Privacy
Local-first, by design.
Nerva is a desktop app, not a service. Your heart-rate signal stays on your machine. I don't run a backend that sees your BPM, your sessions, or your recordings. There is nothing to leak, because nothing leaves.
What I never collect
Heart-rate values, HRV metrics, RR-intervals, session recordings, your email, your name or stream handle, your IP address, or your location. These are blocked at three layers: the desktop app, my Cloudflare Worker, and the analytics backend. Any payload that includes one of the property keys below is dropped before it leaves your machine.
bpmheart_ratehrvrmssdsdnnpnn50baevskyrr_intervalssession_datarecordingemailnameusernameipgeolocation
Anonymous, opt-in usage telemetry
Nerva can send a small set of anonymous events to help me understand which features get used, where the app crashes, and where the onboarding loses people. The toggle is offered on first launch, the choice is reversible from Settings, and an anonymous identifier (a UUID v4 generated on your machine) is the only thing that connects events together.
The transport is a Cloudflare Worker I own
(events.nervabio.com) which forwards to PostHog. The
Worker rejects any payload containing a forbidden property key, same
list as above.
The exact events
This table is the source of truth. If I add a new event in the app, it appears here in the same release.
| Event | When it fires | Properties |
|---|---|---|
install | Once, on first install completion. | version, os_family, install_source |
app_first_launch | First time the app starts after install. | version, os_family |
app_session | Each time the app starts (anonymous session ping). | version, os_family, locale |
ble_scan_started | User opens the device picker. | none |
ble_connect_ok | A sensor connects successfully (no device name, no MAC). | vendor_hint |
ble_connect_failed | A connection attempt fails (anonymous error code only). | reason_code |
theme_changed | User picks a different overlay theme. | theme_id, theme_kind |
pricing_viewed | Pricing screen is shown. | context |
checkout_started | User clicks a checkout button. | plan |
conversion | License is activated successfully on the machine. | plan |
trial_reminder_shown | A trial-expiry toast (J-7 / J-3 / J-1 / J-0) is displayed. | stage |
trial_reminder_dismissed | User dismisses a trial-expiry toast. | stage |
trial_reminder_cta_clicked | User clicks the CTA inside a trial-expiry toast. | stage |
trial_reminder_replaced | A new reminder supersedes a previous one without dismissal. | stage |
onboarding_started | First time the onboarding wizard opens. | none |
onboarding_step_completed | User completes one wizard step. | step |
usage_intent_selected | User picks how they intend to use Nerva (stream / personal / both). | intent |
first_bpm_displayed | The first BPM value is rendered after install. | none |
onboarding_completed | User finishes onboarding. | none |
onboarding_skipped | User skips onboarding. | step |
License email
When you buy a Pro plan, the payment provider (Lemon Squeezy) handles the transaction and sends you a license key by email. That email is held by Lemon Squeezy, not by me. Nerva only stores the license key on the machine you activate it on.
GDPR
Nerva is based in the EU. The legal basis for the anonymous usage telemetry is your explicit consent (opt-in). To revoke it, toggle off "Help improve Nerva" in Settings, events stop immediately. To request deletion of past events tied to your anonymous ID, email me at [email protected].