Privacy
What we collect
- Cloudflare Web Analytics: page views, country, device class, Core Web Vitals. Cookieless. No fingerprinting. No personal identifiers.
- Custom site events (also Cloudflare Web Analytics): which models you enabled, whether a count completed, whether you adjusted the cost slider. Aggregate only.
Advertising cookies
This site may display advertisements served by Google AdSense and other third-party ad networks. These networks may use cookies, web beacons, and similar technologies to:
- Serve ads based on your prior visits to this site or other sites on the web (interest-based advertising).
- Measure ad performance and report aggregate impressions to advertisers.
- Provide ads relevant to your interests.
Google's use of advertising cookies enables it and its partners to serve ads based on your visits to this site and other sites on the internet. You may opt out of personalized advertising by visiting Google's Ads Settings or, for third-party vendors, the Network Advertising Initiative opt-out page.
We do not control the cookies set by third-party ad networks. Their data practices are governed by their own privacy policies.
What we do not collect
- Prompt content. Your prompt is never logged, never stored, and never persisted by us. Browser-side counts (OpenAI, open-source) never leave your device. Server-side counts (Anthropic, Gemini) send your prompt to the provider's tokenization endpoint and discard it immediately after the response returns.
- Email addresses, accounts, or identifiers. The free counter has no signup.
- First-party cookies. Our own application sets no cookies.
Third-party data flow
- Anthropic's
count_tokensendpoint receives your prompt for tokenization when you have a Claude row enabled. Per Anthropic's API policy, count_tokens calls are not used for training. - Google's
countTokensendpoint receives your prompt for tokenization when you have a Gemini row enabled. Same policy applies. - Cloudflare serves all traffic and runs the analytics beacon.
- Google AdSense (and any other ad network shown) loads ad scripts and may set its own cookies as described above.
Data retention
- Token counts are cached in Cloudflare KV for 30 days, keyed by SHA-256 of the input text. The text itself is never stored, only the hash and the resulting count.
- Analytics data is retained per Cloudflare Web Analytics defaults.
Your choices
- Opt out of personalized ads: Google Ads Settings.
- Opt out of multi-vendor interest-based ads: aboutads.info/choices.
Your rights (GDPR & CCPA)
EU / UK / Switzerland (GDPR). If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. We hold essentially no personal data on our own systems, but if you believe we do, email the address below.
California (CCPA / CPRA). California residents have the right to know what personal information we collect, request deletion, and opt out of the sale or sharing of personal information. We do not sell personal information. To exercise any CCPA right, email the address below.
Children's privacy
How Many Tokens is a developer / professional tool. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, email us and we will delete it.
Contact
Questions or concerns: ideas@boringhaus.com.
Changes
If this policy changes materially, the version date below will reflect the change.
*Last updated: 2026-04-27.*