Privacy

Privacy policy

This page covers the tokenhush.com website and the Tokenhush product. This site adds no first-party analytics or tracking scripts. The product redacts on your machine and sends no telemetry except two switchable outbound categories — update check and rule sync. Each category's current status, its field list, retention, and off switch are below.

Last updated: 2026-09-13

This website

This site is static. It has no accounts, no forms, and no place to submit personal information.

What the site does not collect
No sign-up, no newsletter, no contact form, and no email collection. There is no field on this site that accepts personal data.
Hosting
Like any website, the hosting provider processes the requests needed to serve pages and protect the service from abuse. That is standard request handling, not visitor profiling.

The product

The product is a local gateway. Redaction happens on your machine. The open-source core ships no audit store: it exposes a no-op seam, and the project does not operate a service that receives your content.

  • No telemetry except two switchable categories. The product sends no telemetry except update check and rule sync, both listed under network egress. Each is switchable and its current status (active or planned) is shown there. The gateway has no analytics endpoint that collects usage data.
  • Content stays local. Your prompts, responses, and provider keys stay on your machine. The project does not operate a service that receives them.
  • Keys stay yours. In V1 the gateway is passthrough: your tools keep their own provider keys, and the gateway forwards them without storing them.
  • Verifiable in the source. The core is open source, so these behaviors can be checked in the code rather than taken on trust (fregie/tokenhush).

Network egress

Tokenhush makes vendor requests for exactly two switchable categories: update check and rule sync. Each category's current status (active or planned), its requests, the server-visible fields, retention, and off switch are listed below. This list is generated from one machine-readable manifest shared by the CLI and the core documentation, so the three stay in lockstep.

  • Update check

    Active

    This build sends these requests only when you run the matching command; the fields, retention, and switch below apply.

    Check for a signed release: the update manifest, its signed revocation document, and the root-signed key-list. These share one host and one switch and are one egress category, not three.

    Host
    updates.tokenhush.com
    Default when active
    enabled
    How to switch it off
    The check runs only when you run tokenhush update (including --check) on a self-managed install; Homebrew and Scoop installs are handed to their package manager. Set the environment variable TOKENHUSH_NO_UPDATE_CHECK=1 to make the command return before any network request.
    Retention
    Cloudflare access logs and request records are retained for 30 days.

    Fields involved

    • channelSent by the clientRelease channel requested (for example stable or beta).
    • os_archSent by the clientOperating system and CPU architecture of the running binary.
    • current_versionSent by the clientCurrent binary version, so the server can tell whether an update exists.
    • ipObserved by the serverSource IP address of the request, visible to the server.
    • timestampObserved by the serverRequest time recorded by the server.
    • access_logsObserved by the serverCloudflare access logs (path, time, source IP, User-Agent).

  • Rule sync

    Active

    This build sends these requests only when you run the matching command; the fields, retention, and switch below apply.

    Fetch signed detection-rule manifests and rule bundles so the local detectors can be tightened without shipping a new binary.

    Host
    updates.tokenhush.com
    Default when active
    enabled
    How to switch it off
    Rule sync runs only when you run tokenhush rules sync; it never syncs on its own. Set the environment variable TOKENHUSH_NO_RULE_SYNC=1 to make the command refuse without any network request.
    Retention
    Cloudflare access logs and request records are retained for 30 days.

    Fields involved

    • channelSent by the clientRule channel requested (for example stable or beta).
    • os_archSent by the clientOperating system and CPU architecture of the running binary.
    • current_schema_versionSent by the clientSchema version and serial of the rule set currently in use.
    • ipObserved by the serverSource IP address of the request, visible to the server.
    • timestampObserved by the serverRequest time recorded by the server.
    • access_logsObserved by the serverCloudflare access logs (path, time, source IP, User-Agent).

Third-party links

This site links to GitHub for source code, releases, discussions, and security advisories, and to the public documentation in the same repository. Once you follow one of those links, GitHub's own privacy terms apply.

Changes and questions

If this policy changes, the updated version is published on this page with a new date. Questions about the policy can be raised in GitHub Discussions. For vulnerabilities, use the private advisory channel instead of a public issue, as described on the security page.