# personal project
claudeusage Claude Code usage tracker
TypeScript, Node.js, Next.js
claudeusage turns local Claude Code session logs into a public profile and leaderboard at claudeusage.com. the install is one command: npx claudeusage-sync. i built both the website and the CLI. bazarkua/claudeusage-sync
Claude Code writes each session as JSONL under ~/.claude/projects/. those files hold the full prompts and replies, and they also hold per-message token counts. the CLI streams the files line by line and keeps only the numbers: token totals, model id, timestamps, and the ids needed to de-duplicate. message text is never read.
What actually gets uploaded
the payload is daily buckets: hours active, session count, and per-model input / output / cache tokens. active hours are WakaTime-style, the sum of gaps shorter than 10 minutes between consecutive messages. de-duplication is messageId:requestId, keeping the highest output_tokens because Claude Code writes cumulative streaming values.
that is the whole object. no prompts, no code, no file paths, no project names, no individual message ids. machineId is SHA-256(hostname + ":" + osUsername) computed on the device, so the server only ever sees a hash. the first run prints the payload and waits for y/N before sending anything. --dry-run does the same without uploading.
sign-in for the CLI is an RFC 8628 device flow. the CLI never handles a password. Google or GitHub in the browser, a short code, a long-lived cu_live_... token written to ~/.claudeusage/config.json with 0600 permissions.
What the site does with it
each synced account gets a public profile at /u/<name>: API-equivalent cost, active hours, billed tokens, streak, the year grid, and a usage timeline. a global leaderboard ranks those totals. you can sign in with a display name or stay anonymous.
Claude Code keeps about 30 days of detailed logs locally and then drops the older ones. syncing once is how the year of history stays on the profile after the local files are gone.
the CLI is MIT, Node 22, and small enough to read in an afternoon. the ingest shape lives in src/aggregate/payload.ts. if a line in that file is a content field, the privacy claim is wrong.