Privacy boundary

Only counts cross the line.

AIByCity is built around a narrow allowlist. Provider telemetry and local Codex session records are reduced to numeric counters before anything is sent.

What can leave your Mac

• Your selected city identifier.
• Provider and model name.
• Event time and numeric token counters.
• Pseudonymous Link, device and event identifiers.

What is rejected

• Prompts, responses and tool arguments.
• File paths, repository names and command content.
• Email addresses, account identifiers and IP-derived location.
• API keys, authentication tokens and raw OTLP envelopes.

The background collector skips content records and never uploads raw session files. Reading and deduplication happen locally on your computer.

How a contribution is counted

A server-issued Link bearer binds each numeric event to the selected city. The server stores only its hash, applies per-event and hourly safety limits, and rejects repeated event identifiers so a retry does not inflate a city total.