Spender
Privacy
Last updated 22 September 2026
Spender collects nothing. There is no account, no analytics, no advertising and no Spender server. Your API keys and your spending data stay on your Mac, and the developer never receives them.
The app
API keys
Keys you enter are stored in the macOS Keychain on your Mac. Each key is sent only to the provider it belongs to, over HTTPS, to read billing and usage data. It is never sent anywhere else.
Spending data
Costs, tokens, balances and credits are requested directly from each provider's API and kept on your Mac, inside the app's sandbox, so the last good figures are there when you open the panel. Your settings — which providers are shown, their order, and any balance you entered by hand — are stored the same way.
Network requests
Apart from update checks (below), the app connects only to the providers you connect it to, and only to their documented HTTPS endpoints. Links such as Billing or Status open in your web browser, where the provider's own privacy policy applies. What a provider does with your requests is governed by that provider's privacy policy.
Updates
The copy downloaded from this website checks for a new version once a day, if you allow it, by reading a list of releases at usespender.com/appcast.xml; a new version is downloaded from GitHub. Those requests carry your IP address, the app's version and your macOS version, as any web request does, and nothing else. You can turn automatic checks off in Settings. The Mac App Store copy has no update check of its own: the App Store updates it.
No tracking
The app contains no analytics, crash-reporting or advertising code. If you have chosen in macOS settings to share analytics with app developers, Apple may pass anonymous crash reports to the developer; that is Apple's feature and you can turn it off in System Settings → Privacy & Security → Analytics & Improvements.
Removing your data
In Options → Connections, Delete Credential removes a key from the Keychain. Deleting the app together with its data removes everything it stored.
This website
usespender.com is a static page hosted on GitHub Pages. It sets no cookies and runs no analytics. GitHub, as the host, may log visitors' IP addresses for security; see the GitHub Privacy Statement. The main page loads a typeface from Google Fonts, so your browser also contacts Google; see the Google Privacy Policy.
Children
Spender is a developer tool and is not directed at children.
Changes
If this policy changes, the new version will be posted here with a new date.
Contact
Questions go to the issue tracker on GitHub. To report a security problem privately, follow the security policy.