1. Who is responsible
The data controller is Hevelly Tech SL, NIF [NIF], [Registered address], Spain. For anything about personal data, write to privacy@hevelly.com.
2. What this policy covers
This website (https://hevelly.com), the Hevelly app (https://app.hevelly.com), the optional account, and the emails we exchange with you.
3. What we do not process: your financial data
The figures you enter in Hevelly (holdings, balances, transactions, subscriptions, gift cards, liabilities, places, notes) are stored in your browser on your own device. They are not sent to us and we do not process them. The app is designed so that it keeps working without any account.
If you create an account and choose to make a cloud backup, the backup is encrypted on your device with a passphrase that is never sent to us. What we store is ciphertext that we cannot read, together with the technical values needed to decrypt it on your device (a salt, an initialisation vector, a round count and a version number). We have no way to recover a lost passphrase.
When the app fetches exchange rates it asks for the full table, the same for everyone. When it fetches stock quotes or coin prices it sends ticker symbols or coin ids, with random decoy symbols mixed in, and never quantities, amounts or names. Our server code does not log the symbols.
4. What we do process, why, and on what basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Your email address | Creating your account and signing you in with a one-time code; telling you about changes to the service or these terms. | Performance of a contract (6.1.b). |
| Which version of the terms and of this policy you accepted when creating your account, and when | Showing that the agreement was made, and knowing whom to tell when they change. | Legal obligation (6.1.c) and legitimate interest (6.1.f) in keeping a record of the contract. |
| Your plan, sign-up date and, if you give it, your country | Running your account; knowing which features you have paid for; country is optional and used for statistics and tax rules. | Contract (6.1.b); country: consent (6.1.a), withdrawable by clearing it in Settings. |
| Your encrypted backup (ciphertext and its technical values), a device id and a device label such as "iPhone, Safari", and dates | Storing one backup per account so you can restore it on a new device; enforcing the one-device-at-a-time rule of the free plan. | Contract (6.1.b). |
| Product updates by email | Occasional news about Hevelly. | Consent (6.1.a). Off by default; withdraw any time with the link in the email or in Settings. |
| Anonymous usage statistics | Counts of which screens and features are used, so we know what to improve. Never amounts, holdings, names or places. | Consent (6.1.a), a switch in Settings that is off by default. At the date of this policy no statistics are collected even when it is on. |
| Technical logs: IP address, browser type, requested address, time | Serving the website and the app, keeping them secure, and diagnosing faults. Kept by our hosting provider for a short time. | Legitimate interest (6.1.f) in running a secure service. |
| Emails you send us, and our replies | Answering you. | Legitimate interest (6.1.f), or contract where it is about your account. |
| Payment data (planned, when Hevelly Plus launches): the fact and amount of a payment, a customer id, invoices | Charging for the subscription and keeping the accounting records the law requires. Card details are handled by the payment provider and never reach us. | Contract (6.1.b) and legal obligation (6.1.c). |
We do not use your data for automated decisions with legal effects, and we do not sell it.
5. Who processes data for us
These companies process personal data on our behalf, under data processing agreements, and only for the purposes above:
- Vercel Inc. hosts the website and the app and keeps the technical logs.
- Supabase Inc. provides the database and the authentication service behind accounts: your email, profile and encrypted backup are stored there.
- Resend Inc. sends our emails (sign-in codes and, if you opt in, updates).
- Stripe (planned) will process payments for Hevelly Plus and hold the card details we never see.
Some of these providers are based in, or may process data in, the United States or other countries outside the European Economic Area. Where that happens we rely on the safeguards the GDPR allows: the EU-US Data Privacy Framework for providers certified under it, and the European Commission's Standard Contractual Clauses otherwise. You can ask us for details of the safeguards in place.
We share personal data with nobody else, except if the law requires it.
6. How long we keep it
- Account data and the encrypted backup: for as long as the account exists. "Delete my account" in Settings removes the backup and the profile at once and the sign-in record within a few days.
- Each new backup replaces the previous one. With Hevelly Plus, the last 30 versions will be kept while the plan is active.
- Technical logs: a short period set by the hosting provider, in the order of days to weeks.
- Emails: for as long as needed to deal with the matter, then deleted.
- Payment and invoicing records: for as long as Spanish tax and accounting law requires.
7. Your rights
You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent at any time (which does not affect what was done before). Most of this you can do yourself in Settings: change your country, turn the opt-ins off, delete your account. For anything else, write to privacy@hevelly.com; we answer within one month.
If you think we have handled your data wrongly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to the authority of the EU country where you live.
8. Cookies and storage on your device
This website and the app set no cookies, and run no analytics or advertising scripts. The app stores your data in your browser's IndexedDB and a few settings (theme, whether the lock is on, hidden amounts, a random device id, and, if you sign in, the session token) in its local storage. All of it stays on your device, and all of it is strictly necessary for the app to work, so no consent banner is needed under article 22.2 of the LSSI-CE. Clearing the site data in your browser removes it.
9. Children
Hevelly is not intended for children under 14, and we do not knowingly create accounts for them.
10. Changes to this policy
When we change this policy we update the date at the top. If a change affects what we do with your data in a way that matters, we tell account holders by email first.