Token Weather privacy policy

Effective date: 11 October 2026. This policy covers the MIT open-source 1.0.0 edition, local observations and user-controlled deployments.

Publisher and support

Feida Wang, trading as RSI AI as a sole trader, maintains Token Weather. General support is public GitHub Issues. Email support and private identity-document collection are not offered.

Numeric planning

The MCP accepts a reference limit, usage, up to six turn totals, a task increase, an output reserve and fixed source enums. Messages, chats, chat IDs, paths, API keys and identity information are not accepted. Extra fields/invalid counts are rejected without echoing their contents. It cannot read private context or quota.

Current preparation requests are computed on your computer through stdio or loopback HTTP. The calculator does not read chat records, call a publisher service, retain request business data or write access/body logs. The demo makes same-origin local calls and does not persist form values. It has no external scripts, analytics, model API or credentials. Prepared test artifacts use synthetic numbers and are distinct from actual user requests.

User-controlled remote deployment

If you deploy this MIT source on your own server, the host sends numeric inputs to your chosen endpoint. That server handles request metadata such as IP/time. The publisher does not operate a shared budget server and has no access to your deployment through this software. Your selected provider, proxy, host and any modifications you make determine log collection, recipients, location, retention and deletion controls.

The supplied calculator has no business-data persistence or access/body logging. That does not eliminate proxy, container, network, diagnostic or provider logs. Before exposing your service to other users, accurately disclose your actual practices and controls. No unverified promise of no logs, Australian-only processing or immediate deletion is made. The publisher has not deployed a remote instance here.

Local observation MCP

The optional inspect_local_context tool is available only in the local stdio entry point. It accepts the exact requested chat ID and workspace binding, plus numeric task/output assumptions. Those local binding values may also be supplied in environment variables. The tool reads the exact matching compatible Codex record and relevant reference configuration. It does not scan arbitrary chat contents for a guessed target. Its returned result omits message text, IDs and paths, but can include numerical usage/account windows and model/effort labels. If requested in a chat host, those outputs and local tool arguments may be processed by that host under its policies and your settings.

The optional watch command repeats these local reads until Ctrl+C, with no paid/account API call or transcript-content persistence. This adapter writes no cache or request log. The remote HTTP server and container do not load or expose it. Actual model/effort/chat controls remain disabled. Operational errors omit private paths, IDs and contents. Existing weather/checkpoint storage below is separate.

Optional local Codex data

The weather helper locates the requested chat's record and checks chat/project identity. It parses message-bearing records to extract usage; text may be seen in memory but is not copied into weather history. Relevant local model and compaction configuration is also read. Cache metadata can include counts, timestamps, model/effort, observed compaction, account limits when present, chat/turn IDs, paths, file IDs and fingerprints.

The original single-page weather service runs on 127.0.0.1, stores settings, process information, a local control token and logs, and collects until stopped. Its display preference uses browser localStorage. Closing the tab does not stop it. This service is separate from the numeric budget demo.

Enrolled-workflow checkpoints save goals, requirements, decisions, progress, evidence references, paths, generations and fingerprints. Notes may contain confidential/personal task information; verification may read referenced local files. Automatic chat moving is disabled.

Local helpers do not transmit their stored weather/checkpoint data to a Token Weather publisher service. Requested outputs can enter the user's Codex chat under applicable host policies/settings. User-chosen exports, syncs and backups follow the services the user selects.

Retention and controls

The budget process has no business-data database or request/session history. Close stdio or stop the demo with Ctrl+C. Synthetic preparation artifacts remain until the user removes them.

Weather defaults to $CODEX_HOME/state/token-weather (~/.codex is the default Codex home); TOKEN_WEATHER_DATA_DIR can select another path. At most 400 samples per chat are retained. This is not timed expiry: files, service records and logs remain until deleted. Checkpoints live in .codex/handover/<workflow-id>. Uninstalling, archiving a chat or expiring evidence does not erase these files.

Run weather-service stop for the relevant chat and confirm it stopped before removing files from the confirmed weather directory. Stop workflow writers before deleting that workflow. Clear local site storage and remove exports separately; do not delete unrelated Codex records. Future readings can recreate a cache from the original chat; deleting weather data does not delete that chat.

Website and public support

GitHub processes support handles, text, timestamps and chosen attachments. Issues may be visible to everyone. There is no 30-day deletion rule; closing an issue does not erase it. Use GitHub controls or a minimal public request identifying the item. Do not post private records/credentials or identity documents.

The existing site uses GitHub hosting without publisher-added tracking/forms. GitHub's own provider processing and backups are outside publisher control. No Australian-only processing promise is made. A deployment operator must disclose their own actual service practices. The publisher website describes source software and does not host a budget MCP.

Scenario interface controls

The current source UI keeps supplied values in browser memory for the open page; it creates no form-value database or browser localStorage. Optional live updating sends valid numeric inputs to the same local calculator after a short typing pause. Copy summary writes the current supplied-number result to the device clipboard only after the user presses Copy. Clipboard history or device synchronisation, if enabled by the user, follows those services' controls. The five weather images are bundled files, not third-party runtime requests. The demonstration screenshot published in the source/docs uses synthetic values; the user's reference screenshot and private audit comparisons are not published.