The project
CarboneWatch watches this machine's outgoing connections to known AI services and estimates their energy use and carbon footprint. No content is read, no administrator rights are required, and nothing leaves the machine until sharing is turned on in the settings — it is off by default.
Optional. It adds what the application cannot see — Gemini, Meta AI, Copilot in Microsoft 365 — and hands its measurements over to it. It installs from your browser's store; Brave, Arc, Comet, Opera and Vivaldi take it from the Chrome Web Store.
Safari is not supported yet: it only accepts an extension wrapped in a dedicated application, which remains to be built.
Format and size of the downloaded file.
CarboneWatch is the work of an independent developer — not an ad network, not a company that lives off data. The intention fits in one sentence: AI use has an energy cost that appears on no invoice, and what we cannot see, we do not question.
On macOS, the application is signed with an Apple developer ID and notarised by Apple: it opens with no security warning. On Windows, where the certificate is a different one and has not been taken yet, SmartScreen may warn on first launch — it does not say the app is dangerous, only that it is not widely distributed. The instructions below cover each published system.
Nothing leaves your machine until you decide it should, and the decision can be undone: one button stops sharing, and erasure of whatever was already sent is requested in writing. No account, no telemetry, no administrator rights, no open port.
macOS — nothing in particular to do. The application is signed with an Apple developer ID and notarised, and the notarisation ticket travels inside the package: it opens without any detour through system settings, and even offline.
On first launch, macOS asks the confirmation it asks for any application downloaded from the internet. “Open” is enough, and the question does not come back.
Windows — SmartScreen warns about any little-distributed executable: “More info”, then “Run anyway”.
Linux — the .deb package (Debian, Ubuntu) and the .rpm package (Fedora, openSUSE) install normally, through the system package manager. They do not update themselves: a new version is downloaded here and installed over the previous one.
On first launch, a single question: whether your estimate may join the shared footprint. It is asked once, with the exact list of what would be sent and what is never sent, and a button to read the upload word for word before answering. “Not now” is a complete answer: nothing is sent, and the question is not asked again. The choice can be changed at any time in the settings, where you can also request erasure of everything already uploaded.
CarboneWatch recognises services by their network address, never by hostname: that is what lets it decrypt nothing and read no content. The price of that choice is that a service served from someone else's addresses escapes it — Gemini from Drive's and Gmail's, Meta AI from Facebook's, Copilot from Office's. The application alone does not count them, and does not pretend to.
The browser extension sees them, because a browser sees the full address where the machine only sees an IP address. It does not replace the application and calculates nothing itself: it hands over the volume it measured, which the application converts with the same method as everything else, and rejects where it overlaps what it already saw. The application first, the extension next.
iOS and Android are absent, and it is not a matter of scheduling. CarboneWatch detects by destination: it reads the volume exchanged with known AI services, whatever the browser or client. No mobile system grants an ordinary app that.
On iOS, it would mean becoming a VPN and routing the device's entire traffic through us — precisely what CarboneWatch refuses to do everywhere else. On Android, only installed apps would be visible, never usage going through a browser: a figure that silently ignores part of the usage is worth less than no figure at all.
On macOS and Windows, the application checks for a newer version on launch and installs it on request. A package is rejected unless it is signed with the CarboneWatch key: a compromised server cannot deliver anything other than what was signed. On Linux, the .deb and .rpm packages have no such mechanism: updating is done by hand, from this page.
What leaves the machine on that occasion: your IP address and the installed version, as for any web page. The check can be turned off in the settings.
