Privacy policy

Effective date: 2026-11-02

This policy explains what data the dvnt apps (the account app and the apps at *.dvnt.app, such as perfect me, Notes, contrée, Billiard, Rubik's and Vault) handle, where it is kept and what you can do about it. The service is run by dvnt. Contact: davidanaton@gmail.com.

In short

• Most of what you enter in the apps stays on your device.
• To sign in we keep a small account record from Google: your Google account ID, email, name and picture.
• Some features you turn on store data on our servers (contrée Cloud backup, shared game links, TV mode, Notes Cloud storage) or in your own Google Drive (Drive sync).
• When you play contrée online, the table (every player's cards included) is kept on our servers while it is open, and the finished game goes into each player's History.
• When you play contrée nearby (no internet), the phones connect to each other directly; the host's phone keeps the table, and the camera reads QR codes on the phone without recording or sending images.
• You have a dvnt-wide @username. People who type your exact username see it along with your first name and picture; friends you add in an app also see your full name. Never your email.
• openGym, the gym tracker at gym.dvnt.app, has its own profiles and sign-in (passkeys); with a profile, your training and body data are kept on our servers.
• There are no ads, no analytics and no trackers, and we never sell your data.

1. Your account and sign-in

You sign in with Google. dvnt is invite-only: an account works only if its email is on our allowlist, and access can be limited to some apps or to a period of time.

When you sign in, we store:

• your Google account ID (the sub identifier), email address, name and profile picture URL;
• when your account was created and when it was last seen;
• which apps you can use and when that access ends, and, if you joined through an invite link, who invited you and for which app;
• your username (your @handle, the same in every dvnt app) and a log of its changes: the old and new name, who made the change (you, the administrator, or the system for the default) and when;
• your sign-in sessions: a random session ID, a hash of the session secret (never the secret itself), and when the session was created, last used, expires or was revoked.

Access requests. If you sign in with an email that is not on the allowlist, we store your email, name, picture, the time of the attempt and, if you used an invite link, who invited you and for which app. The administrator is notified so they can approve or delete the request.

2. Google permissions

The sign-in screen asks Google for exactly these scopes:

• openid, email, profile: to know who you are (account ID, email, name, picture);
• https://www.googleapis.com/auth/drive.appdata: access to a hidden folder in your Google Drive that only dvnt can use (the “app data” folder). It does not give access to any other file in your Drive.

When Google returns a refresh token at sign-in, we store it encrypted (AES-256-GCM) together with the list of granted scopes. It is used only for the Drive sync feature: to get short-lived Google access tokens when an app syncs with your Drive. If you revoke dvnt's access in your Google account, the stored token stops working and we delete it the next time it is used.

We use Google user data only to provide the features described in this policy. We do not sell it, use it for advertising, or share it with anyone else.

3. Data on your device

By default, what you enter in the apps (habits, goals, journal entries, games and scores, player names, vault items, settings and so on) is stored only in your browser, in IndexedDB or localStorage. It does not leave your device unless you use one of the features below or export it to a file yourself. Notes, and perfect-me's journal when you have Notes, are the exception: they use Cloud storage unless you choose otherwise (see Notes). contrée's nearby play also keeps, on the device only and never synced: the table you host (every hand included), the table you joined, and your copies of nearby games others hosted (see Playing nearby).

4. Google Drive sync (optional)

If you choose Drive storage in an app's settings, that app keeps a copy of its data in the app data folder of your own Google Drive. That copy is stored by Google, not on dvnt servers. You can remove it from your Google Drive settings (manage apps) and revoke dvnt's access at any time in your Google account.

5. contrée: Cloud backup, shared links and TV mode (optional)

Cloud backup. If you choose Cloud storage in contrée, your games (including the @username and picture of the players at each game who have a dvnt account), the player names you entered, your contrée settings, the game in progress, the lessons you marked as done and the bidding systems you made are stored on dvnt servers, linked to your account, so they sync across your devices. You can delete the whole backup in contrée Settings: the games on the device you delete it from are kept there, and your other devices remove their copy the next time they sync, so the deleted data doesn't come back.

Shared game links. When you share a game, anyone with the link can see it without signing in: team names, player names, bids and scores. The page asks search engines not to index it (noindex). A link keeps working until you revoke it, delete the game, or delete your Cloud backup. Apps you paste the link into (for example messaging apps) may fetch its preview. A link shows the game as it is when someone opens it; it does not update live. If you start a rematch of a shared game, the rematch is shared too and the old link shows a link to it, so people who have the old link can see the new game; stop sharing the rematch to end this.

TV mode. A screen can open contrée's TV page without an account; it shows a QR code. When you scan it with your phone, signed in, we store a TV session linked to your account: a random code, a hashed secret only that screen knows, and when it was paired and expires. The screen then shows your game in progress, the next ones included (team names, player names, bids and scores; for the players at the table who have a dvnt account, which can include your friends, their @username and picture), and the bids of the round being played, which your phone sends to our servers while a TV follows you. Anyone who can see the screen sees them. It stops when you stop it from your phone, after 12 hours, or when you delete your Cloud backup; a code nobody scans expires after 15 minutes. TV mode needs Cloud storage.

Online games. When you create or join an online table in contrée, our servers keep the table while it is open: who is at it (account ID, first name, @username and picture), the rules, the team names and colors players choose, each player's chosen teammate, the dealer chip, who pressed Ready, whether the game counts for the rating, and once the game starts every card dealt and played, every bid and the scores. Only the server sees all the hands; each player receives only their own cards and what the table shows. The other players at the table see your first name, picture and @username on the lobby, at the table and in your player card, where they can send you a friend request. When two players at a table have the same first name, the others also see the first letter of each one's last name, taken from their account name ("David A."), or their @username if that isn't enough; that name stays in the recorded game. A table has a 5-character code and a link (/t/<code>): anyone signed in with the code or link can see the lobby's owner and join while it hasn't started; once it has, only its players can open it. When a game ends, the server records it for all players: the creator gets it in their Cloud backup, the others in their shared games, already approved and final (no approval request: pressing Ready in the lobby agrees to the rules and, for a rated table, to the game counting). A game between two teams of dvnt users, with no bot, at a table its owner left rated, is verified at once and counts for the official rating. A player can leave the table once a game is over; it then no longer lists for them. A game ended early by the players, or after 24 hours without activity, is kept as abandoned and never counted. Online play needs Cloud storage.

Playing nearby. contrée can also be played with people around you with no internet, the phones on the same Wi-Fi or on one phone's hotspot. To connect, the host's phone shows a QR code and the guest's phone shows one back; each phone's camera reads the other's. The camera images are processed on the phone to read the code and are never recorded or sent anywhere; the camera runs only while that screen is open. A QR code carries what two phones need to connect: their addresses on the local network, connection keys, a table number and the app's version. Instead of a QR code, the host can send an invite link, and the guest a reply, by any messaging app the players choose: the link and the reply carry the same connection data (in the link's # part, which browsers don't send to our servers), and that app handles them under its own terms. The phones then talk directly, over an encrypted WebRTC connection (DTLS), with no dvnt server and no third-party relay (no STUN or TURN server). Each guest's phone sends the host its account ID, first name, @username and picture (from the account saved on the phone; nothing can check it offline) and its moves. The host's phone runs the table: it knows every hand, and saves the table (every hand included) on the phone after every move, so the game can resume if the app restarts; it deletes it when the host closes the table, or when the game is over. The other players see your first name, picture and @username, as in an online game. When the game ends, it is recorded on the host's phone as the host's game, with each player's account on their seat; once the host is online with Cloud storage, it is shared for approval with the players who are the host's friends, like any game the host scores, and it isn't verified at once. Each guest keeps a summary of the game on their phone only (the 20 latest), removed when the host's copy reaches them.

6. Notes and the perfect-me journal (optional)

Notes is a Markdown notes app. If you have access to it, perfect-me's journal is part of your notes: each day's journal entry (mood, energy, tags, people, goal and your answers to the prompts) is that day's note. Writing @name in a note creates a note for that person in your notes; its properties can hold details you type about them, such as their first and last name, other names and date of birth.

Where they are kept. You choose it once, in Notes or in perfect-me's settings, and both apps follow it; we store that choice with your account. With Cloud (the default), your notes (their names and folders, text and properties) are stored on dvnt servers, linked to your account, with the earlier versions of each note so you can restore one. With Google Drive, they are kept in one file in the app data folder of your own Drive (see Google Drive sync). With This device only, they stay in the browser; the Notes app and perfect-me then each keep their own and don't see each other's. Your notes are only for you: no one else can read them, and they are not encrypted end to end (the server can read them, as it must to sync and keep their history).

7. openGym (gym.dvnt.app)

The gym tracker at gym.dvnt.app is openGym, an open-source app we run unchanged on our servers. It doesn't use your dvnt account: it has its own profiles, and you sign in to it with a passkey (Face ID, Touch ID, fingerprint or a security key). Creating a profile needs an invite code from the administrator.

With a profile, we store on dvnt servers: the profile name you choose, an email address if you add one to sign in with, your passkeys' public keys (never your fingerprint or face), and what you enter to sync it between your devices: routines, workouts and sets, body weight and goals, settings, and the photos or videos you add to your own exercises. Training and body-weight data can say something about your health; only you and the administrator can see them. The administrator can see the list of profiles and each profile's workout history in openGym's admin dashboard. If you turn on notifications, your browser's push subscription is stored as described in Push notifications; if you pair a new device with a code or QR code, we store that link between your devices.

Activity log. openGym records sign-ins, failed sign-in attempts and administrator actions, with the profile and the time, but no IP addresses.

8. Usernames and friends

Your username. When you first sign in, you get a username made from the part of your Google email address before the @ (with a number added if it's already taken). You can change it in the account app (Username tab) once every 30 days. The administrator can also change it, for example to stop impersonation, and every change is logged.

Who can see it. Other dvnt users can find you only by typing your exact username in an app you both use; there is no way to browse or search the list of users, and lookups are rate-limited. A lookup shows your username, first name and picture, never your email address. Apps fetch this profile information from the account service only when a signed-in user needs it, for example to show their friend list.

Friends (per app; today in contrée, which needs Cloud storage). Friendships are separate in each app. When you add a friend, by their username or with their friend link or QR code, we store both account IDs, who asked, and when the request was sent and accepted. Friends see each other's username, full name and picture. A friend request shows only the first name until it is accepted. In contrée, a friend picked for a game gets their first name as a player name, or their first name and last initial ("David A.") when another player has the same first name; that name is part of the game, like any player name. When you start a game signed in, your own seat (South) is filled in with your first name from your account, or your @username, which you can change before starting; friends who see the game see that name.

• Friend link and QR code: your link contains a random token. Anyone who has it can send you a friend request, which you still have to accept. You can replace the link at any time; the old one then stops working.
• Player names linked to friends: in contrée you can link a name from your games to a friend, or pick a friend when starting a game. Your contrée data (and its Cloud backup) then keeps that friend's account ID and username with the name, and each new game records which seats are friends' accounts. Shared game links never show these account IDs. You can unlink a name at any time.
• Games with friends: when a game you start in contrée has friends at the table, each of them is invited to see it. If they accept, they can see the whole game (team and player names, bids, rounds and scores), live while it's played. They keep it even if you later delete your copy or your Cloud backup, and once someone has accepted, you can no longer delete the game from the server. While it's played they also see the bids as you enter them in the round dialog, and they can show the game on a screen of theirs (TV mode), which stores which game that screen follows until it ends or they stop it. They can archive it on their side. If they decline, they never see it. To do this, our servers keep a copy of each game that has invited friends.
• Checking results and ratings: friends approve a game while it is played, never after: when it ends, its copy is frozen and final. Before a game starts, its owner can choose that it doesn't count for the rating; we store that choice with the game. A rated game where each team has a dvnt user who approved it is "verified": our servers then compute an official rating (ELO) for each of those users and keep, for each game, every user's rating before and after. Your rating and the number of verified games behind it are shown to you and to your friends in that app; a game's rating changes are shown to everyone who can see the game. Ratings are only computed for dvnt users, never for typed names.
• Declining is silent: the person who asked isn't told and keeps seeing their request as pending. We keep the request, marked as declined and hidden from you, until they cancel it; you can still accept it later by searching for their username. For 30 days after you decline, we also keep a record so that a new request from the same person is declined at once, again without telling them.
• Friendships can't be removed, only archived. Archiving hides a friend from your own lists and is visible only to you. Deleting your contrée Cloud backup doesn't remove friendships.

9. Push notifications (optional)

If you turn on push notifications, we store your browser's push subscription (an endpoint URL and its keys) to send you notifications, for example alerts about new access requests, or in contrée a friend request or its acceptance, an invitation to a table, a game to approve, or a game you approved being over. For an app's notifications we also store which app it is and your language, so the text is in that language. Notifications are delivered through your browser maker's push service (such as Google, Mozilla or Apple). Turning notifications off deletes the subscription.

10. Cookies and local storage

We use three cookies, all needed for sign-in, and all httpOnly (not readable by scripts), Secure (sent only over HTTPS) and SameSite=Lax:

• dvnt_account: a signed token with your account ID, email, name and picture, valid for one hour, shared by the dvnt apps;
• dvnt_refresh: your session, valid for up to 30 days, sent only to the account service;
• __Host-gymsid: your openGym session, valid for 90 days, sent only to gym.dvnt.app.

The apps also use localStorage and IndexedDB on your device for your data and preferences. We do not use advertising or tracking cookies.

11. Third parties

We do not use analytics, ads or trackers, and we do not sell or rent your data. The services involved are:

• Google: sign-in, Drive sync (if you use it), and web fonts loaded from Google Fonts, which means Google receives your IP address when an app loads;
• your browser's push service, if you turn on notifications.

Our servers process technical data such as your IP address (for example to limit abusive request rates) and request logs, only to run and protect the service.

12. How long we keep data

• Account data: while you have an account. Sessions expire after at most 30 days.
• Access requests: until the administrator approves or deletes them.
• contrée Cloud backup and share links: until you delete them.
• Notes in Cloud storage: until you delete them, or delete the server copy. Earlier versions of a note (its history): 90 days, and always the 20 latest of each note while the note exists. A deleted note stays in Recently deleted for 30 days, where you can read and restore it; the app then erases its text and properties, and keeps only a deletion marker (its name and folder) so your other devices remove it too. This applies in every storage mode.
• contrée TV sessions: until you stop them, at most 12 hours after pairing (15 minutes for a code nobody scanned); expired sessions are deleted within the hour. The bids of a round in progress are deleted when the round dialog closes or the TV stops.
• contrée online tables (with every hand): an unstarted table 2 hours after its last activity, a table 1 hour after its game ended; a game left 24 hours without activity is ended as abandoned first. Invitations to a table go with it. The finished game stays in the players' History like any shared game.
• contrée nearby tables (on the host's phone, with every hand): until the host closes the table, or the game is over. A guest's record of the table they joined: until they dismiss it or the host closes the table. Guests' summaries of nearby games: the 20 latest, each until the host's copy arrives (it never does for a guest who isn't the host's friend).
• Your username and its change log, friendships and friend links: while you have an account. Declined friend requests: until the person who asked cancels them; the record that declines their new requests: 30 days. Official ratings and each verified game's rating changes: while the games they come from are kept.
• openGym profiles and everything in them: until you delete the profile; its activity log: 90 days (at most the 5,000 latest events).
• Server backups: the database and openGym's data are backed up every night and backups are kept for 14 days, so deleted data can remain in a backup for up to 14 days.

13. Your choices

• Delete your contrée Cloud backup and its share links in contrée Settings, or revoke a single share link.
• Stop a TV that follows your contrée games from the TV button in the Counter.
• Switch an app back to on-device storage, or export your data to a file, in its settings.
• In Notes settings: choose where your notes live, export them as Markdown files, or delete the server copy or the Drive copy you no longer use.
• Close an online table you created before it starts, or leave one; during a game, end it with the other players once someone has been away 3 minutes (it is then kept as abandoned and not counted).
• Close a nearby table you host (it is then deleted from your phone), or dismiss a nearby table you joined from the Counter.
• Change your username in the account app (Username tab).
• Archive a friend, or replace your friend link so the old link and QR code stop working.
• Revoke dvnt's Google access in your Google account settings.
• Delete your openGym profile, with all its data, in openGym's settings, or export it to a file there.
• Sign out, which revokes your session.

There is no self-service account deletion yet. To see, correct or delete your account and the data we hold about you, email davidanaton@gmail.com; we will answer within a reasonable time.

14. Security

All traffic uses HTTPS; phones playing nearby talk over encrypted WebRTC (DTLS). Sign-in cookies are httpOnly and Secure, session secrets are stored only as hashes, and Google refresh tokens are encrypted. No system is perfectly secure, but we work to protect your data.

15. Children

dvnt is not directed at children. If you think a child has given us personal data, contact us and we will delete it.

16. Changes

We may update this policy. When we do, we change the effective date at the top of this page.

17. Contact

dvnt: davidanaton@gmail.com