What is the privacy model?
The app uses local files with user-only permissions. It does not upload saved profiles to a developer-operated server. Browser login, identity checks, and usage refreshes use OpenAI's Codex login or app-server workflow and remain subject to OpenAI's services and policies.
What data is stored on the Mac?
| Local file | What it contains | Why it exists |
|---|---|---|
accounts.json | Profile ID, display name, optional email and account ID, timestamps, and active profile ID | Show and identify saved accounts |
accounts/<profile-id>/auth.json | A reusable Codex credential snapshot for that authorized account | Activate the account selected by the user |
settings.json | Language and display preferences | Keep the chosen app settings |
usage-cache.json | Profile ID, last successful weekly usage, optional 5-hour usage, reset times, and fetch time | Keep useful usage context visible while refreshing |
These files live under ~/Library/Application Support/Codex Account Switcher/. Saved profile directories use mode 0700; credential and registry files use mode 0600. The active Codex credential remains under the active CODEX_HOME, normally ~/.codex/auth.json.
What network activity occurs?
Codex Account Switcher has no developer-operated API or profile-sync service. Adding an account starts the standard Codex browser login flow. Identity verification and usage refreshes launch Codex app-server for the relevant local profile, which may communicate with OpenAI. The switcher does not insert itself as a proxy between Codex and OpenAI.
This website is a static GitHub Pages site with no project-added analytics script, advertising tracker, account system, or contact form. GitHub may process normal hosting request data under the GitHub Privacy Statement.
How can local data be removed?
- Remove an inactive account in Manage Accounts to delete its switcher profile, metadata entry, and cached usage entry.
- Quit and uninstall the app, then remove
~/Library/Application Support/Codex Account Switcher/to delete all switcher-managed local data. - Manage the active
~/.codex/auth.jsonand server-side sessions through Codex and your OpenAI account. Removing switcher data alone does not revoke every OpenAI session.
What should never be posted in a support request?
Keep real auth.json files, access tokens, account names, email addresses, API credentials, private screenshots, and private project details out of GitHub Issues, Discussions, commits, and test fixtures. A useful bug report can include the app version, macOS version, the visible error stage, and sanitized reproduction steps.
How can these claims be verified?
- System designLocal file layout, permissions, app-server use, switch sequence, and deletion behavior.
- AccountStore.swiftImplementation of profile, registry, settings, usage cache, and credential storage.
- OpenAI Codex authentication storageUpstream behavior for file-backed
auth.jsonbeneathCODEX_HOME.