RHMRA Phone Dashboard

A private, installable, read-only viewer for encrypted RHMRA dashboard snapshots.

What the app does

RHMRA Phone Dashboard lets a user view a temporary copy of their own RHMRA account summary, positions, scheduled-run outcomes, and strategy P&L on a paired phone. The laptop dashboard creates the snapshot, encrypts it before upload, and provides a private pairing link containing the decryption key.

The phone app is strictly read-only. It has no brokerage credentials and cannot place, change, or cancel trades.

Why it connects to Google Drive

The app requests only https://www.googleapis.com/auth/drive.appdata. It uses that permission to find and download the encrypted RHMRA snapshot written by the paired laptop in this app's hidden Google Drive appDataFolder. This limited scope does not let RHMRA browse ordinary files in your Google Drive.

The encrypted snapshot travels directly between your browser and Google Drive. The phone PWA also signs in directly with Google and keeps its Google access token only in browser memory. There is no developer-operated RHMRA dashboard server, and the maintainer does not receive your dashboard contents, phone access token, or pairing key.

How laptop Google sign-in works

The companion RHMRA Agent uses a maintainer-operated Cloudflare Worker only as a laptop OAuth token relay. It transiently forwards the one-time Google authorization code and S256 PKCE verifier, or a later refresh token, to Google's fixed token endpoint and returns Google's token response. The relay code does not log or store those values.

The relay never receives dashboard snapshots, Google Drive files, pairing keys, brokerage credentials, or trading data. On Windows, the Agent stores its Google tokens locally as ciphertext protected for the signed-in user with DPAPI. Cloudflare supplies the relay infrastructure and processes the transient token traffic and associated network metadata under its own terms and privacy policy.

Privacy and security

The snapshot is decrypted only on the paired device. The decryption key stays on that device, and Google Drive receives only encrypted dashboard data. The app contains no advertising, analytics SDK, or tracking pixel.

Laptop Disconnect Google Drive asks Google to revoke access and clears the Agent's locally saved DPAPI-protected Google credential while retaining the phone pairing; the phone may then need to reconnect to Google. Phone disconnect and Forget this device clear only phone-local state and do not revoke the shared Google grant. If laptop revocation cannot be confirmed, use Google Account third-party connections as described in the Privacy Policy.

For complete details, including local storage, deletion, revocation, expiry, and Google API use, read the Privacy Policy and Terms of Use.

Install and pair

  1. Open RHMRA Phone Dashboard and install it from the browser or add it to the Home Screen.
  2. Use View on Phone on the paired RHMRA laptop dashboard to create a private link or QR code.
  3. Pair this device, select Connect Google Drive, and approve the limited app-data permission.

Keep the private pairing link and QR code confidential because they contain the dashboard decryption key.

Support

For help or security reports, open an issue in the RHMRA Phone Dashboard repository. Never include a pairing link, QR code, decryption key, Google token, or brokerage information.