RHMRA Phone Dashboard privacy

Effective August 11, 2026.

RHMRA Phone Dashboard is a static, read-only Progressive Web App. The phone viewer has no RHMRA application backend: the phone viewer's dashboard downloads and Google tokens are not sent to the maintainer. The companion laptop Agent uses the narrowly scoped OAuth relay described below only to complete Google token exchanges.

Google Drive access

The app requests only https://www.googleapis.com/auth/drive.appdata. The phone PWA communicates directly from your browser to Google Sign-In and the Google Drive API to read the encrypted RHMRA snapshot stored in this app's hidden appDataFolder; it does not use the laptop OAuth relay. The app cannot browse your normal Drive files through this scope.

Google processes sign-in and Drive requests under Google's own terms and privacy policy. Google can observe your signed-in account, the OAuth application/client and grant, request IP and device/browser details, Drive API operations, hidden app-data filename and file ID, ciphertext size, file timestamps, and request timing. Encryption protects the dashboard contents, not that metadata. The phone PWA's OAuth access token is kept only in browser memory and is discarded on phone reload, disconnect, or Forget this device.

Laptop OAuth relay

The companion RHMRA Agent uses a maintainer-operated Cloudflare Worker for the laptop's Google OAuth token endpoint. For initial authorization, the Agent sends the one-time Google authorization code, S256 PKCE verifier, client identifier, and loopback redirect URI to the relay. For later refreshes, it sends the Google refresh token and client identifier. The relay adds the protected Desktop client credential, forwards the request to Google's fixed HTTPS token endpoint, validates Google's token response, and returns that response to the Agent.

This processing is transient. The relay has no application database and its code does not log or store authorization codes, PKCE verifiers, access tokens, refresh tokens, or Google's token response. It never receives dashboard snapshots, Google Drive files, pairing identifiers or keys, brokerage credentials, or trading data. On Windows, the Agent stores its Google access and refresh tokens locally as ciphertext protected for the signed-in Windows user with DPAPI; it does not write plaintext tokens. On platforms without an equivalent supported native store, the Agent keeps them only in process memory.

Cloudflare provides the relay's network and execution infrastructure and acts as a service provider/data processor for these transient requests. Cloudflare may process the request and response traffic plus operational metadata such as IP address, timing, headers, and Worker invocation/error information under Cloudflare's own terms and privacy policy. The relay is not used to advertise, profile users, sell data, or access Drive contents.

Solely for abuse prevention, Cloudflare's point-of-presence-local rate limiter keeps an ephemeral request counter for up to one minute. The counter is keyed by a value derived from the CF-Connecting-IP address supplied by Cloudflare, or a shared fallback when that address is unavailable or invalid. The key and counter contain no OAuth request body, authorization code, PKCE verifier, access token, refresh token, or Google token response.

Google API Services User Data Policy

RHMRA Phone Dashboard's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Drive data is used only to provide the encrypted phone-viewer feature. It is never used for advertising, user profiling, sale, or transfer to the developer or an unrelated third party. Cloudflare processes only the laptop token exchange as a service provider; the relay never receives Google Drive data.

Dashboard data and encryption

The laptop uploader places only an encrypted dashboard envelope in Google Drive. The phone viewer accepts a strict allowlist of dashboard fields. A run's existing bounded detail text may include an optional bounded timing summary with the session, runner/model/configuration, and displayed durations. It does not include invocation IDs, timing timestamps or sources, raw timing records, raw trade ledgers, gate files, account or order identifiers, local paths, constants, or brokerage credentials.

The decryption key arrives in the private pairing link fragment, is removed from the address bar immediately, and stays on the paired device. Where supported, it is stored in IndexedDB as a non-extractable Web Crypto key. A browser that cannot clone that key may use a session-only fallback that disappears when the tab closes.

Local storage

The app stores the pairing identifier, provider, non-extractable key, last accepted sequence metadata, Google Drive file ID, and the last verified AES-GCM encrypted envelope locally so it can reject rollback, restore the last verified view after a reload, and resume the same pairing. The encrypted envelope is removed when it expires, Google Drive confirms that sharing stopped, or you select Forget this device. The app stores no Google access token, decrypted dashboard payload, analytics identifier, or advertising identifier.

Delete app data and revoke access

• On the phone, select Forget this device to delete only that phone's local pairing, decryption key, cached encrypted envelope, and in-memory access token. Phone disconnect similarly clears only the in-memory token; neither action asks Google to revoke the shared grant or clears the laptop Agent's credential.
• Stop sharing from the laptop dashboard to remove the active encrypted snapshot file from Google Drive.
• On the laptop, Disconnect Google Drive asks Google to revoke the grant and always clears the Agent's in-memory credential and locally saved DPAPI-protected Google credential. It retains the phone pairing, but the phone may need to reconnect to Google because the laptop and phone use the same Google application grant.
• If the laptop reports that remote revocation could not be confirmed, remove RHMRA from Google Account third-party connections for immediate assurance. The Agent's local credential has still been cleared.
• Remove RHMRA Phone Dashboard from Google Account third-party connections to revoke its Google access. Because the laptop and phone belong to the same Google application, reconnecting either one may be required afterward.
• Uninstall the web app or clear this site's browser data to remove any remaining local application data.

Stopping a share and using laptop Disconnect Google Drive both retain the stable phone pairing. A later laptop session can reuse that pairing after Google is connected again. Use phone Forget this device or laptop Forget paired phone when pairing data itself should be erased.

No analytics, ads, or dashboard collection

The phone PWA contains no analytics SDK, advertising SDK, tracking pixel, or developer-operated dashboard collection endpoint. The Google Cloud project maintainer may receive aggregate OAuth/API quota, latency, and error metrics, and the Cloudflare account may expose aggregate Worker invocation and error metrics. The relay code does not put OAuth request or response contents in application logs. Neither the phone PWA nor the relay sends the maintainer dashboard plaintext, pairing keys, or Drive files. A static hosting provider may keep ordinary web access logs under that provider's policy. The private pairing fragment is not sent as part of those HTTP requests.

Questions or security reports

Open an issue in the RobinhoodEquityTradingDashboardViewer repository. Never include a QR code, private pairing link, decryption key, Google token, or brokerage information in a report.