HEVORA Privacy Policy

What we collect

When you create an account or sign in with e-mail:

• the e-mail and name you enter;
• your password, stored only as a one-way hash (never as plain text);
• IP address, browser type and sign-in time, for the list of signed-in devices and for security;
• security records: sign-up, sign-in, failed sign-in, temporary lock, password reset events (e-mail addresses are masked in the records).

Sign in with Google

If you choose "Continue with Google", HEVORA asks Google for three basic things only: basic identity (openid), your e-mail address, and your basic profile. From these we receive your e-mail, name, profile picture and your unique Google account number.

We do not ask for and do not read your e-mail, contacts, calendar, Drive files or any other Google data.

Data from Google is used only to create your HEVORA account, or to connect Google to an existing HEVORA account with the same e-mail address (and only when Google states that address is verified), and to show your name and picture on your account. It is not sold, not used for advertising, and not shared with anyone beyond the processors listed below.

HEVORA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we use it for

Only to run the app: recognise you when you sign in, keep the account safe, send verification and password-reset e-mails, manage subscriptions, and diagnose problems. We do not sell data and do not use it for advertising.

Who helps us (processors)

Each party receives only the minimum needed for its task:

• HEVORA's own server and database (accounts and sessions are stored there);
• an e-mail delivery provider (SMTP) for verification and password-reset e-mails;
• DOKU for payments in rupiah; crypto payments are read directly from public blockchains;
• Cloudflare, as the network in front of the server for security and speed.

Cookies and browser storage

We use one secure session cookie (httpOnly, Secure, SameSite) to keep you signed in, and browser local storage for language, theme and a copy of the last data shown. There are no advertising or tracking cookies.

How long we keep data

Account data is kept while the account is active. Sessions last 30 days. Security records are deleted automatically after 12 months. Order and payment records are kept as long as needed for bookkeeping and disputes, and remain even if the account is deleted.

Your rights

On the HEVORA Account page you can view and change your name, change your password, see signed-in devices, sign out of all devices, and delete your account. Deletion is refused while a subscription is active; end it first or contact us.

To withdraw Google's permission, open your Google account, "Security", then "Third-party apps with account access", and remove HEVORA.

Children

HEVORA is not meant for anyone under 18 and we do not knowingly collect their data.

Changes to this policy

If this policy changes, the date above is updated; important changes are announced by e-mail or in the app.

Contact

Write to [email protected].