Privacy Policy
What Calculate Token collects, what it sends to third parties, and what stays in your browser.
Last updated 31 July 2026
The short version
You can use the calculator without an account, and GPT token counting never leaves your browser. Two things do leave it: counting tokens for a Claude model sends your text to Anthropic, and the AI rewrite sends it to Google. Nothing you type is stored unless you are signed in, in which case saving a calculation stores it — including the prompt text — until you delete it.
What stays in your browser
Token counts for OpenAI models are computed locally. The tokenizer is downloaded to your device and run there, so the text you paste is never transmitted for a GPT count — not to us, not to OpenAI.
Your light/dark preference is kept in localStorage on your device and is never sent anywhere.
What is sent to other companies, and when
Each of these happens only in response to something you do. None of them run in the background.
- Anthropic— when the results table shows an exact Claude count, your text is sent to Anthropic’s token-counting API. Anthropic returns a number; it does not return a completion. If this is unavailable, the app falls back to a local character-based estimate and marks the row
estrather than sending anything. - Google — using the AI rewrite sends your prompt to the Gemini API to be rewritten. If Gemini fails, the same text is sent to Anthropic instead as a fallback.
- Resend — your email address, to deliver sign-up confirmation and password reset messages. Only if you create an account.
Your text is sent to these providers to perform the operation you asked for. What they do with it afterwards is governed by their own terms, not ours.
What is stored if you create an account
An account exists so your work persists between visits. It stores:
- Your identity — name, email address, whether that email is verified, and a profile image if you signed in with Google. Passwords are stored only as a hash; the plain password is never written down.
- Your sessions — an expiring session token, plus the IP address and browser user agent the session was created from. These are recorded so a session can be attributed if one is stolen. Signing out ends the current session; there is not yet a screen listing every active session.
- Your saved work — saved calculations, collections, history entries, saved reports, and shares. Saved calculations and history entries include the full prompt text, along with any response or notes you added. That is the point of saving them, but it is worth stating plainly: if you paste something confidential and save it, it is stored.
History is recorded only for signed-in users. Using the calculator signed out leaves no record of what you typed.
Sharing
Creating a share link generates an unguessable token. A share is unlisted by default, meaning anyone with the link can open it but search engines are told not to index it. Marking a share public makes it indexable, and it may then appear in search results.
Revoking a share takes effect immediately — the cached page is purged rather than left to expire.
Data collected to run the service
- Rate limiting — the paid routes are capped per caller. For a signed-in user the key is a hash of the session token. For an anonymous caller it is the IP address, held in a short-lived counter that expires on its own. There is no way to identify a person from it, but it is an IP address and we would rather say so.
- Error reporting — when something breaks, a report goes to Sentry containing the error and a stack trace. It is configured not to attach personally identifying information, and structured logs redact any field whose name suggests a key, token, password, cookie, or secret.
- Analytics — Vercel Analytics records aggregate page views. It does not use cookies and does not build a profile of you across sites.
Who else touches the data
The service runs on infrastructure operated by others. Beyond the providers already named, the database is hosted by Neon, the application by Vercel, and rate-limit counters by Upstash.
Nothing is sold, rented, or shared for advertising.
How long it is kept
Saved work is kept until you delete it. Deleting an item deletes it; deleting your account removes your saved calculations, collections, history, reports, and shares along with it. Sessions expire on their own. Rate-limit counters expire within a day at most.
Your control over it
- Export — the history page exports everything you have saved as CSV, JSON, Markdown, or a ZIP of all four.
- Delete — any individual item, or your whole account, from account settings.
- Avoid entirely — the calculator works signed out, and signed out nothing is stored.
Depending on where you live you may have additional statutory rights to access, correct, or erase your data. Get in touch and we will action it.
Children
This is a developer tool and is not directed at children. Accounts are not knowingly created for anyone under 13.
Changes to this policy
If this policy changes, the date at the top changes with it. Because the site is open source, the full revision history of this page is public in the repository — you do not have to take our word for what it used to say.
Questions
Anything unclear or anything that looks wrong, tell us. If a claim on this page does not match what the code does, that is a bug and we want to know.