted, not sent as $0. Community Rank is not a global, worldwide, or all-AI-users rank. It does not send prompts, sessions, paths, credentials, raw events, or the SQLite index. The rank service must not store connection IPs as user data. The dashboard does not load Google Fonts or other third-party assets. wheretoken serve binds 127.0.0.1 only and sets X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Referrer-Policy: no-referrer. /api/scan, /api/summary, and /api/community refuse a non-localhost Host (DNS rebinding).

The CLI never prints JWTs, access tokens, API keys, Authorization, Cookie, or Set-Cookie values. wheretoken scan --json and /api/scan run the same redaction. If a source is degraded (Trae encrypted login, Cursor signed out), it says so in a footnote instead of dumping secrets.

Do not paste ~/.config, %APPDATA%, or session files into issues. Report vulnerabilities privately to the GitHub owner.