Privacy boundary

Only counts cross the line.

AIByCity is built around a narrow allowlist. Raw provider telemetry is filtered in memory before anything is stored.

What can leave your Mac

• Your selected city identifier.
• Provider and model name.
• Event time and numeric token counters.
• A pseudonymous device identifier, public key and batch signature.

What is rejected

• Prompts, responses and tool arguments.
• File paths, repository names and command content.
• Email addresses, account identifiers and IP-derived location.
• API keys, authentication tokens and raw OTLP envelopes.

How a contribution is counted

Each event receives a stable identifier and belongs to a signed batch. PostgreSQL rejects repeated batch and event identifiers, so a retry does not inflate a city total.