Privacy Policy

Last updated: October 18, 2026

1. Introduction

Headroom (“the App”) helps you view usage limits or balance information returned by third-party AI service providers that you choose to connect: OpenAI/Codex, OpenCode Go, OpenRouter, and DeepSeek. This Privacy Policy explains how the App handles information when you use these connections.

2. Information We Handle

When you connect a provider, the App handles the credentials needed to request that provider’s information:

• OpenAI/Codex: The App uses OpenAI’s device authorization flow. You enter your password on OpenAI’s sign-in page, not in the App. The App receives and stores the resulting access token, refresh token, and account identifier, as well as the temporary device authorization information needed to complete sign-in.

• OpenCode Go, OpenRouter, and DeepSeek: You enter an API key for the provider you choose. The key is sent directly to that provider to retrieve usage or balance information and, if the request succeeds, is stored in the iOS Keychain on your device.

• Provider readings: The App receives provider-reported usage windows, balances, amounts, currencies, reset times, and related timestamps. Real readings may be cached locally on your device so they remain available between refreshes.

The App does not ask you to enter your provider password in Headroom. It does not create a Headroom account or send your credentials or readings to a Headroom-operated server. The App does not include analytics or advertising SDKs.

3. How Information Is Used and Shared

The App uses credentials only to connect to the provider you select, request the provider-reported usage or balance information, and display that information to you. Requests are sent directly from your device to the corresponding provider over HTTPS.

The provider receiving a request is OpenAI, OpenCode, OpenRouter, or DeepSeek, depending on the connection you choose. Each provider processes information under its own terms and privacy policy. The App does not control how a provider handles information it receives.

The App does not use your provider credentials to make AI model inference requests. However, API keys may have permissions beyond reading usage or balance information and may allow billable requests through the provider. Review the key’s permissions before connecting it.

4. Storage, Retention, and Deletion

Provider credentials are stored in the iOS Keychain on your device and are configured as device-only credentials, available while the device is unlocked. They are not synchronized through iCloud Keychain by the App.

Real provider readings may be stored in protected local app storage. The App excludes this cache from device backups. Demo readings are not saved to the real-reading cache.

When you select Disconnect for a provider, the App deletes that provider’s credential from the local Keychain and its cached reading from the App’s local storage. Disconnecting does not revoke a key, token, or authorization with the provider. Revoke it separately through the provider’s account controls if you want to invalidate it.

The App does not maintain a Headroom account or a developer-operated server containing your credentials or readings. Removing the App removes its local app data, subject to iOS behavior and any device backup or restore. Information already received by a provider is subject to that provider’s own retention and deletion practices.

5. Demo Mode

Demo mode displays sample values and simulated states. It does not make live provider requests, require an account or API key, or save sample readings to the real-reading cache. Demo values are illustrative and must not be treated as real account information.

6. Security

The App uses the iOS Keychain for provider credentials, direct HTTPS requests to fixed provider endpoints, and protected local storage for cached readings. No method of storage or transmission can guarantee absolute security. Keep your device and provider accounts secure, and do not share your API keys or sign-in codes.

7. Changes to This Policy

This Privacy Policy may be updated from time to time. The latest version and its effective date will be made available wherever this policy is provided.

8. Contact

If you have questions about this Privacy Policy, privacy requests, support, or feedback, please contact us at:

stephenlip@163.com