Privacy policy

Operator

The service is operated by Novaulta.com. See the GDPR and Turkish KVKK notices for details of personal-data processing.

Data on our server

Google sign-in processes your Google account identifier, name, email, the profile photo link Google provides (the photo itself is not downloaded or shown in the app), sessions and necessary security metadata in Cloudflare D1. Each session record holds the IP address and browser it was opened from. We also keep the last backup method and time and a short-lived sync lock. Google access and refresh tokens are stored encrypted; the ID token used during sign-in is not stored.

• Assets, liabilities, monthly records, goals and vault passwords are not stored on Novaulta servers.
• A session cookie keeps you signed in. A session ends six to seven days after you last used the service; while you use it, it is extended once a day.
• Yahoo Finance and TEFAS price lookups go through our server. The server does not link them to your account or write them to a database; the answer for a symbol is shared by everyone in the Cloudflare cache for a few minutes (a day for past closes). A one-minute request counter per IP address limits abuse.

Data on your device

Your financial vault is encrypted in browser IndexedDB using an Argon2id-derived key and AES-256-GCM. AI API keys and the WebDAV address, username and password are also stored inside this encrypted vault and are synced and backed up with it. Language, device ID, the last fetched rates, the last sync time, Google Drive connection preferences and the ID of the account last verified in this browser with the time of that check (so the vault can still open without a connection; signing out removes it) are kept unencrypted in browser local storage; they hold no financial records.

• An optional Google Drive or WebDAV backup stores only an encrypted vault file in your own account.
• We do not receive your vault password and cannot reset it.

Cookies and browser storage

Essential session and OAuth cookies, IndexedDB and local/session storage support the app. We currently do not use advertising or behavioral analytics cookies. Optional analytics or marketing cookies would require a separate choice. Clearing browser data can erase your local vault, so export an encrypted backup first.

• Session cookie: account access.
• Language cookie: remembers the language you chose, so pages open in it.
• IndexedDB: encrypted vault, local backups and optional remembered device key.
• localStorage: language, device ID, last fetched rates, last sync time, Google Drive connection preferences and the account last verified here, for opening offline.
• sessionStorage: temporary Google account-link verification, the figures you enter in the F.I.R.E. calculator and a plan waiting to be added to your vault (this tab only, cleared when you sign out).

External services and international transfers

Google and Cloudflare process sign-in data. Most requests below go directly from your browser, so these services see your IP address, browser details and that the request comes from Novaulta. Yahoo Finance and TEFAS requests go through our server instead, so those services see Cloudflare rather than your IP address. Rate, price and inflation queries carry only public values such as a symbol, currency, country or date, never your quantities or amounts. These providers may process data abroad; review their terms before use.

• Google (from your browser): Google sign-in; if you choose a Google Drive backup, Google's sign-in script and the Drive API. Only the encrypted vault file is uploaded to Drive.
• WebDAV (from your browser, only if you set it up): the server you choose sees the encrypted vault file and your IP address.
• Current exchange rates and metal prices (from your browser): open.er-api.com, Frankfurter (api.frankfurter.app), gold-api.com and the open-source currency-api via jsDelivr (cdn.jsdelivr.net). Requests carry only a currency or metal code.
• Month-end rates for a past month (from your browser, when you enter a monthly record for a past month): Frankfurter for European Central Bank rates (api.frankfurter.dev, with api.frankfurter.app as fallback) and dated copies of currency-api (cdn.jsdelivr.net, with currency-api.pages.dev as fallback). Requests carry only the date.
• Inflation data (from your browser, on analysis screens): monthly price indices from OECD (sdmx.oecd.org) and, when you ask for it, annual inflation from the World Bank (api.worldbank.org). Requests carry only the country or area and the range of years.
• Yahoo Finance and TEFAS (through our server): current prices, symbol search and past month-end closing prices. Requests carry only the symbol, fund code or search text and, where needed, the date.
• Cloud AI (from your browser, only after a separate opt-in): your question goes to the OpenAI, Anthropic or Google (Gemini) service you choose. If you choose to share financial data, the portfolio summary you can preview on screen and the earlier messages of the chat are sent too. Changing the cloud AI provider resets your previous permission.
• Ollama connects to a local service on your device. An Ollama cloud model, whose name ends in -cloud or :cloud, runs on Ollama's servers, so that service passes your question and, if you choose it, the portfolio summary on to Ollama; it asks for the same permission as the other cloud providers.
• When you press “List models”, only your API key is sent to the provider you chose (OpenAI, Anthropic or Google); for Ollama the list comes from the service on your device.
• Google Calendar (only if you click it): adding the monthly reminder opens Google Calendar with the reminder's title and description.

Retention and deletion

Account and backup metadata remain while your account is active. Expired sessions, with the IP address and browser details they hold, are deleted within a day. Request counters kept with an IP address to limit abuse are deleted an hour after the last request, within a day at the latest. Deleting the account in Settings removes account records, sessions, backup metadata and sync locks from D1, and withdraws the access you gave Novaulta in Google through Google's revoke endpoint (oauth2.googleapis.com/revoke). Also deleting this browser's vault and account data is optional; you choose it on the deletion screen. Local vaults on other devices and encrypted backups in your personal cloud account are not automatically deleted. Security logs and third-party records may follow their own retention periods.