Privacy

Reset is a local macOS application. It has no developer analytics, advertising SDK, account service, or crash-reporting service.

Data the app reads

Reset reads only the local data needed to show and switch the accounts that you choose to manage:

  • Codex authorization from ~/.codex/auth.json when observing or switching the current account, and each saved account’s managed Codex home when validating it or reading usage.
  • Codex rollout files under sessions and archived_sessions of saved managed homes and every Codex home found beside ~/.codex when the app starts: ~/.codex itself, any sibling directory whose name starts with .codex (such as ~/.codex-pro2; a backup copy of ~/.codex is recognised and skipped), and the directory CODEX_HOME names when that variable is set in the app’s own environment. For discovered sibling and environment-selected homes, auth.json is read only to learn which account they are signed in as; nothing is written to those external homes. Saved managed homes follow the refresh and promotion rules below. From those JSONL files, Reset extracts thread and turn identifiers, model and reasoning metadata, token counters, repository URL or working-directory path, and a task label made from at most the first 96 characters of the first meaningful user-request line.
  • Claude Code account identity (accountUuid, emailAddress, organizationName, and displayName, plus organizationUuid when present) from its local account config. Reset prefers <config root>/.config.json, then ~/.claude.json; with CLAUDE_CONFIG_DIR, the fallback is <config root>/.claude.json.
  • Claude Code credentials from the macOS Keychain only through explained, user-initiated connection, saving, switching, or enabling Fast sync.
  • Claude Code rate-limit fields delivered to the local status-line bridge. The bridge preserves an existing command-style status line and writes only the five-hour and seven-day limit windows to its snapshot.

Reset does not save full prompts, responses, transcripts, source files, or project contents. The short task label is derived from prompt text and is stored locally so the app can group usage by task.

Reset never shows Keychain prompts at launch or in the background. It caches an explicitly connected Claude sign-in in its own Keychain service and checks only the foreign item’s creation and modification dates, at most once per minute, to detect rotation. A changed or inaccessible item requires an explained Reconnect action; existing limits retain their original timestamps. Settings → Sync → Keychain prompts defaults to Only when I ask, supports Never, and suppresses interactive attempts for six hours after a denial.

Data the app stores

Reset keeps its files in its own data folder inside ~/Library/Application Support.

  • Each saved Codex account has a persistent, owner-only home under codex-homes/<account-id>/<login-generation>/ in the data folder. The home contains auth.json (ChatGPT identity, access, refresh and ID tokens, and refresh metadata) and files the Codex CLI writes there, such as its configuration, logs, databases and session metadata. Reset starts no model turns in these homes. Directories use mode 0700; authorization files created by Reset use 0600. Each Add account, Save account and Sign in again action runs an independent browser login into a fresh home. The Codex CLI itself refreshes and rewrites that home’s authorization; Reset never calls the OAuth refresh endpoint.
  • Existing Codex Keychain snapshots remain migration inputs until successful CLI validation in a staged managed home. The staging path is saved before the CLI runs, so a retry retains any credentials the CLI has already rotated. After the home becomes authoritative, the old snapshot enters the retired-credential purge; failed deletion is retried. An expired snapshot requires a new browser login.
  • Saved Claude credential snapshots live in the macOS Keychain under Reset’s own Keychain service. The connected Claude sign-in has a separate cache entry (claude.connected-sign-in.v1); removing a saved account does not disconnect that current Claude Code session.
  • Account labels, identities, state revisions, managed-home paths, authentication timestamps, credential fingerprints, promotion reconciliation fingerprints, and legacy credential references live in state.json in the data folder.
  • Usage counters, model metadata, account-limit observations, repository or path labels, and task labels live in usage.sqlite3 in the data folder.
  • Raw per-turn usage events are retained for 90 days. Daily aggregates and the metadata needed to explain them remain until the user resets the app data.
  • The WidgetKit App Group snapshot contains display labels, current limit windows, freshness timestamps, and the Codex summary shown by the widget. It contains no authorization blobs, Keychain credentials, project paths, or task labels.
  • Reset may install a local Claude status-line bridge in the data folder and update ~/.claude/settings.json. It records and restores an existing compatible command-style status line.

Files created by Reset use owner-only permissions where macOS exposes POSIX permissions. The main app is intentionally outside the App Sandbox because account switching requires access to the Codex authorization file, local rollout files, the Claude settings file, and the Claude Keychain entry. The widget extension is sandboxed and can read only the App Group snapshot.

Network activity

Reset makes these outbound requests:

  • It starts the locally installed Codex app server to sign in, validate accounts, refresh native credentials and request official account usage and limit data, with CODEX_HOME pointing to the account’s own home. The Codex process communicates with OpenAI under the user’s existing Codex authorization.
  • It downloads the official Codex and OpenAI pricing documents used to refresh the versioned local rate card.
  • It reads a JSON feed of Codex reset announcements at feed.nextreset.app. The request carries one shared token that is identical in every copy of the app and is not derived from anything on your machine; the feed uses it to apply a request ceiling per client rather than per IP address. It carries no account identifier, no usage data, and nothing derived from you, so the read still cannot be tied to a person or an account. Every failure leaves the app behaving exactly as it did before the feature existed.
  • Sparkle checks the public EdDSA-signed update feed and downloads an update only through the published release channel.
  • Only when “Fast sync over the network” is enabled in Settings — it is off by default — the app also reads usage directly from each provider with that account’s own credentials: GET https://chatgpt.com/backend-api/wham/usage with the Codex access token from that saved account’s managed home, and GET https://api.anthropic.com/api/oauth/usage with the Claude Code OAuth token. These are the same reads the providers’ own tools perform. Each token is sent only to the service that issued it, over HTTPS, on an ephemeral session with cookies disabled; the requests carry no other local data, and these HTTP clients never refresh or write credentials. A stale Codex token delegates recovery to the locally installed CLI running in that home. With the setting off, Reset makes no direct authenticated HTTP requests; CLI-mediated Codex validation and refresh still occur.

Reset News notifications are generated locally from the reset-announcement feed read described above. The notification preference and last notified signal ID stay in local UserDefaults to avoid repeating an announcement across launches; notifications send no data off the Mac and make no additional network requests.

Reset does not send local rollout metadata, project labels, task labels, saved credential snapshots, or widget snapshots to the Reset developer.

Codex promotion and shared token families

Make current validates the selected account and workspace, then copies its managed auth.json into ~/.codex/auth.json through the validated, rollback-safe switch transaction. Workspace mismatch fails closed. Like CodexBar promotion, this leaves one shared-family edge: the live home and the promoted managed home now share a refresh-token family. Reset tracks the promotion fingerprint and writes observed live rotations back into that managed home; a CLI refresh of the promoted managed home also updates the unchanged live file through a guarded replacement. It never overwrites an independently logged-in home merely because the email matches. Concurrent external writers, or CLI activity while Reset is closed, can still race the shared family and require Sign in again. Migrating a snapshot does not create a new token family; only an independent login does.

Other discovered sibling homes remain read-only. Reset does not refresh or publish credentials into them.

Removing local data

Removing an account in Reset deletes that account’s managed home (including CLI-created files), legacy saved credential and account-owned usage records. Cleanup failures remain queued for retry. It does not sign out the live ~/.codex copy or revoke the provider session. Clear statistics starts a new analytics period; it keeps account data, authorization history, rate cards, import positions, and work labels needed to group later activity.

To remove all Reset data, quit the app, remove its data folder from ~/Library/Application Support (the folder that holds state.json and usage.sqlite3), remove its App Group container, and delete the Keychain items it created (their service name ends in .authblob). If the Claude status-line bridge is enabled, disable it from Reset before deleting the app so the previous Claude Code status line is restored.

Independent project

Reset is an independent project and is not affiliated with, sponsored by, or endorsed by OpenAI or Anthropic. OpenAI, ChatGPT, Codex, Anthropic, and Claude are trademarks of their respective owners.