Privacy policy

Who makes this app

OpenRouter Monitor is developed by Adam Godsall and published under Godsall.dev. It is not affiliated with or endorsed by OpenRouter. This policy describes version 0.2.0.

Adam Godsall is responsible for personal information received through app support. For support or privacy requests, email adam@godsall.dev.

Your API key

When you choose Settings → General → Validate & Save, the app sends your key directly to OpenRouter over HTTPS to validate it and check access to account analytics. A successfully validated key is saved in Apple Keychain and read into memory for authenticated requests.

The secret key is not written to the app’s local JSON data file or exports. A SHA-256 fingerprint of the key is saved locally to recognise credential changes. Cached account data can also contain key names, labels and identifier hashes; these are not the secret keys.

Settings → General → Remove Key deletes the saved Keychain credential and stops authenticated monitoring. It leaves cached usage and key metadata on the Mac. To revoke the key itself, use your OpenRouter account.

Connections to OpenRouter

The app makes HTTPS requests directly to OpenRouter to retrieve current-key usage and limits, account credits, grouped model and provider activity, account key metadata, and the model catalogue and prices. Authenticated requests include your API key. Account credits, activity and the key list require a management-capable key.

The app only reads this information. A management key can have wider permissions at OpenRouter, so only use a key for an account you are authorised to access.

The public model catalogue is retrieved without a key, including when you open Settings or track model prices. Searching and selecting models happens locally; the search text is not sent to OpenRouter as a search query.

The app retrieves usage metadata, not prompt or response text, and does not submit AI generation requests. OpenRouter receives your requests and connection information, including your IP address. Its handling and retention of that information are explained in OpenRouter’s privacy policy.

Information stored on your Mac

The app stores settings and cached account information in an OpenRouterMonitor/state.json file within its macOS Application Support location. This can include:

• Display, currency, exchange-rate and refresh settings; budgets and notification preferences.
• Key profile details, validation dates and the credential fingerprint.
• Usage and balance snapshots, reporting dates, spending and key limits.
• Grouped model and provider activity, request totals and token counts.
• Key names, labels, identifier hashes, usage, limits, expiry and disabled status.
• Tracked models, cached prices, detected model changes, refresh timestamps, errors and alert state.

This is a local JSON file, not a Keychain item. Treat it as potentially sensitive account information. The app keeps up to 500 usage snapshots and 100 model-change records during normal updates. Cached activity and key lists are replaced after a successful refresh and may remain when a refresh fails.

Retention, export and deletion

There is no automatic deletion period for the local data file, recovery copies or files you export. An unreadable data file may be preserved as a state.recovered-…json file beside the original.

To remove local data:

1. Use Settings → General → Remove Key to remove the saved credential, if required.
2. Quit OpenRouter Monitor.
3. Delete its OpenRouterMonitor/state.json file and any recovery copies from Application Support. For the direct-download build, this is normally ~/Library/Application Support/OpenRouterMonitor/. The sandboxed Mac App Store build uses Application Support inside its app container.
4. Delete any exports separately from the locations where you saved them.

Email adam@godsall.dev if you need help locating the app’s data. Removing the app alone may leave its saved credential or local files behind. Deleting local data does not erase information held by OpenRouter or Apple.

Settings → System & Data → Export JSON… saves the local state to a location you choose. It excludes the secret Keychain credential but can include the fingerprint, key metadata, balances, budgets and activity. Exports are not uploaded automatically. Review and redact them before sharing.

Notifications and keep awake

Notifications are created locally through macOS, with your permission. They may show spending projections, key names, remaining limits or model changes. Control them in the app’s Budgets & Alerts settings and macOS notification settings.

Keep-awake features use macOS power-management services. The optional battery cutoff reads power-source status and battery capacity locally. Sessions, display and battery options, and battery readings are not saved in the JSON data file or sent by the app’s API client. Keep awake starts off after relaunch.

Analytics, Apple and this website

The app contains no advertising or third-party app telemetry SDK, and no automatic upload to a developer support or analytics service. Model analytics displayed in the app are information retrieved from your OpenRouter account.

Apple handles App Store downloads, purchases and any system diagnostics you choose to share under Apple’s privacy policy. This is separate from the app’s local storage and direct requests to OpenRouter.

Opening the OpenRouter dashboard takes you to its website in your browser. Visits to Godsall.dev, including this policy, are covered by the website privacy policy. Optional website analytics depend on your cookie choices and are separate from the Mac app.

Support messages and your rights

If you email for help, Adam receives your email address and the information you choose to send. This is used to answer your request and resolve app issues, on the basis of legitimate interests in providing support. The email provider processes the messages to deliver and store that correspondence.

Routine correspondence is normally kept for up to 24 months after the last substantive contact, in line with the website privacy policy. It may be kept longer for an ongoing matter or where needed to meet legal obligations. Please do not send secret API keys or unredacted account exports.

You can ask for access to, correction or deletion of personal information you have sent, or object to its use, by emailing adam@godsall.dev. Applicable rights and exceptions depend on your circumstances. Adam cannot remotely access or delete the app’s local files or information held in your OpenRouter account.

The website privacy policy also explains service providers, international transfers and data-protection rights. You may raise a concern with the UK Information Commissioner’s Office.

Changes to this policy

This policy will be updated when the app’s data handling changes. The date at the top identifies the latest revision. Each app has a separate privacy notice.