# Mac 0.6.0 privacy and local storage

The utility launches its own compatible installed Codex helper and communicates over local stdio. It reads account identity, weekly allowance/reset and optional account-reported lifetime/latest-day token activity. It never reads chats, prompts, auth files, browser cookies, passwords or exported Keychain secrets. It does not submit account work or consume credits/resets.

Codex uses its own supported account/storage configuration. Healthy sign-in is tried without forced refresh. Limited managed-session recovery may refresh through Codex. An official browser sign-in starts only on the user's explicit request. Cancelling it does not log out Codex. External sessions are directed to their owning client.

Current readings remain in memory. A hashed effective account/workspace identity and quota samples are saved in ~/Library/Application Support/Team357 Codex Usage Utility/usage-history.json, capped at 14 days and 4,096 samples. A hash remains pseudonymous data; it is not uploaded. Theme/pin/mini/window state and an optional selected helper path are in the utility's macOS preferences domain. Team357 stores no credentials.

CPU, memory and mounted-volume readings use public macOS APIs, not privileged services. They are not uploaded. Shared APFS capacity and unified memory should not be summed as independent pools.

Manual update checks contact the fixed Team357 Mac feed and validated versioned HTTPS download location. The website receives normal request metadata, including IP address, the utility User-Agent and filename, but no account/usage readings. One bounded candidate is cached under ~/Library/Caches/com.team357.codexusageutility/Update. Failed partials are removed; unused old candidates expire after 14 days. No automatic updater daemon or login item exists.

Copy Connection Details writes a user-requested summary to the clipboard: versions, redacted helper-location category, stage, safe failure category, auth mode, recovery and optional-activity status. No emails, IDs, credentials, raw server errors, stderr or usage values are copied. No diagnostics file or upload is automatic. macOS can create its own crash reports under normal system policies; the utility adds no raw-payload exception logger.

Share supplies only the fixed public Utility Lab URL to the native share picker. The user chooses and sends. Live screenshots are not default share assets.

Uninstall keeps preferences/history by default. Explicit full removal also trashes owned support/cache directories and removes the utility preferences domain. The app, alias and trashed data remain recoverable until the user empties Trash. Codex, its sign-in/Keychain entries, other apps and unrelated aliases are not removed.