Privacy

So I know how many people use it, the phone sends one small message of plain text to bv.astrals.dev/api/count:

• Once per version, after you install or update: the version and the edition, “mobile”. Nothing else.
• Every 10 minutes while Vest is open on the phone: the same, plus a random number. Your phone makes that number the first time, from nothing about you, your account or the phone, and keeps it in Vest’s site storage. It lets me count how many different phones use it and how many are on right now.

No account, no trades, no balances, no pages, no name. It goes without cookies and without the page it came from, and its answer isn’t read.

On my side the counter keeps counts per version, edition and day. The random numbers are folded into counts that can’t be turned back into them; only the ones seen in the last 15 minutes are kept as they are, with the time they came in, to count who is on right now, and older ones are dropped. Your IP address is never stored. Vercel, which hosts the counter, sees the IP address of every request, as it does for any website.

To switch it off: the B menu, Settings, Phone, then turn off Usage counts. That stops it and deletes the random number from your phone.

Every 10 minutes while Vest is open, the phone reads bvm.astrals.dev/latest.json, a small file that names the newest version and says what’s new. It’s a plain read: no cookies, no number, nothing about you or your account goes with it. When the file names a newer version, the B menu shows a row that opens this site. The answer is only ever shown as words; nothing in it runs.

Separately, the app that runs the script looks at bvm.astrals.dev/better-vest-mobile.meta.js for a new version: Userscripts on an iPhone when you open its menu, Tampermonkey on Android by itself. That’s the app’s own check, the same as for any userscript.

The voice lines aren’t inside the script, so it opens fast. While the voice is on, the phone downloads the voice you picked from bvm.astrals.dev/voice/ once: one file of about half a megabyte, kept in Vest’s site storage on the phone. It’s a plain download: no cookies, no number, nothing about you goes with it. The script only takes the file if it’s exactly the one it expects (its fingerprint is written in the script), and only ever plays it as sound. With the voice off, nothing is downloaded.

Besides those, the script talks to Vest only, and only as Vest’s own page would: your orders through Vest’s own buttons and code, and read-only requests for your trades, accounts and payouts, with the session your Vest page already has. The news calendar is inside the script; nothing is looked up online.

One choice reaches another site: if you pick a font other than Vest default, System UI or System Mono in Settings, Look, the phone loads it from Google Fonts, as any page with that font would.

Your account, your trades, your address, your name and your login never leave the phone for me or anyone else.

• Your settings, your limits and locks, and the list of what closed your positions, in Vest’s site storage on the phone.
• The Calendar’s data: your trades and payouts as Vest gave them, for the Calendar and the P&L card.
• Recorded prices: the chart’s price second by second while Vest is open, for the P&L card’s Replay. Older than 30 days is deleted. The P&L card page can switch it off.
• Your card picture, if you pick one.
• The voice you picked, once it’s downloaded.

Clearing Vest’s website data in Safari’s settings (or Firefox’s) removes all of it. Safari also clears a site’s stored data by itself after 7 days of using Safari without opening that site.

This site counts its visits with Vercel Web Analytics: which page was opened, the site that linked here, the country, and the kind of browser and device. I only ever see totals. It sets no cookies and keeps nothing that says who you are. That’s about the website only; the script sends just the two things above and downloads its voice.