What Leaves Your Machine

One ad request and one signed confirmation per ad. Never your code.

How Ads Are Shown

Claude Code CLI

The CLI installs a UserPromptSubmit hook. On each prompt it fetches an ad and prints one JSON line with a systemMessage — a single line labeled Sponsoredshown to you, not added to Claude's context. The hook then exits immediately, so your prompt is never delayed. A detached background process reports the impression 10 seconds later.

{"systemMessage":"Sponsored · Brand — ad text · https://example.com"}

VS Code extension

While your AI tool is working, the extension opens a 10-second card labeled Sponsoredin a side panel without stealing focus. It triggers on two VS Code API activity signals: a terminal opening, and an inline-completion request (it returns no suggestions and never reads or sends the document). If you skip or close the card early, nothing is reported and you don't earn.

Network Calls

1. GET https://claudecash.co/api/ad

When	CLI: once per prompt you submit. VS Code: on AI activity, at most once per card.
Headers	`Authorization: Bearer cc_your_api_key`
Body	None
Timeout	CLI 2s, VS Code 3s — fails silently, no ad shown

Response (what we send to you):

{
  "ad": {
    "id": "<campaign id>",
    "text": "ad text",
    "url": "https://advertiser.example",
    "brand": "Brand",
    "color": "#1a3a2a",
    "letter": "B",
    "bid": 5,
    "house": false,
    "token": "<server-signed, single-use impression token>"
  }
}

House ads come with house: true and token: null and are never reported.

2. POST https://claudecash.co/api/impression

When	CLI: 10 seconds after the ad was shown, from a detached background process. VS Code: after the 10-second card completes. Never for skipped cards.
Headers	`Authorization: Bearer cc_your_api_key`
Timeout	5s — fails silently

Exact JSON body:

{
  "token": "<token from GET /api/ad>",
  "platform": "cli"   // or "vscode"
}

token — signed by our server and bound to your account. Accepted only ≥ 9.5 seconds after it was issued, and only once.
platform — which client showed the ad.
Server-side rate limit: max 1 impression per 5 seconds per key, 2,000 per day.

3. POST https://claudecash.co/api/events (extension 0.3.0+, CLI 0.4.0+)

When	Batched: once a minute and when the editor or Claude Code session closes. Fails silently, never retried in a loop.
Headers	`Authorization: Bearer cc_your_api_key`
Limit	100 events per batch, 600 per hour per key. Raw events are deleted after 90 days.

Exact JSON body:

{
  "install_id": "random id made on install",
  "session_id": "random id per editor window / Claude Code session",
  "platform": "vscode",          // vscode | cursor | windsurf | cli
  "client_version": "0.3.0",
  "editor": "Visual Studio Code 1.95.0",
  "os": "darwin",
  "events": [
    { "event": "session_start", "ts": 1767225600000 },
    { "event": "ad_shown", "ts": 1767225601000, "token": "<token from GET /api/ad>" },
    { "event": "ad_completed", "ts": 1767225611000, "token": "...", "duration_ms": 10000 },
    { "event": "ai_prompt", "ts": 1767225700000 },
    { "event": "ai_turn_end", "ts": 1767225760000, "duration_ms": 60000 }
  ]
}

Every event type: session_start, heartbeat (every 5 min while the window is focused), session_end, ai_prompt and ai_turn_end (CLI only: that Claude Code is working and for how long — never what you asked), ad_shown, ad_completed, ad_skipped, ad_closed, update_check, update_started.
Ad clicks open claudecash.co/api/click/…, which counts the click and redirects to the advertiser. We count clicks; we never see what you do on their site.
Every GET /api/ad is counted on our server. For old clients without an API key we store only a hash of your IP that changes daily, never the IP itself.
Events never move money. Earnings come only from /api/impression.
Turn off usage events: VS Code setting claudecash.telemetry (also respects VS Code's global telemetry switch) or CLAUDECASH_TELEMETRY=0 for the CLI. Ad events needed for earning stay on.

4. Claude Code hooks, status line and the activity file

claudecash install adds hooks for UserPromptSubmit, Stop, SessionStart and SessionEnd, plus a statusLine command, to ~/.claude/settings.json. All are documented Claude Code settings — nothing in Claude Code is patched.
Hooks write one local file, ~/.claudecash/activity.json: whether Claude is working, since when, and the session id. That's how the VS Code card knows to show only while your AI is actually working. Nothing about your prompt is in it.
The status line prints your original status line first (if you had one), then one sponsored line from a locally cached ad. It makes no network calls and reads only the session id from Claude Code's status JSON. An ad is billed only after it has been on screen 10 seconds during an active turn.
The VS Code extension can add the two activity hooks itself, only after you click Enable.
Codex (--codex, experimental): hooks in ~/.codex/hooks.json update the same activity file. Nothing is printed inside Codex.
Remove everything: claudecash uninstall restores your original status line exactly and removes only our entries.

5. Automatic updates

On startup, clients read GET /api/client-config — version numbers only, never code or download links.
Extension: if outdated, it reinstalls itself from your editor's own marketplace (VS Code Marketplace / Open VSX) and asks you to reload.
CLI: at most once a day, runs npm install -g @claudecash/cli@latest in the background. Turn off with CLAUDECASH_AUTO_UPDATE=0.

What We Never See

Your source code

The CLI hook drains the event JSON Claude Code sends on stdin without reading it. The VS Code completion provider returns nothing and never reads the document.

Your prompts or conversations

Neither client reads or sends chat history, prompts, or messages.

File paths or repo names

Neither request contains paths or project info — only the API key header and the fields shown above.

Environment variables

The CLI stores only your API key, in your OS config directory via the conf package. The extension stores it in VS Code settings. Nothing else is read.

Git metadata or secrets

No git commands run and no .git files are read.

Model responses or thinking traces

The hook fires at prompt submission, before Claude replies. We never see output or thinking.

What the Website Loads

The clients above are separate from claudecash.co. When you visit the website:

Google Tag Manager and Google Analytics 4 load on every page for traffic analytics.
Mixpanel product analytics load only after you accept the cookie consent banner.
The dashboard and advertise pages call ipapi.co from your browser to detect your country (for currency display). ipapi.co sees your IP address.
Payments open Razorpay's checkout, which loads from Razorpay.
Tips on your dashboard (and, at most once a day, in the extension or CLI) are picked from activity ClaudeCash already records — whether you're earning, your balance, your client version. We log when a tip is shown, clicked, or dismissed; nothing else is collected for them.

Verify It Yourself

Both clients are open source. Read the exact code that runs:

Claude Code CLI: github.com/iamshantanubose/claudecash-cli — see src/hook.ts, src/api.ts, src/report.ts, src/config.ts
VS Code extension: github.com/iamshantanubose/claudecash — see src/extension.ts

You can also watch the two requests with any HTTPS proxy (e.g. mitmproxy) — nothing else is sent.