Privacy and security
Your figures stay on your device. Here is what that means, exactly.
No overclaiming. This page describes what Hevelly does today, what leaves your device and why, and what we can and cannot see. If anything here stops being true, the page changes first.
Where your data lives
Everything you enter is stored in your browser, in a database on your phone or computer called IndexedDB. There is no copy on our servers. Hevelly works without a connection, and when it does connect it is only to fetch rates and prices.
Because the data lives in the browser, clearing the site data for Hevelly erases it. That is why the app nudges you to save a backup file once you have a few entries, and why it asks to be installed on your home screen: installed apps are not subject to the storage eviction some browsers apply to ordinary tabs.
The demo runs in a separate database with made-up figures. Leaving it deletes that database. It never touches your own data.
Two facts worth knowing
- Data saved at one address stays at that address. If you open Hevelly at a different domain, you start empty there, and a backup file carries your data across.
- Your browser profile can see its own storage. Anyone with your unlocked phone or computer, and no Hevelly lock set, can open the app. The lock is for that, see below.
What leaves your device
Two kinds of request, and only two. The first fetches exchange rates: the full table, the same for everyone, so the request says nothing about you. The second fetches stock quotes and coin prices by symbol. Your browser mixes random decoy symbols from a fixed list into each request, so even our own server cannot tell which of the symbols you hold. Requests never carry quantities, amounts or names. Our routes do not log the symbols.
- 0.285 BTC€20,391.50
- 12 shares of a world fund€1,340.16
- Cash at N26€12,480.52
- Mortgage−€96,400.00
Stays here. Nothing above is ever sent.
- Which symbols were asked forsome are decoys
- How much you holdnever
- Your balances or net worthnever
- Your backup, if you make oneciphertext only
With an account we also know your email, your plan and when you signed up.
There are no analytics scripts, no advertising pixels and no third-party trackers on the app or on this website. Hevelly sets no cookies. The app keeps a few settings (your theme, whether the lock is on, a random device id) in your browser's local storage, which stays on the device; if you sign in, the session token is kept there too.
The optional account and the encrypted backup
You never need an account. The app is complete without one, and a backup file from Settings is free. An account adds one thing: a single cloud backup you can restore on a new device.
Signing in is a six-digit code sent to your email. There is no password. Sign-up and sign-in are the same step.
The backup is encrypted on your device before it is uploaded, with a passphrase you choose (at least twelve characters). The key is derived with PBKDF2-SHA256 at 600,000 rounds and a random salt, and the file is sealed with AES-GCM-256 and a fresh IV every time. The passphrase never leaves your device. The server stores the ciphertext, the salt, the IV, the round count and a version byte, and nothing it can read.
If you lose the passphrase, the backup cannot be read, by you or by us. There is no reset, because a reset would mean we could read it too. The app says this before you set one. Your data on the device is unaffected; a new passphrase simply makes a new backup.
A free account holds one backup from one device at a time. Restoring on another device is always allowed; uploading from another device needs a move, which can happen once every 30 days. Hevelly Plus, when it arrives, adds continuous sync across devices and a history of backups, with the same encryption.
What we store about an account
| Your email address | To sign you in with a one-time code and, if you opt in, to send product updates. |
|---|---|
| Your plan | Free, or Hevelly Plus once it exists. Only our billing code can change it. |
| When you signed up | A timestamp. |
| Your country | Optional. Two letters, only if you choose to tell us. |
| The usage opt-in | Off by default. Nothing is collected yet even when it is on; when it is, it will be counts of screens and features, never amounts, names or places. |
| One encrypted backup | Ciphertext, salt, IV, round count, a version byte, a device label such as "iPhone, Safari", and the dates. Not the key. |
"Delete my account" in Settings removes the backup and the profile, then the sign-in record. Your data on the device stays.
The app lock is a screen lock
You can lock Hevelly with a 4 to 8 digit PIN, and add Face ID or Touch ID where your device offers it. The PIN is checked on the device (only a salted verifier is stored), wrong guesses slow down, and the screen is covered the moment you switch apps so the app switcher shows nothing.
The lock covers the screen. It does not encrypt the data in your browser. Someone with full access to your unlocked device and its files could still read the database. If that is a concern, use your device's own encryption and lock screen, which protect everything on it. A forgotten PIN has one way out: clearing Hevelly's data from the browser and restoring a backup.
What Hevelly does not do
- It does not connect to banks, brokers or exchanges, and never asks for their logins.
- It does not sell, share or analyse your figures. It cannot: it does not have them.
- It does not buy, sell, cancel or move anything. "Log a buy" writes a line in your records and nothing else.
- It does not give financial advice. The runway figure and the trends are arithmetic on your own numbers.
Questions, or something on this page that does not match what you see in the app? Write to privacy@hevelly.com. The formal version of all this is the privacy policy.