Privacy

What leaves your machine

The device check. When a licence is activated and at most once a day, TokenGem sends a SHA-256 hash of the key (never the key), a device identifier derived from the machine, the TokenGem version, and the operating system name and architecture. The reply is a seat count and whether the key has been revoked. No command text, no file paths, no repository names, no code, no session content, no hostname, no email address, ever. Turn it off with tokengem privacy --device-check off; seats are then not counted from that machine, and everything else keeps working. The free tier sends nothing at all, because it has no key to check.

The update check. Only when you run tokengem update or press the button in the dashboard. It fetches a public feed and sends nothing but the request. TokenGem never checks for updates on its own.

Installing. tokengem install downloads the three pinned open-source components from their own release channels. Those downloads reach those projects' hosts, not ours.

Nothing else. There is no telemetry, no crash reporter, no analytics in the product, opt-in or otherwise. The measurement ledger, the baseline, the repo index and the routing log are files on your disk. The dashboard listens on the loopback address only and is not reachable from your network.

Third-party flows TokenGem closes

The three components TokenGem manages each have a data flow of their own. TokenGem turns every one of them off on every process it starts, and the switches live in one function so there is one place to check rather than a promise to trust:

• The terminal filter's usage ping, whose payload would include your most-run commands: hard-disabled, consent never granted.
• The repo index's custom model provider, which would send your whole corpus to an endpoint a repository could name: the enabling flag is never set.
• The repo index's semantic extraction of prose files, which sends them to a third-party model: off by default; indexes are built from the local syntax tree only. You can turn it on in Settings, and the setting says what happens when you do.
• The repo index's query log, which writes your question text to disk in plain text: off by default. If you turn it on, it writes inside TokenGem's own directory, is shown in Settings, and is deleted by the purge button.
• The code-discipline ruleset makes no network calls and has no dependencies. Nothing to close.

The per-component audit, read from source at the pinned commits, ships with the product as docs/SUPPLY_CHAIN_AUDIT.md.

This website

This site sets no cookies, runs no third-party analytics and records no session. Page counts are first-party and carry no visitor identifier. The device page and the resend page send what you type in them to our issuer service and nothing else, and are rate-limited by address to stop abuse.

What a purchase records

The merchant of record keeps the payment and invoicing records the law requires it to keep. Our issuer keeps the order reference, the purchase email, the tier, the key and its hash, when the receipt was sent, and the device identifiers that check in, for as long as the licence exists, because a perpetual licence has to be resendable in ten years. That record is never sold, shared or used for marketing. Ask by email and it is shown to you or deleted, subject to the records the merchant of record must retain.

Questions

Reply to your receipt, or use the contact page. Every claim on this page can be checked against the product's own source and the audit document that ships with it.