// Privacy

Your heart rate never leaves your machine.

Nerva is a desktop app, not a service. Your heart-rate signal stays on your machine. I don't run a backend that sees your BPM, your sessions, or your recordings. There is nothing to leak, because nothing leaves.

Last updated June 2026

Privacy at a glance

  • No cloud

    Heart-rate, HRV and stress are computed on your machine. None of it is sent to a Nerva server, there isn't one in the path.

  • No account

    There is no sign-up, no login, no email required to install and use the app. Nothing ties the data to an identity.

  • No tracking

    No analytics SDKs, no ad networks, no behavioural telemetry baked into the desktop app.

What I never collect

Heart-rate values, HRV metrics, RR-intervals, session recordings, your email, your name or stream handle, your IP address, or your location. These are blocked at three layers: the desktop app, my Cloudflare Worker, and the analytics backend. Any payload that includes one of the property keys below is dropped before it leaves your machine.

  • bpm
  • heartrate
  • heart_rate
  • hrv
  • rmssd
  • sdnn
  • pnn50
  • baevsky
  • rrintervals
  • rr_intervals
  • sessiondata
  • session_data
  • recording
  • email
  • name
  • username
  • user_name
  • ip
  • ipaddress
  • geo
  • location

Anonymous, opt-in usage telemetry

Nerva can send a small set of anonymous events to help me understand which features get used, where the app crashes, and where the onboarding loses people. The toggle is offered on first launch, the choice is reversible from Settings, and an anonymous identifier (a UUID v4 generated on your machine) is the only thing that connects events together.

The transport is a Cloudflare Worker I own (events.nervabio.com) which forwards to PostHog. The Worker rejects any payload containing a forbidden property key, same list as above.

The exact events

This table is the source of truth. If I add a new event in the app, it appears here in the same release.

Event When it fires Properties
install Once, on first install completion. os
app_first_launch First time the app starts after install. version
app_session When the app exits (records the session length). duration_seconds
ble_scan_started User opens the device picker. none
ble_connect_ok A sensor connects successfully (no device name, no MAC). device_type
ble_connect_failed A connection attempt fails (anonymous error code only). failure_reason
theme_changed User picks a different overlay theme. theme_id
pricing_viewed Pricing screen is shown. none
checkout_started User clicks a checkout button. plan
conversion License is activated successfully on the machine. plan, amount_eur, attributed_reminder?, reminder_to_conversion_ms?
trial_reminder_shown A trial-expiry toast (J-7 / J-3 / J-1 / J-0) is displayed. milestone
trial_reminder_dismissed User dismisses a trial-expiry toast. milestone
trial_reminder_cta_clicked User clicks the CTA inside a trial-expiry toast. milestone
trial_reminder_replaced A new reminder supersedes a previous one without dismissal. milestone
onboarding_started First time the onboarding wizard opens. none
onboarding_step_completed User completes one wizard step. step
usage_intent_selected User picks how they intend to use Nerva (stream / personal / both). intent
first_bpm_displayed The first BPM value is rendered after install. none
onboarding_completed User finishes onboarding. at_step, sensor_paired, duration_seconds?
onboarding_skipped User skips onboarding. at_step

This website

The marketing site you're reading uses a self-managed PostHog project (EU region, Frankfurt) to count page views and download clicks. No cookies are set. The identifier lives in sessionStorage and is wiped the moment the tab closes. IP addresses are discarded server-side, autocapture and session recording are disabled, and no cross-site tracker is loaded. The only events captured here are page views and clicks on the download / pricing buttons, with the OS, version, or plan as properties.

License email

When you buy a Pro plan, the payment provider (Lemon Squeezy) handles the transaction and sends you a license key by email. That email is held by Lemon Squeezy, not by me. Nerva only stores the license key on the machine you activate it on.

GDPR

Nerva is based in the EU. The legal basis for the anonymous usage telemetry is your explicit consent (opt-in). To revoke it, toggle off "Help improve Nerva" in Settings, events stop immediately. To request deletion of past events tied to your anonymous ID, email me at [email protected].