Privacy Policy

The BoringSpinner extension never reads your code, prompts, completions, chat content, file names, or any other content from your editor or AI coding assistant.

This is not a marketing claim hedged in fine print. It is a structural fact that you can verify by reading the source-available extension code on GitHub. The extension has no code path that accesses editor content, workspace files, or AI-assistant responses. It only watches for the single-line “thinking” spinner state exposed by Claude Code's status bar and settings interfaces.

We treat “we never read your code” as a load-bearing commitment, not a preference. Any future code change that would require reading editor content will require explicit, opt-in user consent and a new version announcement.

The BoringSpinner extension makes network requests to exactly two external destinations:

• api.boringspinner.com — the BoringSpinner backend. All authenticated API calls (telemetry, earnings, ad portfolio, kill-switch, auth) go here over HTTPS. This is the primary and default destination.
• The configured update host — defaults to api.boringspinner.com. Advanced users may configure a separate self-hosted update server via updateBase in ~/.coads/config.json.

Additionally, the extension starts a local loopback HTTP server (bound exclusively to 127.0.0.1, never to 0.0.0.0 or any public interface). This loopback server handles click events from the webview ad injection and never carries traffic off your machine.

There are no third-party analytics SDKs (no Google Analytics, Segment, Amplitude, Mixpanel, Sentry, or equivalent) in the extension or on this website.

All telemetry is described in the source-available client. We collect the minimum required to operate the auction and pay you accurately:

We do not collect: your code, prompts, completions, chat messages, clipboard contents, file contents, keystrokes, window titles, screen pixels, URLs you visit, or any other content from your machine.

BoringSpinner modifies two files on your machine to inject the sponsored ad slot:

• ~/.claude/settings.json — BoringSpinner appends entries to the spinnerVerbs and statusLine fields. This is a documented, supported configuration surface.
• Claude Code webview bundle — for the overlay surface, BoringSpinner patches the installed extension bundle in place.

Before any modification, BoringSpinner creates a byte-exact backup of every file it touches, verified by checksum. The BoringSpinner: Restore Claude Code command restores every file to its pre-install state in a single click.

If BoringSpinner cannot find a compatible version of Claude Code or Codex, it does nothing and shows an “incompatible” status bar message.

• Impression / click events: retained for 12 months, then purged.
• Ledger rows (your earnings credits): retained indefinitely for accounting and tax purposes (Stripe Connect requires this).
• Account data: retained until you close your account. On account closure we delete all personal identifiers; aggregated, non-identifiable statistics may be retained.

Payouts are processed through Stripe Connect Express. When you connect a Stripe account, Stripe's privacy policy governs the banking and identity information you provide to Stripe directly. BoringSpinner receives only a Stripe account ID and payout-eligibility status.

Until Stripe Connect platform approval clears, earned balances are held in a custodial Stripe account in your name. These funds are yours; BoringSpinner is not the beneficial owner of any publisher balance.

For US publishers earning ≥ $600 / year, Stripe Connect issues a 1099-K or 1099-NEC on your behalf. Non-US publishers are required to complete a W-8BEN form through Stripe. BoringSpinner does not issue tax forms directly; Stripe is the responsible party for 1099 / W-8 workflows.

• Legal basis: contract performance (operating the ad auction and paying you) and legitimate interest (anti-fraud).
• Retention: events for 12 months; ledger forever (tax law requirement).
• Right to erasure: honored on account closure for all personal identifiers. Ledger rows are anonymized, not deleted (accounting compliance).
• Data portability: request a full export of your ledger data at any time by emailing privacy@boringspinner.com.

BoringSpinner is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has created an account, contact privacy@boringspinner.com and we will delete it promptly.

We will notify users via the extension status bar and by email (if you have provided one) before any material change to this policy takes effect. The effective date at the top of this page is always the date of the last substantive update.

Questions, erasure requests, or data-export requests: privacy@boringspinner.com