Privacy policy

Last updated October 20, 2026

This policy explains what Billfuse collects, why, who else handles it and how to delete it.

What we collect

• Invitations. If we invite you by email before you have an account, your email address and the date we invited you.
• Your account. When you sign in with GitHub, we receive your email address and the basic profile details GitHub shares at sign-in, such as your name, username and avatar. We use the email address to identify your account and to send your alerts. Our sign-in provider also records sign-in events, including the time, IP address and browser, for security.
• Billing. None during early access: Billfuse is free, and we don't collect any payment details.
• Provider keys. The OpenAI and Anthropic admin keys, OpenRouter management keys and Google Cloud service account keys you connect, and for Gemini the name of your billing export table. Each key is stored encrypted (AES-256-GCM). We keep its last four characters unencrypted so you can tell keys apart; for a Google service account we keep its email address instead.
• Usage data. Daily cost per model and billing line item, and daily token and request counts per model, read from your providers' usage and cost APIs.
• Your settings. Your budgets, which alerts we've sent, your Slack webhook (encrypted) if you add one, whether the weekly summary and automatic pausing are on, and, while spending is paused, which OpenAI projects and Anthropic API keys we paused (their IDs and names) and the spend limits they had before.
• Terminal and extension access. For each computer you authorize with npx billfuse login, and each browser where you sign in to the Billfuse Chrome extension: its name, when it was authorized and last used, and a SHA-256 hash of its access token. We never store the token itself.
• Logs. Our server records standard request logs, such as IP address, time and page. Our application logs record account IDs and error messages, for example when a provider rejects a key. We use both for security and debugging.

We don't use advertising or analytics trackers.

How we use it

• To sync your spend, show your dashboard and send the alerts and summaries you set up.
• To send your invite, if we invite you.
• To keep the service secure and to fix problems.

We don't sell your data, use it for advertising, or use your provider data to train AI models.

How we use your provider keys

Billfuse uses your keys to read usage and cost data from OpenAI, Anthropic, OpenRouter and, for Gemini, your Google Cloud billing export: on a schedule, and when you press Sync now. Only if you turn on automatic pausing or click Pause now or Resume, it also uses your OpenAI and Anthropic keys to change project spend limits and turn API keys off and back on. When you turn on automatic pausing, or connect a key while it's on, it also checks that it's allowed to by writing back one setting unchanged. A key is decrypted only on our servers while it is being used and is never sent back to your browser. These keys can do more than read usage, so treat them like passwords. You can disconnect a key at any time, which deletes it.

Who else handles your data

• Supabase stores our database and handles sign-in.
• OVHcloud hosts the server that runs Billfuse and its scheduled syncs.
• Resend sends our emails.
• GitHub handles sign-in.
• Slack, only if you add a Slack webhook: alerts are posted to that channel.
• OpenAI, Anthropic, OpenRouter and Google Cloud: we call their APIs with your keys to read your usage. For Gemini, that means running a query on your billing export in BigQuery, which Google may bill to your project.

How long we keep it

• Your account data is kept until you delete your account.
• When you disconnect a provider, its usage data is deleted. When you replace a key, data the new key doesn't cover is deleted once the new key's first sync succeeds.
• Invitations are kept until you ask us to remove them or delete your account.
• Records of what we paused are deleted when you resume, disconnect that provider or delete your account.
• Server and application logs are kept in size-limited files on our server. The oldest entries are deleted as new ones come in.

Deleting your data

In Settings → Account, Delete account permanently deletes your account, saved keys, usage data, budgets, alert history, Slack webhook, weekly summary setting, terminal and extension access, and any invitation for your account's email address. It can't be undone. Our providers may keep their own records, such as sign-in and email delivery logs.

To remove an invitation without an account, or to get a copy of your data, email support@billfuse.dev.

Cookies and local storage

We use cookies only to keep you signed in. Your light or dark theme choice is saved in your browser's local storage. There are no advertising or tracking cookies.

If you use the Billfuse Chrome extension, it keeps your Billfuse address, its access token, the latest spend summary and which budget alerts it has already shown you in Chrome's extension storage on your computer. It only talks to the Billfuse address you enter, and it can't read the pages you visit. Signing out deletes the token from the extension and revokes it on our side; if the extension can't reach us at that moment, revoke it in Settings under CLI access.

Security

Provider keys and Slack webhooks are encrypted at rest, terminal and extension tokens are stored only as hashes, and database access rules let each account read only its own data. No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you.

Children

Billfuse is for developers and isn't meant for anyone under 16.

Changes

If we change this policy in a way that matters, we'll update the date at the top and email everyone with an account.

Contact

For questions or requests about your data, email support@billfuse.dev.