Headspare privacy policy

Headspare shows your AI subscription limits. Sign-in tokens stay on the device you signed in on and are sent only to that provider. Mac, iPhone and Apple Watch keep readings in your iCloud. If you pair a phone, sealed readings are meant to go through a relay. That relay is not deployed yet. The waitlist on this website is separate, and only if you join it. This page says what the apps read, where it is stored, and how to delete it.

Effective 25 October 2026. Applies to Headspare for iPhone, Apple Watch, Mac and Android, to this website, to the waitlist, and to the support email.

In short

• Headspare has no account of mine to create, no advertising and no tracking of you across apps or websites. The apps send crash and performance reports, and counts of actions such as sign-ins and feedback, to Sentry, with no name, email or token. Sentry is set not to store your IP address. The crash reports section lists exactly what.
• The Mac app and the iPhone app read quota numbers from accounts you sign in to on that device. Tokens stay in that device’s keychain and go only to that provider. If you use VibeProxy on the Mac, Headspare never sees those logins or tokens. The Apple Watch does not sign in and holds no tokens.
• Each device that signs in saves its readings in your own private iCloud database, one record per device. Your iPhone and Apple Watch read those records.
• Android does not sign in and cannot read iCloud. It is meant to pair with the Mac and read sealed readings from a relay on Cloudflare. That relay is not deployed yet. It is built so it does not hold the key.
• I cannot read that iCloud data. Apple does not show private iCloud data to developers.
• Account names are hidden on screen by default, but the real names are still stored in your iCloud and on your devices.
• The website waitlist is optional. If you join, the form sends your email address, the platforms you tick and your consent straight to Brevo, which stores the list. Nothing is added until you click the confirmation link in an email. Nothing from the apps goes there.

Who I am

Headspare is made by Mike Zamayias, an individual developer. I am the controller of personal data processed through the apps, this website, the waitlist and the support email, and the person responsible for this policy.

Email: support@headspare.app. No phone number and no street address are published here.

What Headspare reads

On the Mac: direct sign-in

In Settings, Accounts, you can sign in to Claude, Codex, Antigravity, xAI or GitHub Copilot directly. Headspare signs in the way the providers’ own coding tools do.

• Claude and Antigravity open the provider’s sign-in page in your browser. The page sends you back to Headspare on 127.0.0.1, your own Mac, with a one-time code. Headspare trades that code with the provider for tokens. Codex, xAI and GitHub Copilot show you a code instead. You enter the Codex code on auth.openai.com, the xAI code on x.ai, and the GitHub Copilot code on github.com.
• Headspare stores the tokens, the provider, and the email or name the provider reports in your Mac’s keychain. They stay on this Mac and are not synced to iCloud or other devices.
• When the access token expires, Headspare asks the same provider for a new one with the stored refresh token. GitHub’s token does not expire, so Headspare keeps it until you remove the account or GitHub rejects it.
• To read your limits, the Mac app sends each token only to the provider it belongs to: api.anthropic.com and platform.claude.com for Claude, auth.openai.com and chatgpt.com for Codex, Google’s googleapis.com addresses for Antigravity, auth.x.ai and grok.com for xAI, and github.com and api.github.com for GitHub Copilot.
• What comes back is quota information and the account’s email, name and plan.

On the Mac: VibeProxy

Instead of signing in, or as well, you can point Headspare at VibeProxy. The Mac app talks to VibeProxy, a separate app that holds your AI subscription logins. It connects only to the address 127.0.0.1, which is your own Mac, and never leaves it.

• From the folder you choose (normally .cli-proxy-api in your home folder), it reads two files: management.key, which lets it talk to VibeProxy, and merged-config.yaml, which gives VibeProxy’s port.
• It asks VibeProxy for the list of accounts: the provider, the email or label, and the account status.
• For each account it asks VibeProxy to run that provider’s quota request. VibeProxy attaches the login token itself. The token is never passed to Headspare.
• What comes back is quota information: how much of each limit is used, when it resets, the plan name, and short notes such as “Extra usage disabled”.

For VibeProxy accounts, the requests to Claude, Codex, Antigravity and xAI are made by VibeProxy, using your own accounts, in the same way as VibeProxy’s own quota page.

For sign-in, Headspare connects to the providers you sign in to directly, on the Mac or the iPhone, and to VibeProxy on your Mac when you use it. Sign-in tokens are sent only to the provider they belong to. They are not sent to a Headspare server. Readings on the Mac and the iPhone also go to your iCloud. A paired phone is meant to send sealed readings to the relay once that relay is deployed. Nothing is sent there yet.

Headspare does not read your prompts, conversations, code or other files. The Mac app refreshes when it opens and then every 30 minutes while it runs.

On the iPhone: direct sign-in

In Settings, Accounts, you can sign in to the same providers on the iPhone. No Mac is required for those accounts.

• Codex, xAI and GitHub Copilot show you a code. You enter the Codex code on auth.openai.com, the xAI code on x.ai, and the GitHub Copilot code on github.com. Claude and Antigravity open the provider’s sign-in page and send you back to Headspare on your iPhone.
• Headspare stores the tokens, the provider, and the email or name the provider reports in this iPhone’s keychain. They stay on this iPhone only. They are not synced to iCloud, to the Apple Watch, or to any other device, and they are sent only to the provider they belong to.
• The iPhone saves the readings to your private iCloud as its own record, one record per device, named source- followed by that device’s id. Other devices read that record. They do not receive the tokens.

On Apple Watch

The Watch reads what your Mac and iPhone saved to your iCloud. It does not sign in, hold tokens, or connect to VibeProxy or to any AI provider.

The one-time unlock is bought through Apple’s App Store. Apple handles the payment, and I do not receive your name, email or payment details. The app checks with the App Store whether this Apple Account owns the unlock, and stores that yes or no on the device so widgets can read it. When the iPhone confirms a purchase, it also writes an unlock record to your private iCloud database so the Mac can see it. That record holds the platform, the time of the unlock, the App Store original transaction ID and the product ID. The iPhone removes the record if the App Store revokes the purchase.

On Android, and the relay

Android does not sign in to the providers and does not read iCloud. The plan is to pair it with the Mac. The Mac will seal the readings with a key that stays on your devices and send the sealed bytes to a relay. The relay is a Cloudflare Worker, and it is not deployed yet, so nothing is sent there now. When it is, the phone will download the sealed bytes and open them on the phone. The Android app uses Google’s AndroidX libraries. It has no advertising code. It sends crash reports and counts of actions such as pairing and feedback to Sentry, as the crash reports section describes.

• When the relay is deployed, for that pairing it will store the sealed bytes, the phone’s name (its device name, or the model if it has none), whether the device is the Mac or a phone, and a SHA-256 hash of a device token. It will not store the key. It will not store sign-in tokens. Without the key, the sealed bytes are not the limits, the account names or the emails.
• A paired iPhone will be able to send its own sealed readings to the same relay. Its sign-in tokens stay in the iPhone’s keychain.
• History items on the relay will be removed after 30 days. A pairing with no activity for 30 days will be deleted. Remove, on the Mac, will delete that phone from the relay. Unpair All will delete the pairing.
• The channel database is built without your IP address. When the relay is deployed, Cloudflare will run the Worker and may keep connection logs, including an IP address, to run the service, as it may for this website.

Android is meant to use the same one-time price, US$4.99. That Play Billing purchase is not built yet, so the Android app does not charge.

Where it is stored

Headspare does not store VibeProxy’s management key or any VibeProxy token. It reads the key from your folder at each refresh and keeps it only in memory while the request runs. The only tokens it stores are those of accounts you sign in to directly, in the keychain, as above.

Hidden account names

Headspare shows “Claude 1”, “Claude 2” instead of emails until you turn names on. Hide Account Names is on by default, and the setting syncs between your devices through iCloud.

This hides names on screen, in widgets and on the Watch. It does not remove them from storage. The iCloud snapshot and the on-device copies still hold the real email or label so that you can switch names on at any time. They sit in your own iCloud and on your own devices, as described below.

Who can access it

• You, and anyone who is signed in to your Apple Account, can access the iCloud data. Only you can read your private iCloud database by default.
• Apple runs iCloud, so the data is stored on Apple’s systems under your Apple Account and Apple’s terms. Private iCloud data counts toward your iCloud storage.
• I cannot read your iCloud data. Apple’s documentation says data in a private database is not visible to the developer. The relay is not deployed. When it is, I still will not have the key, so I will not be able to read the sealed bytes. There is no Headspare account. The waitlist and the support email are the other places I hold something you typed, described below.
• The AI providers receive the sign-in and quota requests for accounts you sign in to directly, with that account’s token, as they would from their own coding tools. They handle them under their own terms and privacy policies. Headspare sends them nothing else.
• Cloudflare hosts this website, forwards mail sent to support@headspare.app and mike@headspare.app to my inbox (Cloudflare Email Routing), and will run the relay for paired phones once I deploy it. The relay section says what that will store.
• Brevo receives the waitlist form, stores the list and sends the confirmation and release emails, as described in the waitlist section. It also delivers mail I send from support@headspare.app.
• Google runs the Gmail inbox that receives the support and feedback email, as described in the support email section.
• Sentry (Functional Software, Inc.) receives the crash and performance reports, as processor, as described in the crash reports section.
• VibeProxy handles its logins and quota requests as it does without Headspare. It receives nothing from Headspare except the quota requests it runs for you.

Crash and performance reports (Sentry)

I do not sell or share your data. The apps contain no advertising or tracking code. They include one third-party library, Sentry, which sends the crash and performance reports described below. Their privacy manifests declare crash data, performance data, other diagnostic data and product interaction, none linked to you and none used for tracking.

If you choose to share app analytics with developers in your device’s Apple settings, Apple may give me anonymous crash and usage statistics. I do not control or receive anything beyond what Apple provides.

The apps also keep crash and hang reports on the device. Watch crash records go to your paired iPhone. Those copies stay on your devices unless you share them yourself. Separately, the apps send the reports below to Sentry.

• Who. Sentry (Functional Software, Inc.), as processor. The data is stored in its EU region, in Frankfurt, Germany. Sentry’s data processing terms cover transfers outside the EEA.
• What.
  • Crashes, app hangs and Android “app not responding” reports, with the code location and the app and OS version.
  • Apple’s diagnostic reports from iPhone and Mac.
  • How long the app takes to start and draw screens.
  • How long requests to the AI providers take, with the address but no query string, headers or body.
  • Counts of actions such as sign-ins, reads, publishing, pairing and feedback, each tagged only with the platform, the app version and, where relevant, the provider name.
  • Device model, OS version, locale and screen size.
  • A random number created when the app is installed, used only to count sessions that did not crash.
• Not sent. Your name, email, account names, sign-in tokens, quota numbers, a device identifier tied to you, screenshots, screen contents, or what you type. The Sentry project setting “Prevent Storing of IP Addresses” is on, and the apps strip the IP field before sending.
• Purpose and legal basis. To find and fix crashes and slow screens. The basis is my legitimate interest in keeping the apps working (GDPR Article 6(1)(f)). The data is not used for advertising or profiling.
• Retention. Sentry deletes crash and performance reports within 90 days.
• Choice. Reports carry no identifier tied to you, so I cannot find or delete one person’s reports. To stop sending them, delete the app.

Support and feedback email

This applies if you write to support@headspare.app or mike@headspare.app, including with Send Feedback in the apps. Cloudflare Email Routing forwards both addresses to my Gmail inbox.

• What is stored. The message, your email address, any name you include, and my replies.
• Purpose. To answer support and privacy requests and to read feedback.
• Legal basis. My legitimate interest in answering you, GDPR Article 6(1)(f). If your message is a request about your rights, also Article 6(1)(c), because I must answer it.
• Retention. I keep the conversation while it is open and up to 24 months after. Then I delete it, unless I need it for a legal claim.
• Processors. Cloudflare for the routing and Google for the Gmail inbox. Brevo delivers mail I send from support@headspare.app.

Waitlist (website)

This applies only if you join the waitlist on headspare.app. The apps never send anything to the waitlist. Mac, iPhone and Android are not available to download yet.

The form on this website sends your details straight to Brevo. They do not pass through a Headspare server, and Cloudflare no longer stores the list. The Worker that runs this website no longer receives the form.

To leave the list, use the unsubscribe link in any release email. To change the platforms you chose, to leave before any release email, or to have your address deleted, email support@headspare.app.

• What is sent and stored. Your email address, the platforms you tick (Mac, iPhone, Android, or a mix) and your consent. Brevo's servers also see your IP address when the form is sent. The form also sends its language (English). A hidden field is there for bots. If it is filled in, the form is not accepted. The form does not ask for your name.
• Double opt-in. Signing up is double opt-in. Brevo emails you a confirmation link, and nothing is added to the list until you click it. If you never click, the address is not added to the list. Brevo keeps a log of the attempt and of the confirmation email, and deletes email delivery logs within two months. Brevo records the time of the signup, the form used, the confirmation email and the time you confirmed.
• Purpose. One email for each platform you chose, when that app is released, plus the confirmation email. Nothing else.
• Legal basis. Your consent, GDPR Article 6(1)(a). The consent box has to be ticked, and the form asks you to tick at least one platform. You can withdraw consent at any time.
• Withdrawal and deletion. You can withdraw your consent at any time. That does not affect emails already sent. The unsubscribe link in any release email stops all emails at once. Brevo then keeps your address on its unsubscribed list, so you are never emailed again. That entry is all that is kept, and it is kept only to honour the unsubscribe. To have it deleted completely, email support@headspare.app and name the address. I delete it in Brevo and write back to confirm. If the request comes from a different address, I send that confirmation to the address on the list.
• A copy or a correction. The same email gets you a copy of what is stored about you, or a correction of the address.
• Retention. I delete the address in Brevo after I have sent the release email for every platform you ticked. If I have not done that within 24 months, I delete it then. You can ask sooner. Brevo deletes email delivery logs within two months, including those of signups that were never confirmed, and stores no copies of the emails. If you unsubscribed, the unsubscribe entry stays until you ask me to delete it, as described above.
• Processor. Brevo (Sendinblue SAS, France) stores the list and sends the emails, as processor. Brevo may transfer data outside the EU, to the United States and India, under the EU standard contractual clauses or the EU-US Data Privacy Framework. Cloudflare hosts this website and may keep connection logs, including an IP address, to run and secure it, under its data processing terms. It does not receive the form. Brevo is the only processor for the waitlist. Other processors named on this page cover the apps and the support email.
• Cookies and tracking. This website sets no cookies and loads no analytics, advertising or other trackers. It loads nothing from Brevo. The only contact with Brevo is the form you submit. Without JavaScript, the form is replaced by a link to Brevo’s own sign-up page, which is Brevo’s website and loads Brevo’s own files. After you confirm, Brevo sends you back to this site, and a script on the page reads the result in the address so it can show a message. Nothing is kept in your browser. The emails from the list are sent by Brevo with anonymous tracking. Brevo counts how many emails are opened and how many links are clicked, as totals only, with no record of which person opened or clicked. The logo in the emails loads from Brevo's servers, so if your email app shows images, opening the email contacts Brevo. Links in the emails pass through Brevo first, for security, before they open the page.
• Other use. I do not sell the list or share it, except with Brevo as processor.

Retention and deletion

Headspare keeps your snapshot until the next refresh replaces it, and keeps usage history until you delete it. History is not trimmed by age, so it grows by one sample per limit every 30 minutes while the Mac app runs. Each day takes roughly 20 KB.

Headspare has no in-app delete button. To remove everything, do these steps in this order. The order matters, because a running Mac or iPhone app writes to iCloud again within 30 minutes.

1. Remove direct accounts on the device you signed in on. On the Mac or the iPhone, open Settings, Accounts, and choose Remove for each account. This deletes its tokens from that device’s keychain. The Apple Watch holds none. Deleting the app does not remove keychain items.
2. Quit Headspare on your Mac (Quit, at the bottom of the panel), and close it on the iPhone if it is installed.
3. Delete the iCloud data. On iPhone: Settings, your name, iCloud, Manage Account Storage, Headspare, Delete Data. On Mac: System Settings, your name, iCloud, Manage, Headspare, Delete Data. Deleting it removes the snapshot and history records for all your devices.
4. Delete the Mac files. Move the Headspare app to the Trash. Then delete the folders ~/Library/Containers/com.mikezamayias.headspare and ~/Library/Group Containers/DW97QZ7F3B.com.mikezamayias.headspare. Moving the app to the Trash does not remove them.
5. Delete the iPhone and Watch apps. Deleting the app removes its on-device cache, widgets and complications.

To end Headspare’s access on the provider’s side as well, sign out of its sessions or revoke its access in your provider account settings, where the provider offers it.

The data in a backup of your device or iCloud is held by Apple under your Apple Account and is removed as those backups expire.

The iPhone and Android apps have a Send Feedback item. On iPhone it is in the app icon menu and in Settings. On Android it is in the app icon menu and in the menu that holds Accounts. If you send feedback, you send it yourself from your own mail app to support@headspare.app. It includes the app details listed on the feedback screen when that switch is on.

Your rights

Apart from the waitlist, the support email and the crash reports, I do not receive your sign-ins or your iCloud data. The relay is not deployed. When it is, I would hold the sealed bytes and the phone’s name, and I would not be able to read the sealed bytes. For the waitlist or the support email, write to support@headspare.app and I will give you a copy or delete it. I cannot look up crash reports, as the crash reports section explains. You control the iCloud data and the on-device tokens with the steps above.

If you are in the European Union or the United Kingdom, you have the rights set out in data protection law, including access, correction, erasure, restriction, portability and objection. Where I rely on your consent (the waitlist), you can withdraw it at any time. Where I rely on legitimate interest (crash reports, support email), you can object. Write to me at the email below and I will answer within one month. You can also complain to your national data protection authority. My supervisory authority is the Hellenic Data Protection Authority (HDPA), www.dpa.gr, Kifisias 1-3, 115 23 Athens.

Children

Headspare is a tool for people who pay for AI subscriptions and is not aimed at children. It has no accounts, no chat, no user content and no web browsing. I do not knowingly receive any data from children. The apps do not send me sign-in tokens. A paired phone will be able to send sealed readings to the relay once it is deployed, and I will not be able to read them. If a child’s email is on the waitlist, write to me and I will delete it.

Changes

If the apps change what they read or where they store it, or if this website changes what the waitlist stores or where, I will update this page and its effective date before that change. I will describe material changes in the release notes of that version and on this website.

Contact