Privacy Policy

1Who we are

Qelvori is developed by Farouk Hoblos ("we", "us"). Questions about this policy or your data: Byteweave@gmail.com.

Because Qelvori keeps your data on your own device, we do not collect, receive or store your personal or financial information, and we have no way to access it.

2Data stored on your device

Everything you put into Qelvori is saved in a local database on your computer (on Windows, in %APPDATA%\Qelvori). The optional demo workspace contains only made-up sample data and is kept in a separate database in the demo folder inside it. What Qelvori saves:

• Money: your accounts and their balances, names and currencies; transactions you add, split between categories, import from a statement (PDF, CSV, OFX or QFX) or paste from a bank or wallet alert; transfers between your accounts.
• Plans: bills, subscriptions, income, categories, categorisation rules, budgets and your smart budgeting plan (including what it looked like when you last looked, so it can explain what changed), savings goals, loans and instalment plans, and the exchange rates you set.
• Credit cards: a nickname, limit, statement and due dates, the card network and expiry, and the last 4 digits. If you choose to save a card's full number, it is stored encrypted with your Windows account's protection and is only decrypted on your computer, after you enter your PIN, when you ask to see it. Qelvori never asks for or stores a card's security code (CVV). See Add from Chrome below for adding a card from your browser.
• Settings: your appearance, layouts, language and reminder choices, which workspace you're in, your Qelvori Plus license key and Plus code key if you have them, and which reminders have already been shown, so each appears once.
• The lock: your app PIN, kept only as a one-way, salted hash (the PIN itself is never saved), the count of recent wrong tries, and the phone number you give when setting it up. They are in security.json next to your data. The phone number isn't sent anywhere or used for anything yet.
• Your agreement: the version of the Terms of Service and this policy you agreed to, and when (in terms.json).
• Linked Google accounts: the data described in section 4.
• Sync: if you turn it on, a random id for this device, how far it has synced, and when it changes each record. The sync key and the Google Drive sign-in are kept outside the database (so backups never contain them): on Windows in sync.json, encrypted with Windows Data Protection; on Android in the app's private storage, where only Qelvori can read it. See Sync.

Qelvori also keeps automatic backups of your database in the backups folder: one each time it starts, and one before you start over or restore a backup. The newest 10 are kept.

On iPhone. The iPhone app is a web app you add to your Home Screen from qelv-app.netlify.app. It keeps the same data as above in that Home Screen app's own storage on your iPhone (its database, backups, lock and sync files), protected by your iPhone's encryption, and keeps a copy of the app's own files there so it opens without a connection. iOS deletes that storage if you remove Qelvori from your Home Screen, so turn on Sync or save a backup file now and then. If you turn on Face ID or Touch ID for Qelvori, your iPhone makes a passkey called “Qelvori unlock” for that site; it stays in your iCloud Keychain (listed in the Passwords app), is used only to open the app on the iPhone, and nothing about it is sent to us.

If you import a password-protected PDF statement, the password is used only to open that file on your computer. It is never saved. Pasted alerts are read for the transaction they describe; the pasted text itself is not kept.

Add from Chrome

Chrome only offers the cards saved in it on secure web pages, so Add from Chrome opens a card page on this website in Chrome (or your default browser). The page's address carries a one-time code after the #, a part of the address browsers never send to a website. When your browser fills in a card, the page hands it straight to Qelvori on your own computer (127.0.0.1), the only place the page is allowed to send it. The card never reaches this website or us. Qelvori stops listening after one card, or after 10 minutes. If the card comes from your Google account (Google Pay), Google's own terms and privacy policy cover that.

3How Qelvori works things out

Forecasts, safe-to-spend, budgets, the smart budgeting plan and its suggestions, insights, net worth over time, currency conversions, categorisation rules and the automatic detection of salaries, bills and subscriptions are all calculated on your computer from your data. Nothing is sent anywhere to do this, no artificial-intelligence service is used, and no decisions about you are made by anyone but you.

Reminders are shown as Windows notifications: names and amounts of upcoming payments, free trials ending and budgets running low. Depending on your Windows settings they may appear on your lock screen and stay in the notification centre. On Android they are scheduled on the phone itself. On iPhone, see iPhone reminders.

4Google user data

Linking a Google account, and turning on Sync, are optional and each requires your consent on Google's own sign-in page (on Android, you pick the account from the phone's own list of Google accounts, then Google's own screen asks for your consent; on iPhone, the app goes to Google's sign-in page and comes back). Qelvori never sees your Google password.

Permissions we request

What is accessed

Qelvori runs two searches of your mailbox, each covering roughly the last 13 months and up to 300 emails per sync:

• emails that look like receipts or subscription notices (for example emails mentioning a receipt, invoice, subscription, renewal, membership, free trial, cancellation, refund or return window);
• emails that look like transaction alerts from a bank, card or wallet (for example emails mentioning a card ending in certain digits, a transaction, debit or credit alert, an available balance, a purchase or withdrawal, or money received or sent).

For those emails it reads the sender, subject, date and body text on your device. An email is treated as a transaction alert only if it comes from a bank, card issuer or wallet and is worded like one, so a shop's receipt that mentions your card is never read as an alert.

How it is used

• Receipts and subscription emails are used to detect subscriptions: the service name, price, billing frequency, next renewal date, and whether it is a free trial or has been cancelled. Those findings are added to your subscription list, and each charge in a receipt is recorded as a payment of that subscription (taken off your balance, or kept as already included, or, when it can't tell, Qelvori asks you). With Plus, the same receipts also show a return window closing, a refund you were promised (so you can check it arrived), a subscription charged twice within a week and a bill much higher than usual: the shop or service name, the amount and the date, kept on your device.
• Transaction alerts are used to record the money they describe: the bank or wallet name, the card's last 4 digits only (never a full card number), the amount and currency, the merchant or the person who sent or received the money, the date, and any balance the alert states. A card or wallet seen for the first time is added to your accounts, and its transactions are added to it.

Gmail data is used for nothing else.

What is stored, and for how long

• For emails that look like receipts or transaction alerts: the sender, subject, date and time it arrived, and up to 2,500 characters of the email's text, kept on your device so later syncs don't need to download them again.
• For other matching emails: only Google's message ID, so they aren't downloaded again.
• Email excerpts are deleted automatically after about 15 months, and all stored email data for an account is deleted when you unlink it.
• Your Google sign-in (an OAuth refresh token) is stored only on your computer, encrypted with your operating system's protection (Windows Data Protection API). Short-lived access tokens are kept in memory only. The Android app stores no Google sign-in at all: Google Play services on the phone keeps your permission and gives Qelvori a short-lived access token when it syncs, kept in memory only. The iPhone app gets a short-lived access token (about an hour) straight from Google's sign-in page and keeps it in its storage on your iPhone until it expires; it has no lasting sign-in, so when its tokens have run out, opening it makes a quick trip to Google's page for new ones. These tokens never pass through our servers.
• A backup file you save yourself contains the email excerpts but never your Google sign-in (see section 7).

The app's Google credentials

Every copy of Qelvori contains the same Google OAuth Client ID and client secret. They identify the Qelvori app to Google — like an app's name tag — and are identical for everyone who downloads it. They are not tied to you or your Google account, and on their own they cannot read anyone's email: access only happens after a person signs in on Google's page and approves it, and that access belongs to that person alone. Google treats desktop apps as "public clients" for exactly this reason, and Qelvori also uses PKCE, a sign-in safeguard that stops anyone else from completing your sign-in. The Android app contains no client secret: Google recognises it by its package name and the certificate it is signed with. The iPhone app contains only a Client ID (no secret): Google sends its sign-ins back only to the iPhone app's own address, and Qelvori checks with Google that each token was issued to it.

When Qelvori talks to Google

Only when you link an account, when you press Sync, and automatically shortly after Qelvori starts, then about every 30 minutes while it is running, and when you unlock it, when your computer wakes from sleep or when its window comes back from the tray (at most every 5 minutes). These requests go directly from your computer to Google (accounts.google.com, oauth2.googleapis.com and gmail.googleapis.com). On Android: when you link an account or press Sync, when you open Qelvori or come back to it (at most every 5 minutes), and about every 30 minutes while it is open; sign-in goes through Google Play services on the phone, and emails come directly from gmail.googleapis.com. On iPhone: the same, while Qelvori is open (iOS gives web apps no background time); sign-in goes through Google's page (accounts.google.com), each token is checked at oauth2.googleapis.com, and emails come directly from gmail.googleapis.com. They never pass through our servers.

Sharing

We do not receive, sell, rent or share Google user data. It is not transferred to any third party, not used for advertising, not used to determine credit-worthiness or for lending purposes, and not used to develop, improve or train artificial-intelligence or machine-learning models. No person reads your emails — not even us.

Qelvori's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access

In Qelvori, open Accounts or Settings → Linked Google accounts and choose Unlink. Qelvori revokes its access at Google and deletes all stored email data for that account; you can choose to keep or remove the subscriptions it found. Cards and transactions already recorded from alerts stay in your accounts, and you can archive them under Accounts → Connections. Forgetting your PIN, or uninstalling the Windows app with your data deleted, also revokes access first. Uninstalling the Android app, or removing the iPhone app from your Home Screen, can't tell Google, so unlink first or remove access as below. (On iPhone, Qelvori can end its access at Google only while it holds a token that hasn't expired.) You can also remove Qelvori's access at any time from your Google Account at myaccount.google.com/permissions.

Sync

Sync is optional (part of Qelvori Plus). When you turn it on, Qelvori keeps these files in the hidden app folder of the Google Drive account you choose: a small file naming the sync group, one per device (its name, such as your computer's name or “Phone”, and how far it has read), numbered files with the changes each device made, and from time to time one full copy of your Qelvori data. Every file is encrypted on your device (AES-256-GCM) before it is uploaded, with a key that is made on your device and passed to your other devices only by the pairing code (a QR code, or 52 letters and digits) you show them. That key is never sent to us or to Google, so neither we nor Google can read your synced data. Your Gmail sign-ins, the email excerpts Qelvori keeps, saved card numbers, your PIN and the look of the app are not synced.

Your devices talk to Google Drive directly (www.googleapis.com): when you open or unlock Qelvori, shortly after you change something, and about every 5 minutes while it is open. Turn Sync off in Settings → Sync: “Only on this device” stops syncing there; “Everywhere” also deletes everything in the hidden folder. Restoring a backup, starting over or forgetting your PIN turns Sync off on that device first, so your other devices keep their data. You can also remove Qelvori's access at myaccount.google.com/permissions.

5Network connections

Apart from the Google connections described above, the Qelvori app connects only to this website, and only for these things:

• Updates. Shortly after it starts and then every 4 hours, the installed app reads a small file from this website (updates/latest.yml) to see whether a newer version exists. If one does, it downloads it from here, checks the download's fingerprint, and installs it when you restart. Nothing about you or your data is sent; like any web request, our host (Netlify) sees your IP address.
• License renewal. If you subscribe to Qelvori Plus, near the end of each paid period the app sends your license key to our license service on this website. The key contains the name or email address from your purchase and your Paddle subscription number. The service asks Paddle whether the subscription is still paid and sends back a key for the new period. Nothing else is sent.
• Free trial. Qelvori Plus is free for your first 14 days, once. So that the trial isn't given again after a reinstall or Start over, when a Google account is linked the app sends our license service a one-way fingerprint of that account's email address (a SHA-256 hash, not the address itself) and the day your trial started. The service keeps the earliest day it has seen for that fingerprint and sends it back. Nothing else is sent, and the fingerprint can't be turned back into your address.
• Plus codes. If you redeem a Qelvori Plus code, you choose one of your Google accounts for it (signing in to it if it isn't linked yet), and the app sends our license service the code and a one-way fingerprint of that account's email address (a SHA-256 hash, not the address itself). The service records that the code now belongs to that fingerprint, so it can't be used with another account, and sends back a key that the app checks offline. Plus then stays on while that Google account is linked in the app. Nothing else is sent.
• Help. If you use Help (in the app or on this website), what you type there is sent to our support service on this website and to the AI service that writes the answer: Groq (an open AI model it runs; Groq keeps no messages by default) or Anthropic (the company that makes the Claude AI model). If neither is available, your message goes straight to us instead. Help never sends your accounts, balances, transactions or anything else from the app: only the conversation, the app's language, whether you use Windows, Android, iPhone or the website, and the app version. Long numbers that look like card, account or ID numbers are removed before anything is sent or kept. Conversations aren't kept, unless the assistant passes one to us (a problem it couldn't solve, a complaint, a refund or payment question, an idea, or a question it couldn't answer): then it is kept in this website's storage so we can read and answer it, and our replies appear in your Help. Once one of us replies, you are talking with that person: the assistant stays out of that conversation until we hand it back, and your messages come straight to us. When we need to know about a conversation, we are emailed a short summary and your latest message through Resend, the email service we use; Resend delivers that email to us and doesn't use it for anything else. To keep usage fair we tell visitors apart by a scrambled (salted hash) form of their IP address, kept for no more than two days. Ask us any time to delete a conversation.
• iPhone reminders. If you turn on notifications in the iPhone app, it schedules its reminders through our website, because iOS doesn't let web apps schedule notifications themselves. Your iPhone encrypts each reminder for itself (Web Push encryption, with keys only your iPhone holds) before sending our reminder service the encrypted messages, when to send each one, your iPhone's push address at Apple, and a random secret that lets only your iPhone change that schedule. At the right time our service passes the encrypted message to Apple's push service, which delivers it; neither we nor Apple can read it. The schedule is replaced each time your data changes, and deleted when its last reminder has been sent, when you turn notifications off, or when you start over after forgetting your PIN. Reminders more than a few hours late are dropped, not sent.
• The iPhone app's own files. The iPhone app is loaded from qelv-app.netlify.app, keeps its files on your iPhone, and checks that address for a newer version when you open it. Plus codes, renewals and Help work from the iPhone app as described here.
• Ask Qelvori's language model. Ask Qelvori answers questions about your money on your device, from your own numbers, and never sends your questions anywhere. If you choose to download its language model (in Ask or in Settings), the app fetches the model's files once from Hugging Face, the public library where the model is published (about 135 MB). Like any download, that request shows Hugging Face your IP address and that a file was fetched; nothing about you or your money is sent. The app checks each file against a fingerprint built into it before keeping it on your device, where it understands your questions without a connection. You can remove it in Settings.
• Voice. You can talk to the assistant (Ask Qelvori) and to Add transaction instead of typing. The microphone is used only while it’s listening: when you press the mic, or, in an assistant conversation you opened, once right after it asks you something out loud, so you can just answer (you can turn that off in Settings → Assistant). Qelvori asks for permission the first time: Windows or your phone shows its own prompt. What you say is turned into text on your device by a speech model (OpenAI’s Whisper) and then handled like typed text; the sound is kept in memory only for those few seconds, never saved and never sent anywhere. To help the model spell them, the names of your bills, subscriptions and goals are given to it on your device. If you choose to download the voice model (in Ask, Add transaction or Settings), the app fetches its files once from Hugging Face (about 80 MB); as with Ask’s model, that request shows Hugging Face your IP address and nothing about you or your money is sent, and each file is checked against a fingerprint built into the app. You can remove it in Settings.
• Spoken replies. The assistant can say its replies out loud. The speech is made on your device with its own voices (on Windows and iPhone, the system’s voices that run on the device; on Android, the phone’s text-to-speech with voices that work offline), so nothing it says is sent anywhere. If your device has no voice for the app’s language, it shows its replies without speaking them. You can turn talking off, or pick the voice and speed, in Settings → Assistant.

Some buttons open a page in your browser instead: this website's pages, the Plus purchase page, Google's sign-in page and the Add from Chrome card page. The purchase page can hand your new license key to the app through a qelvori:// link, which goes from your browser to the app on your computer and nowhere else.

The app contains no analytics, telemetry, crash reporting or advertising. License keys are checked on your computer, offline. The app does not process payments.

6This website and purchases

This website uses no cookies, analytics or third-party scripts, and its fonts are served from this site. There is one exception: the Qelvori Plus purchase page loads Paddle's checkout from paddle.com to take your payment, and Paddle may use cookies and similar technology there for checkout and fraud prevention. The Add from Chrome card page loads nothing from other sites and may only talk to the Qelvori app on your own computer. Like any website, our hosting provider may keep standard server logs (such as IP address and pages requested) for security and reliability.

Purchases are handled by Paddle, our reseller and Merchant of Record. You give your payment details to Paddle, not to us; Paddle's privacy notice covers them. From Paddle we receive your name, email address, country and the status of your subscription. We use them only to issue and renew your license key, to help you if you contact us, and to keep records the law requires. Our license service stores each key it issues with its Paddle transaction and subscription numbers, so the purchase page can show it to you and the app can renew it. For each redeemed Plus code it stores a hash of the code, the account fingerprint it belongs to, the key it issued and the date.

In the Microsoft Store version, Plus is bought from Microsoft, and Microsoft's privacy statement covers your payment and account details. The app asks the Microsoft Store on your device whether your Plus subscription is active; that check is between your device and Microsoft. Microsoft gives us sales and payout reports, not your payment details.

7Keeping, exporting and deleting your data

• Export: Settings → Your data saves your transactions and recurring items as CSV files.
• Backup file: Save backup file writes everything to a .qelvori file wherever you choose. It is not encrypted: it holds your financial data, your license key and the email excerpts Qelvori keeps, so store it somewhere safe. Saved card numbers and Google sign-ins are left out; after restoring, you sign in to Google again.
• Restore: replaces your data with a backup file or an automatic backup. A copy of what was there is kept first.
• Start over: Settings → Start over erases your accounts, transactions, bills, subscriptions and linked Google accounts (your license key, Plus code, language and appearance are kept). A backup is taken first so you can undo it with Restore; delete it from the backups folder if you don't want it.
• Forgot your PIN: starting over from the lock screen ends Google access, erases your data and all its automatic backups, and lets you choose a new PIN.
• Delete everything: Settings → Uninstall Qelvori with Also delete my data from this computer ticked ends Google access and removes the app and the whole %APPDATA%\Qelvori folder, backups included. Uninstalling from Windows Settings keeps that folder, so delete it yourself if you want it gone.
• Google data: unlink the account as described in section 4.
• iPhone: backups and exports go through the share sheet (Save to Files, for example). Removing Qelvori from your Home Screen deletes its data on that iPhone.

Because your data never reaches us, we cannot view, recover or delete it for you. It is entirely under your control on your device.

8Security

• Qelvori asks for your PIN every time it opens, when it comes back from the tray and after Windows locks; until then, none of your data reaches its window. After 5 wrong tries you wait before trying again, a little longer each time.
• Your PIN is kept as a slow, salted hash. Saved card numbers and your Google sign-in are encrypted with your Windows account's protection, so they can't be opened on another computer or Windows account.
• A card number you copy is cleared from the clipboard after 30 seconds, unless you've copied something else since.
• Gmail access is read-only, the database is written safely to avoid corruption, and backups are kept on your computer.
• On iPhone, Face ID or Touch ID can stand in for typing the PIN to open the app; the PIN still works. The iPhone app's site lets no other site show it in a frame and runs only its own scripts.

Because your data lives on your computer, its security also depends on your device: we recommend a password-protected Windows account and disk encryption (such as BitLocker), and keeping backup files somewhere only you can reach.

9Children

Qelvori is not directed at children under 13 (or under 16 where local law requires) and we do not knowingly collect their data.

10Your rights

Depending on where you live (for example under the GDPR or CCPA), you have rights to access, correct, export and delete your personal data. Since Qelvori stores your data only on your device, you can exercise these rights directly in the app as described above. For the purchase details Paddle shares with us, write to Byteweave@gmail.com.

11Changes to this policy

The first time you open Qelvori, it asks you to agree to this policy and the Terms of Service. If we change how Qelvori handles data, we will update this page and its effective date before the change takes effect, and the app will ask you to agree again the next time it opens. If a change affects Google user data, we will ask for your consent again where required.

12Contact

Farouk Hoblos — Byteweave@gmail.com — qelv.netlify.app