Librenest is a retirement planner for people moving between the US and China. It works on numbers that are nobody else's business, so it is built to keep them on your device.
Last updated: 9 August 2026
The short version. Your account balances, holdings, date of birth, citizenship, visa status, income and retirement plan stay on your phone. There is no server-side copy of any of it. The app sends the ticker symbols of the funds you hold — so it can look up their prices — and those arrive without any balance, share count, or anything identifying you. Three things are opt-in, and each one is the only reason anything else leaves your phone: signing in (needed to link a brokerage); linking a brokerage, whose holdings do come through our server and whose connection is held by our partner; and importing a screenshot, where the text read off it is sent to be organized. Typing holdings in, or importing a CSV, sends nothing at all.
All of it, unless it is listed in the next section. Specifically:
This data lives in the app's own private storage. It is not backed up to us, not synced between your devices, and not readable by other apps. Uninstalling the app removes it. Settings → Erase all data removes it immediately and irreversibly.
Librenest asks our server for reference data — public facts about funds and cities that are the same for every user. These requests carry no identifier of any kind: no account, no device ID, no advertising ID. They are sent by a client that is structurally incapable of attaching your identity: it has no access to your sign-in token at all.
| What is sent | Why | What is not sent |
|---|---|---|
Ticker symbols you hold, e.g. VTI,BND |
To fetch prices, asset class and dividend yields | Balances, share counts, account names, or who you are |
| Nothing — an empty request | To fetch the USD/CNY exchange rate, city cost-of-living figures and brokerage cash rates | — |
| A feedback message you type, plus the app version and your device model | So a bug report can be reproduced. Sent only when you tap Send | Holdings, balances, or anything from your retirement profile |
| Text recognized from a statement — only when you import a screenshot or PDF | To organize it into holdings you then confirm. The image itself never leaves your phone: text recognition runs on the device, and only the text is sent | The picture, and anything you don't import. A CSV import sends nothing at all — it's parsed entirely on your phone |
| Your holdings and balances — only for a brokerage you choose to link | To keep that account up to date without you typing anything. The connection is held by our partner SnapTrade, and the holdings it returns pass through our server to reach your phone | Your brokerage username or password — those are entered at your brokerage, and we never see them. The connection is read-only: it cannot trade |
| Your email address — only if you choose to sign in | An account is required to connect a brokerage or bank, because that connection is held by our partner and the account is how we know it is yours | Your holdings, balances, or retirement profile. Signing in does not upload them |
Ticker symbols are not personal information on their own: millions of people hold the same funds, and the request contains nothing to tie them to you. We do not log these requests against any profile, because there is no profile to log them against.
Librenest is not directed to children and is not intended for anyone under 18. You may enter your children's ages so the plan can include school costs; that is a number on your device and is never transmitted.
Because we hold no personal data about you, there is no account to access, export or delete on our side, and no data-subject request we could meaningfully act on. You already hold everything: Settings → Erase all data deletes it, and uninstalling the app does the same.
Requests to our server use HTTPS. Your data is protected by the operating system's app sandbox and whatever device passcode or biometric lock you use. Because nothing personal leaves the device, a breach of our servers could not expose your holdings or your plan — there is nothing there to expose.
If a future version of the app sends something new, this page changes before that version ships, and the date above changes with it. We will not quietly widen what leaves your device.
Questions about this policy: support@heybrooklabs.com