Skip to content

Limits Privacy Policy

This policy covers the Limits app for iPhone and iPad, its widgets, and Limits's pages on this website.

Last updated: 19 October 2026.

The short version: Limits has no servers and sends nothing to us. It signs in to your AI services with the accounts you add, reads how much of each limit you have used, and shows that on your iPhone. Your sign-ins and your usage stay on your device.

Who is responsible for your data

The data controller is Bad Bundle Limited, a company registered in England and Wales, company number 16035056, whose registered office is Silverstream House, 4th Floor, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, United Kingdom.

For anything to do with this policy, email help@badbundle.com.

What Limits collects

Nothing.

Limits collects no personally identifiable information about you. That includes your sign-ins, your account names and email addresses, and your usage. All of it stays on your device.

Limits contains no analytics, no crash reporting, no telemetry, no third-party code and no advertising identifiers. It writes nothing to the system log. There is no Bad Bundle server for it to talk to, so there is nothing for us to receive, store, or hand over.

Limits displays no advertisements, so there is no advertising token used to identify you. It has no in-app purchases and no paid tier, and it never will.

What Limits does with your accounts

You add an account by signing in to an AI service inside Limits: Claude, Codex, Cursor, Gemini CLI, GitHub Copilot or Grok. Limits then asks that service how much of each limit you have used and when it resets, and shows you the answer.

  • Your sign-ins (the tokens and cookies the service gives Limits) are kept only in the iOS Keychain on this device, readable after the first time you unlock it. They are never synced to iCloud and never included in backups of your device. They are sent only back to the service they came from.
  • Your usage (each account's name or email address, plan and limits, and when they were last read) is kept in a file on your device, so that Limits's widgets can show it without opening the app. It holds no sign-ins and no responses from the services beyond a kind of error and, for an unexpected response, an HTTP status.
  • Your settings (how you like limits shown, their order, and which notifications are on) are stored on your device with the app's settings.

Limits only reads usage and account details. It never sends a prompt, and it never uses your subscription for anything else.

Where Limits connects

Limits makes network requests only to each service's own addresses, over HTTPS, and only for accounts you have added: claude.ai, platform.claude.com and api.anthropic.com for Claude; auth.openai.com and chatgpt.com for Codex; cursor.com for Cursor; github.com and api.github.com for GitHub Copilot; auth.x.ai and cli-chat-proxy.grok.com for Grok; and accounts.google.com, oauth2.googleapis.com and googleapis.com for Google sign-in and Gemini CLI.

Limits uses an ephemeral connection that keeps no cookies, cache or stored credentials of its own.

Each of those services receives the request as it would from its own apps, and what it does with it is covered by its own privacy policy, not this one.

Signing in

Signing in opens the service's own sign-in page. Browser sign-in uses your device's shared Safari session, so a service's own website sign-in can carry over to and from Safari. That is what lets you sign in without typing a password again. Cursor's sign-in uses a web view that keeps nothing: its website data is thrown away, and the session cookie is deleted from it once Limits has read it.

Some services show you a short code to enter on their website. Others send you back to Limits when you have signed in, and for those Limits listens for the reply on your own device only (the address 127.0.0.1), accepts a single request that carries the right one-time state, and stops.

If you paste a Cursor cookie instead, it is shown in the text field while you type it, like any pasted value.

Widgets and background refresh

Limits's widgets show the usage Limits last read, and Limits refreshes it in the background. Because they run while your phone is locked, the usage file is protected until your phone has been unlocked once after starting, rather than completely, and your sign-ins are readable after that first unlock. Both stay on your device.

Notifications

If you turn them on, Limits can notify you when a limit is running low and when a low limit has reset. Limits makes these notifications on your iPhone, from the usage it already holds. It asks for permission only when you turn a notification on, and it registers no push token, so no server sends or sees them.

A notification shows the account name and the limit on your Lock Screen, such as "Claude · Work 5-hour session is at 90%", until you mute that account or turn the notification off in Limits or in iOS Settings. Limits keeps a record of what it has already told you about, which holds only account and limit identifiers and reset times.

Deleting your data

  • Remove an account in Limits to delete its sign-in, its saved usage, the record of what was notified for it, and its notifications.
  • Delete All Data in Settings deletes every sign-in, every saved usage, every setting, the whole record of what was notified, and every Limits notification.
  • iOS can keep an app's Keychain items after the app is deleted, so use Delete All Data before you delete Limits.

Apple's own statistics

If you have turned on Share With App Developers in Settings › Privacy & Security › Analytics & Improvements, Apple may give us aggregate statistics about how the app is used, along with crash reports.

This is Apple's collection, not ours. We receive it already aggregated and anonymised, we cannot identify you from it, and Limits's own code plays no part in producing it. Turning that iOS setting off stops it. Apple also provides aggregate App Store sales and download figures, which contain no information about individual people.

We may disclose information we hold in response to subpoenas, court orders, or other legal requirements, to exercise our legal rights or defend against claims, or to investigate illegal activity or abuse.

We hold no information about you that could be disclosed. There is no account, no profile, and no copy of your sign-ins or usage on any system we control, so a demand for it would produce nothing. This is a property of how Limits is built, not a promise about how we would respond.

If this ever changes, the change will appear in this policy before it takes effect.

Business transfers

If we sell, merge with, or partner with another business, any user information we hold could be among the transferred assets. At present there is none.

Your rights

Under UK GDPR you have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable format.

Because we hold no personal data about Limits users, there is in practice nothing for us to produce, change, or delete. If you believe we hold something about you, email help@badbundle.com. Data protection requests are answered within one month, as the law requires. That is a statutory duty and is separate from general support, which carries no such commitment.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

International transfers

We transfer nothing, because we receive nothing. The services you add accounts for process your requests under their own terms and safeguards, as do Apple's aggregate statistics and your device's backups if you keep them in iCloud.

Children

Limits is not directed at children. We do not knowingly collect information from anyone under 13, and no part of the app or site is structured to attract anyone under 13.

California residents

We comply with the California Online Privacy Protection Act. We do not distribute personal information to outside parties, because we do not collect any.

Not affiliated with the services

Limits isn't affiliated with or endorsed by Anthropic, OpenAI, Anysphere, Google, GitHub or xAI. Their names are used only to identify their services.

Changes to this policy

Changes to this policy are reflected on this page, with the date at the top. No notice is given by any other means.

  • 19 October 2026: First published.

Other notes

This policy is adapted from GPS's, which was adapted from Vault's, which was in turn adapted from the Overcast Privacy Policy. If you're looking for a podcast player, I strongly recommend Overcast.