HEADROOM
Privacy Policy
Effective 18 August 2026
Headroom reads how much of your AI credit, quota, and spend you have used, from the providers you connect, and shows it in one place. This policy describes exactly what it stores, where, for how long, and what leaves your device.
The short version: your provider API keys are never shared with anyone, never sent to an AI model, and never written to logs. On the free tier they never leave your phone at all.
Who we are
Headroom is an independent app published by tuaha-dev. For anything in this policy, contact syedtuaha18@gmail.com.
What Headroom stores
Your account
You can use the app without an account. An account is required only to connect a real provider or to subscribe. When you create one, we store your email address and an authentication record held by Google Firebase Authentication. We never see or store your password.
Provider credentials
To read your usage, Headroom needs a credential for each provider you connect — an API key, or a Google Cloud service account document for Gemini. How it is stored depends on the tier:
- Free. The credential is stored only on your device, in the operating system's encrypted keystore (Android Keystore via Expo SecureStore). It is not transmitted to us.
- Pro. Because background checks run while the app is closed, the credential is sent over an authenticated HTTPS connection to our backend, encrypted immediately with Google Cloud KMS, and stored only as ciphertext. Plaintext is held in memory just long enough to call the provider.
- If you paste a key on our website instead of in the app, it is stored server-side only, in the same encrypted form.
Usage data read from your providers
Balances, credit and quota limits, remaining amounts, token and character counts, spend figures, reset dates, and model names — as published by each provider's own usage API. From these we compute daily history, burn rate, runway, and similar figures.
Settings and device data
Your planning budget, usage goal, time zone, alert preference, and AI Planner consent. If you enable alerts, we store the push notification token issued by Expo's push service so we can notify your device.
Subscription
Purchases are processed by Google Play. We do not receive or store your payment details. Our subscription provider, RevenueCat, records your purchase against your Headroom account identifier so your Pro access follows your account rather than one installation.
What Headroom never collects
Your prompts, model responses, conversations, uploaded files, and audio are never read, transmitted, or stored. Headroom reads only the metering and billing endpoints of the providers you connect. Those endpoints report totals — they do not expose content, and Headroom does not ask for it.
We do not use advertising identifiers, we do not sell or share personal information, and we run no third-party advertising or tracking SDKs.
The AI Planner
Pro includes a weekly plain-language explanation of your usage, generated by Anthropic's Claude. It runs only if you switch on Planner consent in Settings, and you can switch it off at any time.
When it runs, what is sent to Anthropic is limited to:
- Provider and model names, sanitised.
- Aggregated figures already shown to you — remaining balance, daily burn rate, runway, spend for the period.
- The usage goal you selected.
Your API keys, your account identifier, your email address, and any content are not included. The model is only permitted to reference figures we supplied; every number shown in a report is one Headroom calculated, not one the model produced.
Who processes your data
| Service | Purpose | What it receives |
|---|---|---|
| Google Firebase | Accounts, database, backend, hosting, encryption keys | Account record, settings, encrypted credentials, usage figures |
| Anthropic | Weekly Planner explanations (Pro, with consent) | Sanitised provider names and aggregated figures only |
| RevenueCat | Subscription status | Account identifier and purchase status |
| Google Play | Payment processing | Handled by Google; we receive no payment details |
| Expo | Push notification delivery | Device push token and the alert text |
| Your providers | Reading your usage | Your credential, sent only to the provider that issued it |
Data is stored in Google Cloud's United States multi-region. If you use Headroom from elsewhere, your data is transferred there.
How long it is kept
- Usage history: 7 days on Free, 90 days on Pro.
- Planner reports: 90 days, deleted automatically by a scheduled job. You can delete one immediately in Settings.
- Provider credentials: until you disconnect the provider or delete your account.
- Account record: until you ask us to delete it.
Your choices
- Planner consent — off by default; nothing is sent to Anthropic until you turn it on.
- Alerts — off unless enabled; turning them off stops us using your push token.
- Disconnect a provider — removes the stored credential from your device and from our servers.
- Delete a report — removes it immediately rather than waiting for the 90-day expiry.
- Export — Pro can export normalised daily history as CSV.
- Sign out — clears the data held on that device, including every stored credential.
Deleting your account and data
To delete your Headroom account and everything associated with it, email syedtuaha18@gmail.com from the address you registered with, with the subject “Delete my Headroom account”.
We will delete your account record, your encrypted provider credentials, your stored usage history, and your Planner reports within 30 days, and confirm by reply.
You can remove most of this yourself at any time without contacting us: disconnecting a provider deletes its credential, deleting a report removes it immediately, and signing out clears the data held on your device.
Security
- Provider credentials are encrypted with Google Cloud KMS and stored only as ciphertext. Database rules deny read access to that field to everyone, including you — it is only ever decrypted inside our backend to call the provider.
- On-device credentials use the operating system's encrypted keystore.
- All network traffic uses HTTPS.
- Server logs identify users by a truncated one-way hash, never by email address, and never contain credentials.
No system is perfectly secure. If you believe your account or a provider key has been compromised, revoke the key with the provider and contact us.
Children
Headroom is a developer tool and is not directed to children. We do not knowingly collect personal information from anyone under 13.
Changes
If this policy changes materially, we will update the effective date above and note the change in the app before it takes effect.