What stays, what moves.

A note on Cursor, Claude Code and Codex. Cursor, Claude Code and Codex themselves send your prompts and the code context they choose to the AI model providers you use, as they always have, under their own terms and privacy policies. OptiFlume changes only which model they use. It does not send, copy or store your prompts or code anywhere else.

1. Who we are

OptiFlume (“OptiFlume”, “we”, “us”) is responsible for the personal information described here (the “controller”, in the language of data protection law). Contact: support@optiflume.ai. This policy covers the OptiFlume software for macOS, the website at optiflume.ai and its subdomains, and your OptiFlume account.

2. On your Mac

OptiFlume keeps its working data in ~/.optiflume in your home folder, in plain text and SQLite files you can open. This includes the routing log (one line per routing decision, with the first 40 characters of the prompt, for your own analytics), the turn-activity log, the safety audit log, working-memory notes and the turn cache (session content OptiFlume uses to carry context forward), the code index, what it has learned about your preferences, your settings, and your license and sign-in session. None of this is sent to us, except the counts in the usage rollup described below.

The routing log, the turn-activity log and the safety audit log drop entries older than 90 days, and the turn cache drops entries older than 30 days, each time Cursor starts a session. On a Mac without Cursor, the routing log is not trimmed yet; you can delete it at any time. Everything else stays until you delete it. optiflume uninstall removes OptiFlume and keeps this folder; optiflume uninstall --purge removes the folder too.

3. What the software sends

Every connection uses HTTPS. Like any internet request, each one shows your IP address to the server it reaches. Requests from the Mac identify themselves only as OptiFlume and their purpose (for example, “OptiFlume/1 (update-check)”); they contain no Mac name, serial number or hardware identifier.

Sign-in

When you sign a Mac in, it asks optiflume.ai for a short code, and you approve that code in your browser. The Mac then receives a sign-in session token, which it stores in a file only your macOS user can read. optiflume logout signs the Mac out.

License refresh

Up to twice a day, the Mac sends its session token to optiflume.ai and receives a signed license for your plan: trial, free tier or Pro. The license identifies your account by a one-way identifier, not your email address, and lets the Mac work offline for up to about 30 days, plus a 14-day grace period unless the license ends with your paid period. The response also includes your account email so that optiflume account can show who is signed in. The software needs this to work; it stops when you sign the Mac out.

Daily usage rollup

At most every six hours, the Mac sends counts for the previous and the current day so your console can show them. It is on by default. Turn it off on the Mac with optiflume telemetry off, which stops these calls entirely, or in console Settings. If you turn it off in the console, the Mac still asks when it checks in, sending only its license, whether you have turned it back on. Each rollup is sent with the Mac’s license, which links it to your account. Our server accepts only the fields below and rejects a rollup that contains anything else:

• day: The calendar day (UTC) the counts are for.
• prompts: How many prompts a model ran on.
• by_tier: Those prompts counted by how demanding OptiFlume judged them.
• by_model: Those prompts counted by the name of the model that ran them.
• switches: How many switches were accepted, stopped, redirected, kept, bypassed, or suggested as a tip.
• saved_usd, saved_seconds: The estimated saving in US dollars, and a time-saving figure that is currently always zero.
• compactions: How many times a conversation's context was compacted, and tokens avoided (currently always zero).
• guard: How many edit loops were caught, secrets redacted or sensitive files blocked, and risky shell commands blocked or warned about.
• version: The OptiFlume and Cursor version numbers.
• trial: During the trial only: the trial meter's estimated saving, prompts routed, trial limits, whether a limit was reached, and days left.
• device: A random identifier for the Mac, created on it and not derived from its hardware, so the dashboard can add several Macs together.

A rollup never contains prompt text, file or folder names, repository names, or code. Analytics and telemetry documents how each count is computed.

Update check

When Cursor or VS Code starts, when a Claude Code or Codex session starts, and every few hours, the Mac downloads a signed description of the latest OptiFlume release from optiflume.ai. When a newer version exists, it downloads that version’s package from get.optiflume.ai and installs it in your own user folder, only after checking that the release is signed by OptiFlume, that the package matches it exactly, and that Apple has verified the package’s Developer ID signature and notarization (to check this, macOS may contact Apple). Neither request sends anything about you or your account. To be asked before installing instead, set "auto_update": false; to turn the check off entirely, set "update_check": false, both in ~/.optiflume/config/routing-config.json.

Compatibility list

About once a day, the Mac downloads a signed list of Cursor versions on which automatic switching should pause, so that a Cursor update that breaks switching can be handled the same day. It sends nothing about you or your account.

Model prices

OptiFlume compares models by their published per-token prices. Once a day the Mac downloads Cursor’s current prices from optiflume.ai (optiflume.ai/api/prices, which copies Cursor’s published list and is signed), so new models and price changes are used without an update. The request sends nothing about you or your account. If Cursor offers a model that neither list includes yet, the Mac reads Cursor’s public model-price page (cursor.com/docs/models-and-pricing.md), at most once a day, and uses its prices only if they agree with the prices already known. The request goes to Cursor, not to OptiFlume, and sends nothing about you, your account or your prompts.

Downloads

The installer and updates are downloaded from get.optiflume.ai. After installing, the Mac downloads OptiFlume’s local models (about 1 GB) once, from get.optiflume.ai or, if that is unavailable, from huggingface.co. Hugging Face then receives your IP address and the name of the file requested, under its own privacy policy. Every file is checked against a known fingerprint before it is used.

4. What we keep on our servers

• Your account: email address, name, profile image link (if Google, GitHub or Apple provides one), whether your email address is verified, and when the account was created and updated.
• Linked sign-in providers: which provider you used, your account identifier with that provider, and the tokens it issues at sign-in. We use them only to sign you in.
• Sign-in sessions: one for each browser and each Mac signed in, with the IP address and user agent (browser or “OptiFlume” app) that created it, and when it expires.
• Pending sign-ins: email sign-in links and Mac approval codes, which expire after 15 minutes.
• Rate-limit counters: a request count and time, keyed by IP address and the page or endpoint requested, and for emails we send, by a one-way hash of the address keyed with a secret only we hold, used to stop abuse.
• Your plan: when your trial started and ends and, if you subscribe, the Stripe subscription and customer identifiers, the subscription status, and when the current period renews or ends.
• Usage rollups: the rollups described above, with the date each was received, your telemetry on/off setting, and when your account first and last sent one. They are stored under the one-way account identifier, not your email address.
• Teams early-access requests: the email address, company, role, team size, tools, rough monthly spend, timeline and note you enter on the Teams page. Each request is also emailed to us.
• Download-link requests: if you ask, on a phone or a PC, for the Mac download link by email, we send that one email and keep nothing about it but a rate-limit counter (a one-way hash of the address, deleted within a day). If you also ask to hear when OptiFlume runs on Windows or Linux, your email address is emailed to us so we can tell you once.
• How you heard about us: if you answer the optional question shown when you connect your first Mac, the answer you picked (for example “Hacker News”), with your account.
• Channel link counts: when you follow a link such as optiflume.ai/r/hn, we add one to that day’s count for the link. Nothing about you is stored.
• Support: emails you send us, and our replies.

5. The website and cookies

optiflume.ai uses only the cookies needed for sign-in: a session cookie that keeps you signed in and, while you sign in, any short-lived security cookies the sign-in flow needs. There are no advertising or analytics cookies and no tracking pixels. To count visits we use Cloudflare Web Analytics, which sets no cookies and does not identify you or follow you across sites: it records, in aggregate, the page viewed, the site that linked to it, the browser, device type and country, and how fast the page loaded. Your theme choice (light, dark or auto) is saved in your browser’s local storage and never sent to us. Our hosting provider, Cloudflare, processes the technical details of each request (IP address, address requested, user agent and time) to deliver and protect the site, and we keep request logs only briefly, for troubleshooting and security.

6. Payments

Pro subscriptions are processed by Stripe through Managed Payments, with Link (a Stripe service) as the merchant of record. When you choose to subscribe, we send Stripe your account email address and account identifier so the subscription is linked to your account. At checkout, Stripe and Link receive your email address and collect your payment details, billing address and tax information, and handle them under their own privacy policies; we never see or store your full card number. Stripe then notifies us of changes to your subscription. Its notifications contain other details of the subscription, but we store only the fields listed under “Your plan” above.

7. Emails

We email you sign-in links and download links you ask for, and notices about your account, your subscription, price changes and changes to our terms. If you joined the Windows or Linux waitlist, we email you once when OptiFlume runs there. We do not send marketing email. Link sends your receipts, invoices and billing emails.

8. Service providers

We use these providers to run OptiFlume. Each receives only what it needs for its task.

• Cloudflare: hosts the website, the database and the download server, so it processes everything we store, and provides the cookieless page analytics described above.
• Stripe: processes subscriptions and payments through Managed Payments, with Link (a Stripe service) as merchant of record. It receives your email address and payment details at checkout. For your purchase, Stripe and Link act under their own privacy policies.
• Resend: delivers sign-in emails and download links you ask for, and delivers Teams early-access requests and waitlist sign-ups to us.
• Google (Gmail): hosts the inbox that our addresses, such as support@optiflume.ai, forward to, so it holds the emails you send us and the Teams requests and waitlist sign-ups delivered to us.
• Google, GitHub and Apple: sign you in, if you choose them. They tell us your email address, name and, if you have one, profile image.
• Hugging Face: serves the local model files if our download server is unavailable.

9. Why we use your information

• To provide what you signed up for (performance of our contract with you): your account, sign-in, licenses, your subscription, your dashboard and support.
• For our legitimate interests, balanced against yours: keeping OptiFlume secure and preventing abuse (such as rate limits and one trial per person), keeping the software compatible and up to date, and understanding, from rollups in aggregate, how OptiFlume is used so we can improve it. You can object at any time, and you can turn the rollup off.
• To meet legal obligations, such as tax and accounting records, and responding to lawful requests.

10. What we never do

• Receive, store or read your prompts or your code.
• Sell your personal information, or share it for cross-context behavioral advertising.
• Show ads, use advertising trackers, or use analytics that set cookies or identify you.
• Use your data to train AI models.

11. How long we keep it

• Your account, linked sign-in providers and plan: until you delete your account.
• Sign-in sessions: a session stops working 60 days after it was last used, and is deleted when you sign out or delete your account.
• Pending sign-in links and Mac approval codes: they expire after 15 minutes.
• Rate-limit counters, including the hashes of email addresses: deleted within a day.
• Usage rollups: until you delete them in the console (Settings, “Delete stored usage reports”, which also turns usage reporting off) or delete your account.
• Teams early-access requests: until you ask us to delete them, or delete an account with the same email address. We delete the emailed copy when you ask.
• How you heard about us: until you delete your account.
• Waitlist sign-ups: until we have told you OptiFlume runs on your platform, or you ask us to delete them.
• Support emails: as long as needed to help you, then deleted on request.
• After you delete your account, two records that cannot be turned back into your email address: a keyed one-way hash of your email address and of each linked Google, GitHub or Apple account ID, with the dates of your free trial, so the free trial is once per person; and a one-way ID of the deleted account, so its Macs’ usage rollups are refused. We keep these while we offer a free trial.
• Stripe’s and Link’s billing records: as long as the law requires them to keep them, under their own policies.
• On your Mac: as described in section 2.

Deleting your account in the console deletes your account, its sign-in sessions and linked sign-in providers, pending sign-ins, your plan record, your usage rollups and telemetry setting, your answer to how you heard about us, and Teams requests sent from your email address. It ends any active subscription at once, so it never renews (Pro ends then, with no refund for the current month; on a yearly plan, ask us and we refund the whole months that had not started). It keeps the two one-way records listed above, rate-limit counters until they are deleted within a day, and copies held by our providers for their own retention periods (for example our hosting provider's request logs, our email provider's delivery logs, and emails in our support inbox until you ask us to delete them). It does not remove data on your Macs: run optiflume uninstall --purge on each Mac for that.

12. Where it is processed

Our providers process data in the United States and in other countries where they operate. Where the law requires safeguards for international transfers, we rely on those our providers offer, such as the European Commission’s Standard Contractual Clauses.

13. Your rights and choices

Depending on where you live, you may have the right to access your personal information, correct it, delete it, receive a copy in a portable format, object to or restrict how we use it, and withdraw any consent you have given. Many of these you can do yourself: turn usage reporting off, delete stored usage reports, or delete your account in the console. For anything else, email support@optiflume.ai from the address on your account. We will reply within 30 days, and may need to confirm the request comes from you. You can also complain to the data protection authority where you live.

If you live in California or another US state with a consumer privacy law: we collect the categories of information described in section 4 for the purposes in section 9; we do not sell or share personal information, and have not done so; we do not use sensitive personal information to infer characteristics about you; and we will not treat you differently for exercising your rights. You can use an authorized agent to make a request.

14. Security

Every connection uses HTTPS. Licenses, release information and the compatibility list are signed, and the Mac checks each signature before trusting them. The Mac’s sign-in session is stored in a file only your macOS user can read, and downloaded files are verified before use. Access to our servers and database is limited to the people who operate OptiFlume. No system is perfectly secure; if a breach affects your personal information, we will tell you as the law requires.

15. Children

OptiFlume is for people aged 18 and over, and we do not knowingly collect information from anyone younger. If you believe a child has given us personal information, tell us and we will delete it.

16. Changes to this policy

Before any feature sends a new kind of information off your Mac, we will describe it on this page first. Any future feature that would send prompt or code content will be off unless you turn it on. When we change this policy, we will post the new version here with a new date, and email you about material changes before they take effect.

17. Contact

Questions or requests about your privacy: support@optiflume.ai. See also our Terms of Service, Refund Policy and Security page.