Usage reads credentials that other apps already store on your Mac (Claude Code's Keychain item, Codex's auth.json, Cursor's local database, the gh CLI, and Antigravity's local language server) and sends each one only to that provider's own API. Nothing is written to disk by Usage except a small state.json listing which providers you connected. There is no telemetry.

Please do not open a public issue for security problems. Email russell@vancuren.net with a description and, if possible, steps to reproduce. You will get a reply within a few days, and a fix or mitigation before any public disclosure.

• Any way Usage could leak a token or cookie somewhere other than its provider.
• Any way a local file or web response could make Usage run code or write outside its own app-data directory.
• Anything that contradicts the privacy statements in the README.