Notchy Privacy Policy

Notchy collects no personal data. There are no accounts of ours, no servers, no analytics and no advertising. Your sessions and your API keys live only inside your phone and go into no backup; the only requests the app makes go straight to Anthropic, OpenAI, GitHub and DeepSeek, without passing through any middleman of ours. The app does include optional one-time purchases, which Google Play processes; Notchy never sees your payment details.

Notchy is an Android app that shows how much quota you have left on Claude, ChatGPT, Codex and GitHub Copilot, plus what you have spent on the paid APIs of Anthropic, OpenAI and DeepSeek: a percentage, when the window resets, and little else, in the app, in a widget, in the quick settings tile and in a couple of overlays on top of the screen. This policy explains which credentials the app touches, where it keeps them, which servers it talks to, what happens if you buy something inside it, and what happens when you uninstall it.

The app is published by Osuna Labs. You can reach us at emilianoos.dev@gmail.com.

What information is collected

None. Notchy does not ask you to sign up with us, does not generate user identifiers, does not measure how you use the app, does not report crashes, and does not send information about you to anyone, neither to us nor to third parties.

This is not a hard promise to keep: there is no Osuna Labs server. Even if we wanted your data, there would be nowhere to put it. The app is made of screens, a local store, and direct requests to the providers you already use.

If you choose to buy something inside the app, Google Play handles the payment and Google is who receives your billing details, never us. This is explained under Purchases inside the app.

Your sessions and your keys

To tell you how much quota you have left, Notchy has to ask each provider as if it were you. There are two ways of getting that, depending on the provider, and neither involves us seeing anything.

Signing in to Claude, ChatGPT, Codex and GitHub

When you add one of these, the app opens a window with the provider's real sign-in page — claude.ai/login, chatgpt.com/auth/login or github.com/login — inside a WebView. You type your details there, on the provider's own site, with their form and their certificate.

Notchy does not see, read or store your email, your password or your verification code. It does not inject code into that page and does not take part in the form. The only thing the app checks, when you are done, is whether the session cookie it needs to ask about your quota is now there.

When you sign in, the provider leaves its cookies in the app's WebView cookie store, which lives in Notchy's private storage, where no other app can read them. When it asks about your quota, the app hands each site back its own cookies, exactly as a browser would. To Claude it sends only the two it needs, sessionKey and lastActiveOrg. To ChatGPT, Codex and GitHub it sends that site's whole cookie header, because their endpoints rely on more than one and we would rather send what works than guess. In every case the cookies go back to the very site that set them, never to any other host and never to us.

API keys

For paid API spend (the Anthropic console, the OpenAI platform and DeepSeek) there is no web login: you paste an admin key and set a monthly budget, and the app works out the percentage spent against that budget. DeepSeek has no spend endpoint, so there the percentage comes from subtracting the balance it reports from the budget you set. That key is saved in the app's local store and sent in the header of the request to the matching provider, and nowhere else.

Worth stating plainly: the key is stored as plain text in Notchy's private storage, just like the session cookies. What protects it is the app sandbox, which stops other apps from reading it. On a phone with an unlocked bootloader or with root access, that protection is not absolute. You can delete the key from within the app whenever you want.

Which servers Notchy talks to

Four, and always to ask about your own usage:

• Anthropic: claude.ai/api/organizations/…/usage and, if you set up the API, api.anthropic.com/v1/organizations/cost_report.
• OpenAI: chatgpt.com/api/auth/session, chatgpt.com/backend-api/wham/usage for ChatGPT, chatgpt.com/backend-api/codex/usage for Codex and, if you set up the API, api.openai.com/v1/organization/costs.
• GitHub: api.github.com/copilot_internal/user, the same endpoint the editor itself queries to find out your Copilot quota.
• DeepSeek: api.deepseek.com/user/balance, and only if you set up its API key. It is the balance left on your account, not a record of what you did with it.

Each request carries that provider's cookies or your key, plus the User-Agent of the app's WebView, and nothing else: no conversations, no prompts, no code, no identifier of ours. For ChatGPT and Codex it also carries the access token and account id that chatgpt.com/api/auth/session hands back; both are OpenAI's own and travel only to OpenAI. What comes back is percentages and reset dates.

That traffic goes straight from your phone to the provider. It passes through no intermediate server, ours or anyone else's. What happens to those requests on Anthropic's, OpenAI's, GitHub's and DeepSeek's side is governed by their own privacy policies, exactly as when you open their sites in a browser.

Notchy only queries the providers you have added. One you never set up, or removed from the list, is not asked.

There is one more party, and only because of the purchases: the app asks Google Play for the price of each product in your currency and for what you have already bought, so it knows what to unlock. That query contains nothing about your usage, your sessions or your keys. It is governed by the Google Privacy Policy and is covered in detail below.

What Notchy stores on your phone

Everything lives in a single preferences file inside the app's private storage, plus the WebView cookie store. What is in there is this:

• The session cookies of the providers you signed in to, and the API keys you pasted, with their budget.
• The last usage reading: per provider, the percentage used, the reset date and the plan label. That is what lets the widget show something before it finishes refreshing.
• A seven-day history with each day's peak usage, which is what draws the "your week" bar. It is seven numbers per provider, with no time of day and no detail of what you did.
• Your settings: which alerts you want, how often to refresh, the order of the providers, which overlays are on and on which side.
• The identifier of the products you bought, if you bought any, so we do not put a lock back on something you already paid for.

None of it syncs to us, because there is nowhere to sync it to.

The overlays: the notch and the edge tab

Notchy can draw your usage on top of other apps: a pill around the camera cutout and a tab at the edge of the screen. For that it needs the display over other apps permission, which you grant by hand from the system settings and can take back just as easily.

That permission is only good for drawing, never for reading. Notchy does not see which app you have open, what is on your screen, or what you type. It is not an accessibility service and does not ask for that permission. The only thing the overlay shows is the number the app already has.

While an overlay is on, the app keeps a foreground service running, which is what Android requires in exchange for being allowed to draw continuously. That is why you see a permanent notification: it is not telemetry, it is the system's requirement.

Alerts and alarms

You can ask Notchy to warn you when you cross 80 % of a window, fifteen minutes before it resets, or right when it resets. Those alerts are worked out and scheduled inside your phone, with the system clock; they do not arrive from any push notification server, ours or Google's.

For that the app asks for the notifications permission and the exact alarms one, without which the system batches the alerts and they arrive late. If you turn on real alarm mode, Notchy asks your clock app to create an alarm; the only thing it hands over is the time and a short piece of text.

Background updates

So the widget and the tile do not show a stale number, the app repeats the query every so often through Android's scheduler, and only when there is a network. It is the same request described above, to the same provider server. If you turn the refresh off or sign out, the requests stop.

Purchases inside the app

Notchy is free and works without paying anything: with one provider connected you get the whole app, with its alerts, its widget and its overlays. Two optional things do cost money:

• Notchy Pro, a one-time purchase that lifts the limit and lets you connect as many providers as you want. Without it you connect one, whichever you choose.
• Voluntary support, in four amounts that all unlock exactly the same thing as each other: nothing. It is a tip, not a feature.

All of them are one-time purchases. There are no subscriptions, no recurring charges and no advertising, and there never will be.

Who charges you and what they see

The payment is processed entirely by Google Play. Notchy has no payment gateway of its own and no server: the app opens the Play window and everything else happens outside it.

Notchy never sees or receives your card, your name, your email, your address or your billing details. Google handles that information under its own policy, and we have no access to it at any point. The only thing the app asks Play is the price in your currency and whether the purchase exists.

As the developer, Google gives us aggregate sales reports (how many purchases there were, in which country, for what amount) without identifying the people who made them.

What Notchy stores on your phone

Only the identifier of the products you own, in the app's private storage. It is a short list of text, along the lines of notchy_pro, and it exists so the app knows what to unlock without asking Play every time you open a screen. It carries no amount, no date, no payment method, and nothing that identifies you, and it never leaves the device.

Restoring what you bought

Your purchases are tied to your Google Play account, not to this phone. If you reinstall Notchy or switch devices, they come back on their own when you open the app; if they take a moment, there is a Restore purchases button in the settings. You do not need to write to us or keep any receipt.

Refunds and billing problems

Anything involving money (a charge you do not recognise, a refund, a payment that did not go through) is handled with Google Play, who holds the transaction. You can do it from your order history. If the problem is that you paid and the app did not unlock your purchase, write to us and we will look into it.

Backups

Notchy has Android's automatic backup switched off. Your session cookies, your API keys, your history and your settings are not uploaded to Google Drive or to any cloud, and they do not come out in a backup made over a cable either. They stay in the app's sandbox, on this phone and on no other.

That is a deliberate decision: these are credentials that give access to your accounts, and the safest place for them is the one device where you typed them. The trade-off is that if you change phones you will have to sign in again and paste your keys again.

This does not affect anything you bought: that lives in your Google Play account and comes back on the new phone, as explained above.

Children

Notchy is not directed at children under 13 and does not knowingly collect information from them. Since the app collects no personal data from any user, there is no children's information for us to hold. Claude, ChatGPT, GitHub and DeepSeek accounts have their own minimum ages, set by each provider.

Your rights and how to delete your data

Since we keep nothing on any server, there is no information of yours that we could hand over, correct or delete on request. The control is entirely yours:

• To disconnect a provider, sign out of it from within the app: Notchy deletes its cookies from the WebView store there and then.
• To remove an API key, delete it from its settings card.
• To delete absolutely everything, uninstall Notchy. When you do, Android wipes its private storage completely: sessions, keys, history, settings and the list of purchased products. Since there is no backup, nothing is left, not on the phone and not anywhere else.

One exception worth stating plainly: the record of your purchases lives in your Google Play account, not in our hands. Uninstalling the app does not erase it, and in fact that is what makes restoring them possible. We cannot delete it either. You manage that history with Google.

One point worth stating plainly: your Anthropic, OpenAI, GitHub and DeepSeek accounts still exist after you uninstall, and whatever those providers log about your visits is their business, under their policies. We cannot delete any of that, nor could we see it. Signing out in Notchy takes the app's access away; closing the account is done with the provider.

If you live in the European Union, the United Kingdom, California or Mexico, the applicable law grants you rights over your personal data. You can exercise them by writing to emilianoos.dev@gmail.com, although, as explained above, we hold no personal data of yours to act on.

Changes to this policy

If Notchy ever gains features that change any of the above — a new provider, a new permission, anything paid — we will update this page before releasing that version, and we will change the date in the header. We recommend checking back from time to time.

September 3, 2026. Accuracy corrections, with no change to what the app does. Codex and DeepSeek were being read by the app but were missing from this page: Codex is now listed among the web-session providers and DeepSeek among the API ones, with its endpoint and its fourth place in the list of servers. The paragraph about cookies said the app picked out only the ones it needed, which is true for Claude but not for ChatGPT, Codex and GitHub, where the site's whole cookie header goes back to that same site; it now says so. What was called a "browser identifier" is named for what it is, the WebView's User-Agent, and the token that ChatGPT and Codex send to OpenAI is now stated too.

September 2, 2026. First version, matching the release of Notchy 1.0: the providers by web session (Claude, ChatGPT, Codex and Copilot), the three optional API keys (Anthropic, OpenAI and DeepSeek), the overlays, the local alerts and the widget. It documents the one-time purchases (Notchy Pro and the voluntary support), processed by Google Play, and puts on record that Android's backup is switched off: the credentials do not leave the phone. No subscriptions, no advertising and no analytics.

Contact

Any questions about this policy or about how the app works:
emilianoos.dev@gmail.com