What Breakerbox stores — and what it never touches.

A plain-language summary of what the optional Breakerbox cloud dashboard collects. The library itself runs entirely on your machine — nothing leaves your environment unless you set report_to.

What we store (only if you use the dashboard)

• Your account — when you sign in with GitHub or an email magic link (via Supabase Auth), we store your email and basic profile (name, GitHub username, avatar).
• Run metadata — budgets, spend, savings, and the hop timeline: node names, model names, token counts, cost, side-effect flags, and trip reasons. Runs are private to your account by default; you can make one public to share it by link.
• A hash of your ingest key — only a sha256 hash is stored, never the key itself.

What we never store

• Your provider / LLM API keys — they are never sent to Breakerbox. Bring-your-own-key features call the provider directly from your browser.
• Your prompts or model outputs — the event stream records node / model / token / cost, not prompt or completion text.

Where it lives

Run data is stored in our Supabase database; the apps are hosted on Vercel. Access is row-level-security-scoped to your account.

Cookies

Only an authentication session cookie, to keep you signed in. No third-party advertising or tracking cookies.

Your control

You can delete individual runs, and request deletion of your account and data via GitHub Discussions. Prefer zero cloud? Don't set report_to — receipts stay on your machine.

This is a plain-language starting point, not legal advice — review and adapt it (and add a contact email) before relying on it.