Privacy Policy

Effective date: April 20, 2026  ·  Last updated: April 20, 2026

TokenBonfire ("we", "our", or "us") operates the TokenBonfire mobile application and website located at tokenbonfire.com. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

1. Information We Collect

• Account information. When you create an account, we collect your name, email address, and a hashed password (or your Google account identifier if you use Google Sign-In).
• AI usage data. We collect token counts, cost estimates, and session metadata retrieved from your connected AI providers. This data is used solely to generate your usage dashboards and team reports.
• Provider API keys. If you connect an AI provider (OpenAI, Anthropic, etc.), we store your API key encrypted at rest. We strongly encourage you to create and use a read-only key scoped to usage and metrics data only — our onboarding guides you through this step-by-step for each provider. If you choose to provide a key with broader permissions, TokenBonfire will only ever use it to read usage data; however, you assume responsibility for the scope of the key you provide. Keys are never shared with third parties.
• Device and usage information. Standard server logs including IP address, device type, operating system version, and app version. We use this to operate the service reliably.

2. How We Use Your Information

• Provide, maintain, and improve the TokenBonfire service.
• Generate your personal and team usage dashboards.
• Send transactional notifications (usage alerts, weekly summaries) if you opt in.
• Respond to support requests.
• Comply with legal obligations.

We do not sell your personal information. We do not use your data to train AI models.

3. Data Sharing

We share data only in these limited circumstances:

• Service providers. We use third-party vendors (hosting, database, email) who process data on our behalf under confidentiality agreements.
• Team features. If your organization uses team features, managers with the appropriate role can see aggregated usage data for their team members.
• Legal requirements. We may disclose information if required by law or to protect the rights and safety of our users.

4. Data Retention

We retain your account data for as long as your account is active. You may delete your account at any time from Settings, which permanently removes your personal information and usage data within 30 days.

5. Security

All data is transmitted over HTTPS. Passwords are stored using a one-way cryptographic hash. Provider API keys are encrypted at rest using AES-256-GCM. We strongly recommend connecting a read-only key scoped to usage data only — our onboarding walks you through creating one. Regardless of key scope, TokenBonfire only uses your key to read usage metrics and never initiates model calls or spend on your behalf. We perform regular security reviews.

6. Children's Privacy

TokenBonfire is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, please contact us and we will delete it promptly.

7. Your Rights

Depending on your location you may have the right to:

• Access and download your personal data.
• Correct inaccurate data.
• Delete your account and associated data.
• Opt out of non-essential communications.

To exercise any of these rights, email us at privacy@tokenbonfire.com.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy at this URL with an updated effective date. Continued use of the service after changes constitutes acceptance.

Contact

Questions? Reach us at privacy@tokenbonfire.com or through the support link in the app.