Privacy

Who runs Hovora

Hovora is an independent, early-stage product. It is built and run by one person; there is no support department and no sales team. Anything on this page can be raised at [email protected], which reaches the person who builds it.

What you give it

Your account: your name, your email address, and a password. The password is stored only as a cryptographic hash — it is never stored in a form that can be read back, by anyone.

And the things you enter about your properties. That is the substance of the product, and it stays inside your own organization:

• Properties — name, address, type, purchase date, notes, and the country, currency and timezone you choose for each
• Tasks and their schedules, including recurring ones
• Reminders you set, and the record of ones that were sent
• Documents you upload, and the filename, size, type and category attached to them
• Maintenance records — what was done, its status, category, priority and vendor
• Expenses — the amount, its currency, date, category, description and vendor

What is recorded as you use it

Signing in creates a session, and the authentication system records the IP address and browser user-agent string with it. That is how you stay signed in between page loads.

Hovora also records a small product-analytics event when something happens — a property created, a task completed, a document uploaded. Each event holds the name of the thing that happened, when it happened, and which account it belonged to, plus a few non-identifying details such as a category, a count or a currency code.

Those events deliberately never carry your content. No titles, no filenames, no addresses, no amounts of money, no email addresses. The code that writes them refuses any field whose name looks like one of those, and drops the event rather than storing it.

Hovora runs no third-party analytics. There is no Google Analytics, no advertising pixel, and no tracking script of any kind on the site or in the application.

Documents you upload

Files are stored in a private Cloudflare R2 bucket. The bucket is not public and cannot be browsed: every file has a key generated on the server, and the only way to reach one is a signed link that Hovora issues to you and that expires within minutes.

Uploads go from your browser straight to storage using a short-lived signed link, so the file does not pass through anything that keeps a copy along the way.

Notifications

If you turn on email reminders, Hovora sends them through Resend, a transactional email provider. The message contains the task title and the property name, because that is what makes a reminder useful — so those details reach Resend in order to be delivered.

If you turn on browser push, your browser gives Hovora a subscription: an endpoint URL and two keys that let a message be encrypted for that browser. Hovora stores those, along with a short description of the browser, so it knows where to send. The message content is the same task title and property name.

Both channels are off unless you turn them on, and either can be turned off again in Settings. Hovora sends no marketing email — every message it sends is one you asked for.

The services Hovora depends on

Running the product means a few third parties necessarily handle some of your data:

• A managed PostgreSQL database — everything except uploaded files
• Cloudflare R2 — the uploaded files themselves
• Resend — sign-in, verification and reminder emails
• A hosting provider, which runs the application and keeps ordinary short-term server logs
• Your browser’s push service, if you enable push — chosen by your browser, not by Hovora

Where it is stored

Which regions the database, the file storage and the hosting run in is a deployment decision rather than something the software fixes. Hovora does not claim a particular country or region here, because that claim would be about configuration rather than about the product, and it could quietly stop being true.

If the storage region matters to you, ask before you upload anything sensitive and you will get a straight answer about the current setup.

Cookies

Hovora sets one cookie: the session that keeps you signed in. It is HTTP-only, so page scripts cannot read it, restricted to same-site requests, and sent only over HTTPS in production.

There are no analytics cookies, no advertising cookies and no third-party cookies. Hovora stores nothing in your browser’s local storage.

How long things are kept

Hovora prefers archiving to deleting, because property history outlives any particular tenancy and losing it by accident is the more expensive mistake. That has consequences worth being explicit about:

• Archiving a property, task or maintenance record keeps it and its history; it stops appearing in your lists
• Deleting an expense marks it deleted and keeps the row
• Deleting a document marks it deleted and removes the file itself from storage
• Product-analytics events are kept, but when an account or organization is removed the identifiers linking events to it are cleared, leaving an anonymous record that something happened

Getting a copy, or getting it removed

Hovora does not yet have a self-service export or a delete-my-account button. Building both properly is on the list; until then, neither is claimed here.

What exists instead is a person. Email [email protected] asking for a copy of your data, a correction, or the removal of your account and its contents, and it will be done by hand and confirmed back to you. No timeframe is promised, because a promise from a one-person project is worth less than a straight answer when you ask.

Changes to this page

If what Hovora does with data changes, this page changes with it and the date at the top moves. Material changes will also be mentioned by email to people using the product at the time.

Contact

Anything on this page — [email protected].