Privacy Policy — Limits for Android

Effective date: [EFFECTIVE DATE — TODO: set before publishing]

This policy describes what "Limits for Android" (package com.pgatesapps.limitsforandroid, published by pgatesapps) does with data on your device and what, if anything, leaves it. It is written to match the app's actual code as of the QA7 audit (2026-07-29); if the app's behavior changes, this document must change with it before the new version ships.

Summary

Limits for Android shows you usage/quota information for AI coding-assistant accounts (Claude Code, Codex/ChatGPT) that you connect yourself. The app:

• has no analytics SDK and no advertising SDK of any kind;
• has no backend server operated by the developer;
• talks only to the providers you explicitly connect, using your own OAuth credentials, plus one narrow DNS fallback described below;
• stores everything it caches locally, on your device, and nothing is uploaded to the developer.

What data the app caches locally, on your device

The app stores the following only in local, app-private storage on your device (Android DataStore/SharedPreferences, not a remote database):

• OAuth tokens for each provider you connect, encrypted at rest with an Android Keystore-managed AES-256-GCM key (hardware-backed on devices that support it). These are excluded from Android's automatic backup / device-transfer mechanisms.
• Account identifiers derived from the sign-in itself: for Codex, a ChatGPT-Account-Id value read out of your own OAuth token (a JWT) so requests can be addressed to the right account; no separate identifier is generated or transmitted by the app.
• Usage percentages and reset timestamps for each limit window the provider reports (e.g. session window, weekly window) — a number 0–100% and a reset time, refreshed periodically.
• Plan/subscription labels the provider reports about your own account (e.g. "Max 5x", "Plus"), shown for display only.
• Your own app settings — display preferences, notification thresholds, widget style, provider ordering — none of which is personal data beyond your own configuration choices.

None of the above is sent to the developer. There is no server of the developer's that any of this data passes through.

What leaves the device, and to whom

The app makes outbound network requests in exactly these cases:

1. To Anthropic (api.anthropic.com and related Claude Code OAuth/usage endpoints) — only if you connect a Claude Code account. Requests use the OAuth token you granted directly to Anthropic and read your own session/weekly usage and profile information. The app does not call any endpoint that would spend your quota or create new API keys, though see the caveat below.
2. To OpenAI (ChatGPT/Codex OAuth and usage endpoints) — only if you connect a Codex/ChatGPT account. Same model: your own OAuth token, used to read your own usage data.
3. To Cloudflare, conditionally — if, and only if, your network's configured DNS resolver fails to resolve a provider hostname, the app falls back to Cloudflare's encrypted DNS-over-HTTPS (DoH) service to resolve that hostname. This exchange carries only the hostname being looked up (e.g. api.anthropic.com) — never your tokens, account identifiers, or usage data. This fallback does not run at all if your normal DNS resolution succeeds.

There is no other outbound traffic. In particular: the developer does not operate a server that any of this data is routed through or logged by; the app contains no analytics SDK, crash-reporting SDK with content capture, or advertising SDK; nothing is sold, and nothing is shared with any party other than the two providers above (and, conditionally, Cloudflare for DNS resolution only) — and only because you asked the app to connect to your own account with those providers.

Important caveat about the OAuth grant

When you connect a provider account, you authorize the app with an OAuth scope defined by that provider (not by this app). This app's own code today only calls read-only usage and profile endpoints. However, the scope you grant may technically permit broader actions than this app's current code uses — the authorization itself, not just this app's present behavior, determines what is technically possible with the token. Disconnecting an account inside this app deletes the locally stored token but does not revoke the authorization on the provider's side. To fully revoke access, visit the provider's own account/security console:

• Anthropic: the Anthropic Console, under your account's connected apps/authorizations.
• OpenAI/ChatGPT: your OpenAI/ChatGPT account settings, under connected apps.

Disconnect, uninstall, and retention

• Disconnecting a provider in the app (Settings → Accounts) deletes that provider's token and cached usage data from local storage immediately. It does not revoke provider-side authorization — see above.
• Uninstalling the app removes all of its local state, including tokens, cached usage, and settings, because Android deletes an app's private storage on uninstall and this data is excluded from backup, so nothing is restored on reinstall or on a new device via backup.
• Retention while installed: cached usage data is retained until the next successful refresh, at which point it is overwritten with the newer reading, or until you disconnect that provider or uninstall the app. There is no server-side copy to separately retain or delete, because there is no server.

What this app does not do

• No analytics or telemetry SDKs.
• No advertising SDKs, ad identifiers, or ad personalization.
• No location access, contacts access, or media library access.
• No developer-operated backend that usage data, tokens, or account identifiers are routed through, logged by, or stored on.
• No selling or sharing of data with third parties for their own purposes.

Unofficial API caveat

The usage figures shown by this app are read from endpoints that Anthropic and OpenAI use for their own official tools but do not publicly document or guarantee as stable APIs. They may change or stop working without notice, which could cause the app to show stale or missing data, or to require a reconnect. This does not change what data the app collects or where it sends it — it is a reliability caveat, not a privacy one.

Children's privacy

This app is not directed at children and does not knowingly collect data from children. It requires a paid Claude Code or ChatGPT/Codex developer account to do anything beyond viewing this policy and the app's static UI.

Changes to this policy

If what the app collects, caches, or transmits changes, this document will be updated and the effective date above will change accordingly. Material changes will be reflected in the app's release notes.

Contact

Questions about this policy or your data can be sent to: [developer email — TODO: fill in before publishing].