Privacy Policy

Privacy Policy

Last updated: 2026-10-15.

Tokenade ("we", "us", or "our") operates the tokenade.net website and the Tokenade software tool. This page explains what personal data we collect, why we collect it, and your rights under applicable law including the EU General Data Protection Regulation (GDPR).

1. Who we are

Tokenade is operated by Paul Irolla, based in France. You can reach us at the address on our contact page.

2. Data we collect and why

2.1 Account data

When you create an account, we collect your email address and either a hashed password (confirmed with a one-time code sent by email) or, if you sign in with Google, the email address, name and account identifier Google sends us. We use this to authenticate you, send you your license key, and communicate essential service information (billing receipts, policy updates). Legal basis: performance of a contract.

2.2 License and machine identifiers

To enforce per-plan seat limits, the Tokenade client sends us a hashed machine identifier (a one-way hash of hardware attributes) and non-identifying platform hints (OS family, hostname). We do not store a copy of your raw hostname — only the hash. Legal basis: legitimate interest in preventing license abuse.

2.3 Token-savings telemetry

The client reports anonymous, aggregate usage statistics so we can show you your savings dashboard, calculate your bill (1% of the API value of the tokens saved, which is why the name of the model used is reported too) and decide which optimizations to build next: the operation or command name (the program name only — for example git — never its arguments, paths, or values), the token count before and after compaction, whether a command-specific optimization applied, and a timestamp. These are measurements of how Tokenade itself behaved, not data about you. We never collect the content of your code, your prompts, AI responses, command arguments, or file contents — none of that ever leaves your machine. Legal basis: legitimate interest / performance of a contract.

2.4 Payment data

Payments are processed by Stripe, Inc. Stripe collects and stores your card details directly under their own privacy policy (stripe.com/privacy). We receive only a Stripe customer ID, subscription and trial status, invoice metadata, and the billing country (and, for a business, the VAT number you enter) needed to apply VAT. We never see or store your card number.

2.5 Cookies and analytics

We use essential cookies for session management (login state). We may use privacy-respecting analytics (aggregate page-view counts, no cross-site tracking) to understand how the site is used.

With your consent only, we use marketing-measurement trackers provided by third-party vendors (social networks and advertising platforms) which set third-party cookies and share browsing data with those vendors. These trackers only load after you accept them via the consent banner shown on your first visit; you can refuse, and no advertising cookie is set without your agreement. You can change your choice at any time by clearing your browser cookies/local storage. Legal basis: consent (GDPR art. 6(1)(a)).

2.6 Sign-up survey and first visit

When you sign up we may ask how you heard about Tokenade (optional), and we record how you first reached the site (referring site and campaign parameters of the link you followed). We use this to know which channels bring users. Legal basis: legitimate interest.

2.7 Emails

We send account and service emails (sign-in codes, receipts, trial and billing notices) and, unless you opt out, occasional product emails such as a summary of your savings. Emails are delivered by Resend. Every non-essential email has an unsubscribe link. We do not track whether you open emails or click their links. Legal basis: performance of a contract / legitimate interest.

2.8 Bug reports (tokenade report)

Only if you run tokenade report and confirm, the client uploads a diagnostic bundle: Tokenade's own logs and, so we can reproduce the problem, your AI agents' session transcripts since installation. Credentials are redacted before upload as well as Tokenade can, but this is best effort, not a guarantee: review what you send. Bundles are stored on our servers and deleted after 30 days. Legal basis: consent, given each time you send a report.

2.9 Testimonials and contact messages

If you leave a testimonial, we store your name, role, text and optional photo, and publish them on the site only with your agreement; you can ask us to remove them at any time. Messages sent through the contact form are kept to answer you. Legal basis: consent / legitimate interest.

2.10 Referral and affiliate programmes

If you invite someone by email, we send that person one invitation email on your behalf. For referrals, we record who referred whom and, to detect fraud, the IP address used when a referral is claimed. If you join the affiliate programme, we store the payout details you provide (account holder and IBAN) to pay your commissions. Legal basis: performance of a contract / legitimate interest in preventing fraud.

2.11 Error monitoring

When the site or the dashboard hits an error, a technical report (error, page, browser, IP address) is sent to Sentry so we can fix it. Legal basis: legitimate interest.

2.12 Who can see your data

Your account data is accessible only to Tokenade's operator and to a small number of administrators he appoints, who have read-only access and are bound to confidentiality.

3. Data retention

• Account data: retained while your account is active and for up to 12 months after deletion to comply with legal obligations.
• Machine-ID hashes: deleted within 30 days of license cancellation or account deletion.
• Telemetry: retained in aggregate for product analytics; raw per-operation records are purged after 90 days.
• Bug-report bundles: deleted after 30 days.
• Affiliate payout details: kept while you take part in the programme, and afterwards as long as accounting law requires for the payments made.

4. Data sharing

We do not sell your personal data. We share data only with:

• Stripe (payment processing)
• Google (only if you choose to sign in with Google)
• Resend (email delivery)
• Sentry (error monitoring)
• Third-party marketing-measurement and advertising vendors (social networks and advertising platforms) — only if you have consented (see § 2.5)
• Infrastructure providers (hosting, database) under data-processing agreements
• Legal authorities, only when required by law

5. Your rights (GDPR)

If you are in the EU/EEA or UK, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Delete your account and associated personal data
• Object to or restrict processing
• Data portability
• Lodge a complaint with your national data protection authority (e.g., CNIL in France)

You can delete your account and all associated data yourself at any time, directly from your dashboard ("Privacy & account" section): deletion is immediate, irreversible, and cancels any active paid subscription. To exercise any of the other rights, contact us via the contact page. We will respond within 30 days.

6. Security

We use industry-standard measures (TLS in transit, encrypted storage at rest, hashed credentials) to protect your data. No transmission over the Internet is 100% secure; we cannot guarantee absolute security.

7. Children

Tokenade is not directed at children under 16. We do not knowingly collect data from minors.

8. Changes to this policy

We may update this policy. Material changes will be communicated by email or a notice on the site. The "Last updated" date at the top of this page reflects the most recent revision.

9. Contact

Questions about this policy? Use our contact page.