Privacy

The short version: the app stores what you put into it, plus your email address so it can recognise you. There is no analytics, no advertising and no third-party tracking — none at all. The details are below, without the legal language.

Who is responsible

SviyLad is one person's personal project, not a company. It runs on Amazon Web Services in Ireland (the eu-west-1 region). Questions about your data go to support@sviylad.dev.

What is stored

• Email address and password. The address identifies you at sign-in and receives account email. The password is stored only as an Argon2id hash — the password itself is not in the database and cannot be recovered from it.
• Whatever you enter yourself: payments, loans, subscriptions, tasks and habits. That is what the app is for.
• Optional: time zone, language, theme, reminder hour and a Telegram chat id. The chat id is stored only if you enter it yourself.
• Technical: records of your sessions, a security log (sign-in, password change) with IP address, User-Agent and timestamp, and rate-limit counters. The counters store an HMAC of the address rather than the address itself, so no email or IP sits there in the clear.

What is not stored: analytics, ad networks, third-party trackers, or anything at all about you outside the app.

Why it is needed

Only to make the app work: to show your entries, let you into your account, and send the account email and the reminders you asked for. The security log and the request counters exist so that nobody else can sit there guessing your password.

Your data is not sold, not passed to advertisers, and not used for profiling or for training models.

Email

Email is only ever sent in response to something you did. There are exactly five kinds: address verification, password reset, a notice that your password changed, a family invitation, and the reply that an account already exists for that address.

There are no newsletters, no announcements and no marketing email — so there is nothing to unsubscribe from. Reminders arrive on Telegram rather than by email, and only if you switched them on yourself. An address that is never confirmed hears from us no further.

Email is sent through Amazon SES from the sviylad.dev domain.

Cookies and browser storage

• The session cookie keeps you signed in. It is HttpOnly and Secure, so scripts on the page cannot read it.
• The theme cookie remembers light or dark, so the page does not flash the wrong colour while loading.
• localStorage holds the language you picked before signing in.

All three are needed for the app to work. There are no analytics or advertising cookies — which is why there is no consent banner.

Who else sees this data

• Amazon Web Services (Ireland) — the server, the database and email delivery.
• Cloudflare — DNS and the protected entry point for traffic. The sign-up page uses Turnstile, the "are you a robot" check.
• Telegram — receives the text of a reminder, and only if you entered your chat id.
• Google Fonts — both this page and the app load fonts from Google's servers, so your browser contacts them and Google sees your IP address. It is the only third-party request that happens without an action on your part.

Nobody else. Data is not sold and is not handed to third parties for their own purposes.

How long it is kept

• Account data — for as long as the account exists.
• An address-verification link lasts 24 hours, a password-reset link 60 minutes, an invitation 7 days, a session 30 days.
• A deleted family is erased for good after 30 days; until then it can still be restored.
• Rate-limit counters are cleared automatically every day.

Your rights

Your address, language, theme and chat id can be changed in Settings yourself. For a copy of your data, a correction, or full deletion of the account, write to support@sviylad.dev.

If you are in the EU, the GDPR gives you the right to access your data, correct it, have it deleted, restrict its processing, take it elsewhere, and complain to a supervisory authority.

Changes

If this page changes, the date at the top changes with it. For material changes affecting data already collected, we will write to the address on the account.