Skip to content
No login requiredNo subscriptionNo in-app analyticsAI usage stays on your Mac
Tokens 4 Breakfast logo
Tokens 4 Breakfast
Privacy

Local-first by default.

Privacy policy and GDPR information for the Tokens 4 Breakfast website and macOS app.

Back to home

Optional ad purchase measurement

When enabled, visitors arriving from a ChatGPT advertisement may choose whether to allow purchase measurement. This is separate from Google Analytics consent. Before you accept, the click reference stays only in page memory, without an advertising cookie or attribution database entry.

With your consent, we store the encrypted click reference and consent time for up to seven days in our server-side Redis store. A first-party HttpOnly cookie, t4b_ads_attribution, holds an opaque reference for the same period. For a confirmed website purchase, we send OpenAI the click reference, a pseudonymous event ID, purchase time, value excluding tax and currency. Names, emails, billing addresses, payment-card data, IP addresses and app usage are not included in this event. These references are pseudonymous, not anonymous.

This optional processing is based on your consent. Declining does not affect the app, download or checkout. Use ‘Withdraw ad measurement consent’ at the bottom of the page while measurement is enabled to delete our attribution record and cookie and stop future matching. Withdrawal does not undo events already sent. Minimal duplicate-prevention records expire after eight days. Contact us for data-rights requests. Native-app purchases and purchases on another browser are not linked by this integration. The app’s local-first handling is unchanged.

Upstash provides the attribution store; Vercel hosts the website and webhook. For an attributed checkout, we pass the opaque attribution reference to Lemon Squeezy as a custom field. It may remain part of their order record. The signed order webhook can include customer and order details. Our integration processes it transiently, does not log or store its full payload, and sends only the event fields listed above to OpenAI.

The seven- and eight-day limits apply to our attribution and duplicate-prevention stores, not to all provider records, order records or hosting logs. When measurement is switched off, no new attribution is processed. Existing attribution expires within seven days; contact us using the details on this page for earlier deletion or other privacy requests.

OpenAI may process events in the United States. Under the Conversion Terms, we and OpenAI generally act as independent controllers, subject to any separately applicable restricted-processing arrangement. Our event includes opt_out=true; this does not mean OpenAI retains no data. Further information: OpenAI Conversion Terms, OpenAI privacy, Upstash privacy.

Last updated: 8 November 2026

This privacy policy covers both this website (tokens4breakfast.app) and the Tokens 4 Breakfast macOS app. The data controller is Aeon GbR, Brünnleinsweg 126, 90768 Fürth, Germany — reachable at support@onekapisch.com.

The macOS app

Tokens 4 Breakfast stores all usage data in a local SQLite database on your Mac. No usage data, token counts, spend figures, or prompt content is transmitted to our servers or any third party. Your history and local tracking work offline; live rate limits, provider usage refresh, license activation, and updates require a network connection. No account is required.

  • Usage and spend data are stored locally on your device only.
  • No analytics SDK, advertising network, or tracking framework is included in the app.
  • Once a day the app checks our website for updates (the standard Sparkle update check). We count these checks per app version to know how many Macs use Tokens 4 Breakfast. Our counter uses a daily-changing hash rather than storing the raw IP address. This is an estimate of active Macs, not a user identity or an exact installation count. Daily aggregate estimation records expire after 400 days. Hosting request logs are separate from these counters.
  • Support contact is by email only — you decide what information to include.

This website

This website uses Vercel Web Analytics for aggregate traffic statistics and Vercel Speed Insights for page-performance measurements. Web Analytics uses a request-derived hash instead of cookies; its visitor session expires after 24 hours. Data can include URLs, filtered query parameters, referrers, device/browser details and approximate location. The session limit is not a deletion deadline for all analytics records. This processing is based on our legitimate interest in understanding aggregate site usage (Art. 6(1)(f) GDPR).

Vercel hosts the website. Hosting and security logs may contain request URLs, IP addresses and timestamps, separately from aggregate analytics. We also keep aggregate download and checkout-click counters in Upstash, including download source, country and referring hostname; these counters do not record raw IP addresses. A size-limited recent-download list also records the time and these labels. Our redirect logs use referring hostnames, not full referring URLs. Aggregate totals have no automatic deletion deadline in our implementation. Provider log and backup retention is separate. Vercel's privacy information is available at vercel.com/legal/privacy-policy.

If GA4 is configured and you accept analytics in the website banner, we use Google Analytics 4 to measure aggregate page views and download button events. GA4 may set analytics cookies such as _ga and _ga_*. We do not send user IDs, account data, prompt content, payment data, or app usage data to GA4. Download events include only the CTA source and app version. This processing is based on consent (Art. 6(1)(a) GDPR), and GA4 is not loaded before consent.

Your analytics choice is stored in your browser's local storage so the site can remember whether you accepted or rejected GA4. You can change that choice at any time through the Analytics preferences link in the footer.

Checkout and payments

The Pro upgrade is sold through Lemon Squeezy, which acts as the merchant of record. When you purchase, your payment and billing data are handled by Lemon Squeezy under their own terms and privacy policy. We can receive order and customer details, including the purchaser's name, email, billing information, product and amount, but not full payment-card details. When optional purchase measurement is enabled, the signed order notification is processed as described above. Lemon Squeezy's privacy policy is available at lemonsqueezy.com/privacy.

Your rights under GDPR

You have the right to:

  • Request access to personal data we hold about you (Art. 15 GDPR)
  • Request correction of inaccurate data (Art. 16 GDPR)
  • Request deletion of your data (Art. 17 GDPR)
  • Object to processing based on legitimate interest (Art. 21 GDPR)
  • Request restriction of processing (Art. 18 GDPR)
  • Data portability where applicable (Art. 20 GDPR)

To exercise any of these rights, email support@onekapisch.com. You also have the right to lodge a complaint with the supervisory authority in your member state. In Germany the relevant authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), www.lda.bayern.de.

Contact

For privacy questions or data requests, contact support@onekapisch.com.