Privacy, plainly

ccbar reads files. It does not write files. It only uploads one byte: the rate-limit ping you can opt out of.

What ccbar reads

Three files in your `~/.claude/` folder.

On launch and again every fifteen seconds, ccbar opens three things — and only those — on your local disk. The reads are file-system operations on your own machine.

Project session files — projects/<cwd>/<sessionId>.jsonl. Each line is one chat event. ccbar parses only entries with type === "assistant" and reads exactly four numeric fields: input_tokens, output_tokens, cache_creation_input_tokens, cache_read_input_tokens. The conversation text is ignored.
Rate-limit log — usage.jsonl. ccbar walks this file once and keeps only the most recent entry that has an anthropic-ratelimit-requests-remaining header.
Directory listing — the names of files in projects/, to count sessions. Names only. Contents not opened.

Live

The quota chip shown in your tray is the same one that goes italic when more than an hour old. ccbar admits when stale.

The one network call

A single Haiku ping for live 5h + weekly headers.

For the bars to be accurate, ccbar reads your Claude OAuth token from ~/.claude/.credentials.json and sends one minimal request to Anthropic's /v1/messages endpoint (Haiku, max_tokens=1). Anthropic's response carries the anthropic-ratelimit-unified-5h-utilization and -7d-utilization headers — that's where the percentages come from. The result is cached for 60 seconds.

The token never leaves the HTTPS request. It's not logged. It's not emitted to the frontend. To opt out entirely, set CCBAR_LIVE_QUOTA=0 — the bars stay empty and ccbar falls back to local aggregates.

Codex tab — same posture, different folder

`~/.codex/sessions/` for history. OAuth for the bar.

For the Codex provider, ccbar walks ~/.codex/sessions/**/*.jsonl and ~/.codex/archived_sessions/*.jsonl to aggregate token usage by 5h / 7-day windows. The rate-limit percentages come embedded in the same JSONL (event_msg.token_count.rate_limits) — no extra network call needed for the bars.

Sign-in is a separate, optional OAuth flow against auth.openai.com (loopback on localhost:1455). The resulting token lives at <config>/ccbar/codex-auth.json with user-only file permissions. We never read ~/.codex/auth.json (Codex CLI's own keystore). The frontend only ever sees { connected, email, expiresAt, sessionCount } — never the bearer.

Display convention: Codex CLI shows rate limits as "X% left" (counting down from 100). ccbar's Codex tab matches that convention — bar empties as you consume — so the number always agrees with what codex shows in your terminal.

What ccbar refuses to read

Credentials live where they live.

Some files in ~/.claude/ contain credentials. ccbar's Rust source has explicit branches that skip them, and the project's instructions to its own contributors forbid reading them outside the live-quota module:

quota-status/account.json — account-level credentials
quota-status/sessions/*.json — per-session credential cache
backups/, cache/, history.jsonl, shell-snapshots/

Verify it yourself

Three commands, no faith required.

# 1. No mock data.
grep -r "mock\|fake\|dummy\|fixture" src-tauri/src/
# returns nothing.

# 2. Only one HTTP client (reqwest), only used by live_quota.rs.
cargo tree -p ccbar | grep -iE "reqwest|hyper|surf|ureq"
# returns reqwest, scoped to one module.

# 3. Run it offline (the desktop reads still work; only live quota is gated).
CCBAR_LIVE_QUOTA=0 pnpm tauri dev
# bars stay empty, local token aggregates still render.

About this website

Static HTML, no analytics.

This page is static HTML hosted on a CDN. No analytics, no cookies, no tracking pixels. The fonts come from Google Fonts, which means Google sees your IP when this page loads — that's the only third-party request, and it goes away the day we self-host the woff2 files.