Privacy policy

Centrail is built so the sensitive parts never leave your machine.

What we collect

• Per-event token counts, model names, and timestamps
• Estimate receipts for those events: which token-count fields were present, the derived provider and resolved model name, the rates and calculation policy used, the pricing source/revision and assignment time, and any missing or contradictory pricing evidence
• Optional: commit shas, line counts, branch names, and repo names (for attribution and ship status)
• Your account email (for sign-in)

What we never collect

Source code, prompts, completions, git diffs, or commit messages.

Public aggregate numbers

We publish running site-wide totals — tokens tracked, and the estimated energy, water, and CO₂ behind them — summed across all accounts (including imported chat history) and shown on our homepage. These are single combined figures: they contain no per-user, per-project, or otherwise identifying data, and nothing about you can be recovered from them. Deleting your data removes your share from future totals.

Storage & deletion

Usage is stored in your private account. You can wipe all events, sources, and identities from your Profile at any time, and revoke any paired machine's token. Estimate receipts are part of the usage event and follow the same deletion path; Centrail does not retain a separate pricing dossier after the event is deleted.

These receipts make a Centrail estimate explainable and reproducible under a named pricing policy. They are not provider invoices or accounting records and do not establish discounts, subscriptions, taxes, regional prices, or charges that the local harness did not report.

Deleting your account deletes your data and revokes every card you shared, pledge cards and monthly recaps alike. Each card's link then says only that its owner revoked it, and when it was issued and revoked: no name, no figures, nothing that leads back to you. A link that stopped resolving would look like a forged card.

Teams

Joining a team is opt-in and consent-first, and you can belong to more than one team; each sees only what you share with it. When you accept a team invite or create a team you see — and must accept — exactly what that team will get: your team will see only the repositories you choose to share with it, by name — usage totals, model mix, commits, and environmental footprint in those repositories — never see your other repositories, folder paths, personal projects, prompts, or code. Nothing is shared until you choose repositories, and then only from that moment unless you pick an earlier date. You can leave at any time, which removes your data from all team views.

A team's list of repositories is the team's own: adding a repository to it shows nobody's usage. You choose, per repository, whether your usage in it counts for that team (Settings → Team → Your sharing). A repository the team hasn't listed waits for an admin to approve your request before anything shows. Unticking a repository removes its usage from every live team view, including earlier periods.

Members who joined a team before October 2026 agreed to a narrower disclosure, and keep it until they choose otherwise: your team will see only the work you assign into its team projects — usage totals, model mix, commits, and environmental footprint for that work — never see your folder paths, repo names, personal projects, unassigned usage, prompts, or code. Under it, nothing from before you joined appears unless you include a folder or repo's earlier history when assigning it (off by default), and the mapping itself — folder paths and repo names — stays visible only to you. Switching to sharing by repository is your choice alone; no admin and no migration can make it for you, and switching replaces those team-project mappings for that team.

Team dashboards are live aggregations over current members only. If you leave a team (or are removed), that removes your usage from all team views immediately — there is no retained team copy, and rejoining starts with nothing shared. Everything you track remains your personal data that you chose to share; team visibility policies (set by team admins) can further limit per-member breakdowns, down to aggregate-only. A team's public pledge card shows the team name, member count, and aggregate footprint only — never member names or per-member numbers.

Monthly recaps

Nothing about your month is public unless you share it. The monthly recap card (under "Share your metrics" on Overview) is created only when you explicitly download it or create its link, contains a frozen snapshot of that month's totals (tokens, estimated spend, commits, footprint) — never your name, folder paths, repo names, or project names — and is a shared card like any other: you can revoke it at any time under Settings → Account → Shared cards, after which its link says only that its owner revoked it. The monthly recap email is private and shows only your own data; it's on by default and every email carries a one-click unsubscribe link, with the same switch available under Settings → Account.

A team's billing status never affects your personal account or data — non-payment pauses the team dashboard, nothing else.

Questions about data handling? We're glad to help — email support@centrail.org anytime.