01 What this extension is
Claude Usage Companion reads your Claude usage limits — the same session and weekly numbers claude.ai already shows you on its own Settings → Usage page — and displays them as bars, history, and a burn-rate forecast without you needing to visit that page. An optional local companion program (the "daemon") can additionally show usage from the Claude Code command-line tool, if you choose to install it.
This is an independent, unofficial project. It is not made by, affiliated with, or endorsed by Anthropic.
02 What the extension reads
The extension only activates on claude.ai pages. While you're
there, it reads two things directly out of the page's own network traffic — it never
touches Claude Code's local files itself:
It does not read message content, does not read your conversation history, and does not modify anything claude.ai sends to or receives from your browser.
03 The optional local daemon
If you separately install the daemon (a manual, opt-in step — it never installs itself),
it reads Claude Code's session logs directly from your own disk
(~/.claude/projects/**/*.jsonl) to show CLI token usage,
cost totals, and let you search your own past sessions.
The daemon also powers the extension's "Guardrails" view: for a project you pick, it
reads your Claude Code permission rules, hooks, and skills (from
~/.claude/settings.json, the project's own
.claude/settings.json, and
.claude/settings.local.json) and any
CLAUDE.md files in that project, so you can see them without
opening a terminal or editor. Two actions there write back to disk, both only when you
explicitly click something — adding or removing a permission-rule override (always to
the project's own .claude/settings.local.json, never the
shared, committed settings.json) and saving an edit you make to
a CLAUDE.md file. Both a read and a write here stay a local
file operation on your own machine — nothing is ever sent anywhere.
This program:
- Runs only on your machine, listening only on
127.0.0.1— never reachable from the internet or any other device. - Never makes a network request of its own; it only reads/writes local files and answers requests from your browser extension.
- Requires a randomly generated access token before the extension can talk to it at all.
You can remove it at any time; instructions are in the project's README.
04 What is never collected
- No account or sign-up of any kind — there is nothing to register for.
- No analytics, telemetry, or crash reporting of any kind.
- No conversation content, prompts, or Claude responses are ever logged, transmitted, or stored by this project — only usage numbers, counts, and timestamps.
- No data is sent to any server this project controls, because no such server exists.
- No data is sold, shared, or shown to any third party, because it never leaves your device in the first place.
05 Where data lives, and for how long
Usage history is stored in your browser's own local storage (IndexedDB), scoped to the extension the same way any browser stores site data — it is private to your browser profile on your device and is never synced anywhere by this project.
Guardrails data (permission rules, hooks, skills, and CLAUDE.md content) is read live from the daemon each time you open that view, and isn't cached or stored by the extension itself.
06 Every permission, explained
The extension requests the smallest set of browser permissions that its features actually need. Here is what each one is for, with nothing left unexplained:
| Permission | What it's for |
|---|---|
| host: claude.ai | Read usage data from claude.ai's own responses while you're on the site — the entire basis of the extension. |
| host: 127.0.0.1 | Talk to the optional local daemon on your own machine, if you've installed it — for usage/CLI data, and for the Guardrails view's local Claude Code config read/write described above. Nothing outside your device. |
| alarms | Schedule the periodic usage check (every few minutes) and the pairing check for the local daemon. |
| notifications | Show a system notification when a usage bar crosses a threshold you've configured — defaults to 80%/95%, adjustable in Settings, or can be turned off entirely by clearing the thresholds there. |
07 Security
The local daemon binds only to 127.0.0.1, requires a bearer
token on every request, and rejects any request coming from a regular web page — so a
malicious website cannot reach it. Every piece of data the extension receives, from
claude.ai or from the daemon, is validated against a strict schema before it's trusted;
anything unexpected is discarded rather than acted on.
The Guardrails view's file reads and writes are scoped the same way: a
CLAUDE.md file can only be read or saved if the daemon itself
already found it on disk under the project you selected — a request can't point it at an
arbitrary file elsewhere on your machine.
08 Children's privacy
This extension is a utility for people who already use Claude and is not directed at, or knowingly used to collect information from, children. Since the project collects no personal information from anyone, there is no children's data to describe.
09 Changes to this policy
If this policy changes, the "Effective" date at the top of this page will change with it, and the current version will always be the one published at this URL and mirrored in the project's repository. There is no mailing list or account to notify, since none exists.
10 Contact
This is an open-source project. The full source, including everything this policy describes, is public — read it yourself or open an issue at github.com/RehberOdhano/headroom.