StatuslineData processed locally
The desktop companion starts the locally installed Codex App Server and reads only the fields needed to show usage windows, reset times, account type and plan. It does not read, copy or store Codex access tokens, API keys, prompts, source code or conversation content.
A manually selected Codex executable path stays in the computer's local application configuration and can be cleared from Source Settings.
Companion 0.1.22 requires manual opt-in for Antigravity. Companion 0.1.23 automatically discovers installed Desktop/AGY CLI sources, preferring Desktop on first discovery and remembering the source. Existing explicit selections and disabled services are preserved; you can disable discovery or select another source in Settings. There is no automatic account failover. Only Google weekly/five-hour quota reaches the interface. Desktop account-status fields are checked in memory to confirm a signed-in subscription and discarded; Claude/GPT buckets are also discarded. The vendor runtime manages its own authentication and requests to Google. Statusline does not extract or copy Google tokens or API keys.
Only the selected source/path and discovery preference are persisted; quota stays in memory and transient runtime data is removed after collection. Remove service saves a disabled preference and stops collection without signing out of Google or changing Codex/mobile pairing. Antigravity quota is not relayed to mobile in this Companion-only release.
Universal encrypted relay
Sync is optional. Pairing creates an AES-256 encryption key on the desktop and transfers it directly to the mobile device with a short-lived, single-use credential. Publisher and reader credentials are role-separated and stored in the operating system secure store.
The relay receives a random channel identifier, SHA-256 hashes of random credentials, an opaque AES-256-GCM ciphertext and timestamps required for expiration and replay protection. It cannot decrypt the quota snapshot and never receives Codex credentials, email addresses, prompts or source code.
Optional push notifications
Periodic quota notifications are a separate opt-in for services present in your Companion: Codex, Google Antigravity and Claude Code. They alert after a reported exhausted 5h/weekly window actually recovers, or within the last hour before a weekly reset if at least 20% remains. Companion must be running and connected. It stores cycle timestamps, exhausted/warned flags and opaque queued events locally; no exact percentage is persisted in this alert tracker.
Quota alerts send the service, event/window type and delivery-expiration timestamp to the relay and FCM/APNs. These operational fields are not end-to-end encrypted; the unused-quota warning reveals its 20% threshold condition. Exact readings, account identity and vendor credit IDs are not sent in these alerts, and the relay does not persist their event content. Detailed quota snapshots stay end-to-end encrypted. Existing credit-only subscriptions are not automatically expanded. Turning off one category preserves the other; turning off all categories removes the installation registration. Opaque deduplication event records expire after at most thirty days or on channel deletion.
After pairing, you can opt in to a generic push alert when Companion detects a newly available Codex reset credit. The first complete reading is a baseline; later alerts are best-effort. Reset IDs, quota values and expiry times are not included in the push message. Opaque reset IDs stay in Companion memory and are never serialized to the relay; Companion persists only locally salted hashes for deduplication. The encrypted mobile snapshot carries the current count and available expiry times.
With your consent and OS permission, the mobile app sends a Firebase Installation ID (FID), a random device ID and your selected app language to the relay over HTTPS. The Worker encrypts the FID before storing it and decrypts it in memory to request delivery from Firebase Cloud Messaging. Google processes the FID and technical app/device metadata; iOS notifications are delivered through Apple Push Notification service. Turning all notifications off or disconnecting removes the relay registration and asks Firebase to unregister and delete the installation. Relay registration and event records expire with the paired channel after thirty days without publication. Provider-side deletion follows Firebase's retention process.
Firebase also processes technical platform and SDK diagnostics for service operation and quality. Firebase Analytics and Crashlytics are not included. This SDK operational measurement is separate from first-party behavioral analytics.
Notifications may be delayed or suppressed by device settings, network conditions, FCM or APNs. See Firebase's Android disclosure and Apple-platform disclosure.
QR scanning on Android
Camera frames and decoded QR contents are processed on-device. Statusline does not store or transmit them. The bundled ML Kit barcode component may collect device and app information, an installation identifier, API configuration, feature events, performance measurements and error diagnostics for Google's diagnostics and usage analytics. Statusline does not receive that telemetry.
Hosting, abuse prevention and logs
The Cloudflare deployment applies abuse limits using a SHA-256 digest of the source IP address. Neither the source IP nor that digest is written to the Statusline D1 database.
Persistent Worker invocation logs are disabled. Cloudflare may still process IP addresses and request metadata at its edge for delivery, security, abuse prevention, aggregate metrics and billing. The Statusline desktop and mobile applications contain no advertising SDK and no first-party product analytics SDK.
Desktop update checks
Starting with companion 0.1.17, the desktop checks the public GitHub releases of arvivares/statusline after startup and every six hours while running. Automatic checks can be disabled in Updates; manual checks remain available. Downloading and installing requires confirmation.
GitHub and its delivery network receive normal HTTPS request metadata, such as the IP address and a user agent. Statusline sends no Codex credentials, quota snapshots, pairing keys, account email or persistent device identifier. Preferences and the dismissed version stay in the local application configuration. These requests deliver software updates, not product analytics.
Website analytics
The public website at statusline.inmerzion.io uses Plausible at plausible.inmerzion.io to understand visits, referral sources, page engagement and clicks on external links and downloads. The integration does not set analytics cookies or persistent visitor identifiers. Browser requests include page and referrer URLs, IP addresses and browser information; Plausible uses this information to produce aggregate statistics. Do not put private information in website URLs.
This measurement applies only to the public marketing website, not to the desktop or mobile applications, their widgets, pairing flows, privacy/support/data-deletion pages or the relay's public pages. No Codex credentials, quota snapshots, pairing keys or conversation content are sent by Statusline to Plausible. Blocking analytics does not prevent use of the website.
See Plausible's data policy for its analytics processing model; hosting and operational logs of the Inmerzion instance are managed separately from the encrypted relay.
Retention and deletion
Pairing links expire after ten minutes. Channels expire after thirty days without a successful publication, and a daily task removes expired rows. Rate-limit state is scoped to 60-second windows and is not stored in the relay database.
Disconnecting the desktop attempts to delete the remote channel and removes its local credential. Disconnecting the mobile reader removes its local credential and encryption key.
See Delete Statusline data for step-by-step instructions and the complete retention details.
Questions
Email founder@inmerzion.io or use the Statusline support page for privacy questions or reports. Never include pairing links, QR codes, API keys, access tokens or private Codex configuration.