Privacy & data

What leaves your machine

Almost nothing. The server binds to 127.0.0.1 only. The app makes exactly one outbound request of its own: once a day it asks registry.npmjs.org for the latest claude-finops version, so it can tell you when an upgrade is out. That request sends nothing about you or your usage. To turn it off, set CLAUDE_FINOPS_NO_UPDATE_CHECK=1 or NO_UPDATE_NOTIFIER=1, or pass --no-update-check.

Provider cost APIs are only called if you add a key (on the Settings page or with --set-key), and only when you click Refresh on Billed vs local.

Three things change Claude Code’s own settings, and only when you click them: Install live warnings adds one hook to ~/.claude/settings.json, Start experiment on Subagent models adds CLAUDE_CODE_SUBAGENT_MODEL there until you stop it, and the Jev page installs TypeSafe’s plugin through claude plugin install and can save your Jev key there. Each keeps a backup of your settings first. The Jev plugin itself only talks to TypeSafe when an app you build calls it.

What it reads

Everything is read-only:

• Claude Code transcripts in ~/.claude/projects.
• If the Claude desktop app is installed: its Cowork transcripts and plan-usage-history.json, from ~/Library/Application Support/Claude (macOS), %APPDATA%\Claude (Windows) or ~/.config/Claude (Linux).

Where your data lives

Everything the app writes lives outside the install folder, in one state directory:

~/.claude-finops/
  data/finops.db          SQLite warehouse (your prompt text)
  data/cloud_cache.json   cached billing figures
  data/server.pid|.log    running server
  settings.local.json     budgets and limits set in the UI
  secrets.local.json      provider API keys (0600)
  data/guard/             per-conversation counters for the live warnings (deleted after 30 days)

Set CLAUDE_FINOPS_HOME=/some/path to move it. Upgrading or uninstalling the package never touches this directory.

The warehouse keeps sessions whose transcripts Claude Code has since deleted, so your history outlives Claude Code’s cleanup. If you delete transcripts on purpose and want them gone from the dashboard too, set "history": {"keep_deleted_transcripts": false} in settings.local.json and press Sync.

Caution

finops.db and any prompt/CSV export contain your full prompt text. Treat them as sensitive and never share ~/.claude-finops/.

Claude’s replies are not stored. A prompt’s details read the reply straight from that session’s transcript in ~/.claude/projects when you open it.

Before you share your screen, click the eye icon (Hide prompts) in the top bar. The side panel has the same button. Prompt text, Claude’s replies and session titles then show as dots, and session titles fall back to their short id. This changes only what the page shows: the database and exports still contain the full text.

Sharing the tool with a teammate

Nothing in the app is tied to one person. Whoever runs it sees their own usage: it reads ~/.claude/projects on the machine it runs on, and takes the account label from that machine’s ~/.claude.json. Point them to npx claude-finops, or run ./share.sh to build a zip that contains only code and defaults.