What is the privacy model?
The app uses local files with user-only permissions. It does not upload saved profiles to a developer-operated server. Browser login, identity checks, and usage refreshes use OpenAI's Codex login or app-server workflow and remain subject to OpenAI's services and policies.
What data is stored on the computer?
| Local file | What it contains | Why it exists |
|---|---|---|
accounts.json | Profile ID, display name, optional email and account ID, timestamps, and active profile ID | Show and identify saved accounts |
accounts/<profile-id>/auth.json | A reusable Codex credential snapshot for that authorized account | Activate the account selected by the user |
settings.json | Language and display preferences | Keep the chosen app settings |
usage-cache.json | Profile ID, last successful weekly usage, optional 5-hour usage, reset times, and fetch time | Keep useful usage context visible while refreshing |
On macOS, these files live under ~/Library/Application Support/Codex Account Switcher/; profile directories use mode 0700 and credential and registry files use mode 0600. On Windows, they live under %LOCALAPPDATA%\Codex Account Switcher\ with current-user ACLs. The active credential remains in CODEX_HOME, normally ~/.codex/auth.json on macOS or %USERPROFILE%\.codex\auth.json on Windows.
What network activity occurs?
Codex Account Switcher has no developer-operated API or profile-sync service. Adding an account starts the standard Codex browser login flow. Identity verification and usage refreshes launch Codex app-server for the relevant local profile, which may communicate with OpenAI. The switcher does not insert itself as a proxy between Codex and OpenAI.
macOS uses Sparkle to check the signed update feed hourly and install updates when requested. Windows checks GitHub Releases hourly when enabled and opens the unified download page for manual EXE replacement. These HTTPS requests expose ordinary network request metadata to GitHub and its download providers. Update requests do not include saved account credentials; Sparkle system profiling is disabled. Automatic checks can be disabled in Settings.
On macOS, the Tibo reset forecast entry fetches a public feed from codex-reset.com approximately every 15 minutes. The independent site receives ordinary HTTPS request metadata and an app-identifying User-Agent; no saved accounts or credentials are included. Clicking the entry opens that website in your browser.
This website is a static GitHub Pages site with no project-added analytics script, advertising tracker, account system, or contact form. GitHub may process normal hosting request data under the GitHub Privacy Statement.
How can local data be removed?
- Remove an inactive account in Manage Accounts to delete its switcher profile, metadata entry, and cached usage entry.
- Quit and uninstall the app, then remove its data directory:
~/Library/Application Support/Codex Account Switcher/on macOS or%LOCALAPPDATA%\Codex Account Switcher\on Windows. Windows also keeps extracted bundled runtimes under%LOCALAPPDATA%\Codex Account Switcher Runtime\, which can be removed after quitting. - Manage the active
CODEX_HOMEcredential and server-side sessions through Codex and your OpenAI account. Removing switcher data alone does not revoke every OpenAI session.
What should never be posted in a support request?
Keep real auth.json files, access tokens, account names, email addresses, API credentials, private screenshots, and private project details out of GitHub Issues, Discussions, commits, and test fixtures. A useful bug report can include the app version, operating system version, the visible error stage, and sanitized reproduction steps.
How can these claims be verified?
- System designLocal file layout, permissions, app-server use, switch sequence, and deletion behavior.
- AccountStore.swiftImplementation of profile, registry, settings, usage cache, and credential storage.
- OpenAI Codex authentication storageUpstream behavior for file-backed
auth.jsonbeneathCODEX_HOME.