Devlets privacy policy
Effective 2026-10-14
Devlets is an Android app of home-screen widgets for developers. This page says what the app does with your data. The short version: Devlets has no servers and no account system, and the developer receives none of your data directly. The one exception is the subscription record that RevenueCat keeps for Devlets Pro under an anonymous id, which the developer can see in RevenueCat's dashboard (see Purchases).
Devlets is made by Joaquin Galang. Website: getdevlets.com. Contact: galang.joaquin.dev@gmail.com.
What stays on your phone
- Your keys, tokens and cookies are encrypted with the Android Keystore and kept on your phone. They are excluded from Android cloud backup and device transfer.
- Your settings and the last data each widget fetched are stored on your phone so a widget can show something when you are offline. Uninstalling Devlets deletes them.
- Android may include those settings and cached data in its automatic backup to your own Google account, under your Google settings. Keys, tokens and cookies are never part of that backup.
- Devlets has no analytics, no crash reporting, no advertising and no trackers.
What leaves your phone
When a widget refreshes, your phone calls the service behind it directly. Devlets does not relay, proxy or log those calls. Every call reveals your IP address to the service it reaches, as any internet request does. On top of that, a call may include what you typed when you set the widget up (a username, package name, repo or domain) and, for services that need sign-in, your own token, key or cookie, which is sent only to that service. Each service handles that data under its own privacy policy.
Advent of Code sign-in. If you choose to sign in to Advent of Code inside the app, Devlets opens Advent of Code's own login page (adventofcode.com/auth/login) in an in-app browser window. You sign in there with one of Advent of Code's login providers; the page and that provider see your sign-in as they would in any browser, and Devlets never sees your password. Devlets reads only the Advent of Code session cookie, encrypts and stores it on your phone, and then clears that window's cookies, storage and cache when sign-in finishes or you close it. The leaderboard picker works the same way: it opens adventofcode.com only, with your stored cookie, and clears the window afterwards. You can instead paste the cookie yourself.
| Service | Host | What is sent (besides your IP address) | Why |
|---|---|---|---|
| GitHub | api.github.com, github.com | Your GitHub token (sent to GitHub only); the repo, username or search text you type in Setup. Sign-in sends the app's public client id and a device code, and renewing sign-in sends your refresh token. | Contributions, pull requests, issues, stars and Copilot usage. |
| Advent of Code | adventofcode.com | Your Advent of Code session cookie (sent to Advent of Code only); the year and leaderboard id you type. If you sign in inside the app, the sign-in page itself loads from this host (see the sign-in paragraph above). | Private leaderboard stars. |
| RevenueCat (your own data) | api.revenuecat.com | Your own RevenueCat API key and project id (sent to RevenueCat only). | MRR, churn and trial widgets. |
| OpenRouter | openrouter.ai | Your own OpenRouter API key (sent to OpenRouter only). | OpenRouter Wallet and Fuel Cells: what is left on your key or account balance. |
| Vercel | api.vercel.com, vercel.com | Your own Vercel access token (sent to Vercel only). | Shipped?: the latest production deploy of the projects you pick. |
| Stripe | api.stripe.com, dashboard.stripe.com | Your own restricted Stripe key, with Charges: Read only (sent to Stripe only). | Stripe Sales: today's and yesterday's charges, for the total and the comparison. |
| npm | registry.npmjs.org, api.npmjs.org | The package name you type. | Package details and download counts. |
| PyPI | pypi.org, pypistats.org | The package name you type. | Package details and download counts. |
| pub.dev | pub.dev | The package name or search text you type. | Package score and downloads. |
| Hugging Face | huggingface.co | The model name or search text you type. | Model likes and downloads, trending models, daily papers. |
| Bluesky | public.api.bsky.app | The handle or search text you type. | Follower count. |
| Codeforces | codeforces.com | The handle you type. | Rating. |
| CTFtime | ctftime.org | The team id you type, if any. | Upcoming CTFs and team rank. |
| Hacker News | hacker-news.firebaseio.com | Nothing beyond your IP address. | Front-page stories. |
| RDAP (domain registries) | rdap.org | The domain name you type. rdap.org forwards the request to the registry's own RDAP server for that domain's ending (Verisign for .com, for example), so that registry receives the domain name too. | Domain expiry date. |
| ipify (opt-in) | api.ipify.org | Nothing beyond your IP address. | Shows your phone's public IP address. The lookup runs only after you turn on Show public IP. |
| Cloudflare speed test | speed.cloudflare.com | Random test data, downloaded and uploaded. Runs only when you tap Run. | Download, upload and latency. |
| RevenueCat (subscriptions) | api.revenuecat.com (and, only when that is unreachable, api-production.8-lives-cat.io and api.rc-backup.com) | An anonymous app user id, and your purchase and subscription status. | Unlocking Devlets Pro. |
| Google Play | play.google.com (Google Play Billing) | Handled by Google under its own terms and privacy policy. | Taking payment and managing your subscription. |
Tapping a widget may open a link in your browser or an app, such as a GitHub pull request, a Hacker News story, an npm package page or the Play Store page of an AI app. That visit is between you and that site.
Purchases
Devlets Pro is a subscription sold through Google Play. Google takes the payment and keeps your payment details; Devlets never sees them. RevenueCat, which Devlets uses to manage subscriptions, receives an anonymous app user id (random, not linked to your name or email), your purchase and subscription status, and your IP address, to tell the app whether Pro is unlocked. RevenueCat keeps these purchase records as a service provider for the developer, who can see them in RevenueCat's dashboard and uses them to count subscriptions and revenue. They are not used for advertising.
Sharing and selling
The developer does not sell data and does not share data with advertisers. Data goes only to the services in the table above, for the reasons given there.
Your choices and deleting data
- Disconnect an account in the app to delete its token from your phone. For GitHub you can also revoke the app at github.com/settings/apps/authorizations.
- Remove a widget to stop its calls. Uninstall Devlets to delete everything stored on your phone.
- To ask for your RevenueCat record to be deleted, email the address below. Subscriptions are managed in Google Play.
Children
Devlets is not directed at children under 13 and does not knowingly collect their data.
Changes
If this policy changes, the new version is posted on this page with a new effective date.
Contact
Joaquin Galang, galang.joaquin.dev@gmail.com. Questions or deletion requests are welcome at that address.
Devlets is independent and is not affiliated with, endorsed by or sponsored by GitHub, RevenueCat or any other service named above.