A little permission.
A lot of control.
Sensitive actions are always connected to an explicit user decision.
Default behavior
| Action | Permission |
|---|---|
| Connect | Passkey login and consent |
| Read balance, addresses, history | Allowed during the connected session |
| Send bitcoin | Fresh passkey approval per payment |
| Create an invoice or estimate an on-chain fee | Fresh passkey approval per operation |
| Sign or encrypt a Nostr event/message | Fresh passkey approval per operation |
Monthly allowances
When approving a payment, the user can set a monthly limit for that origin in sats or US dollars. Fees count toward the limit. Dollar spending is recorded at the current BTC/USD spot quote, rounded up to whole cents. Months reset at midnight UTC on the first day.
Allowances are shared across devices. Bivvy stores signed policies and atomically reserves spending in Turso before dispatching a payment. Concurrent requests cannot reserve the same budget. Uncertain or failed payments retain their reservation conservatively.
Lock and revoke
Sessions lock after 15 minutes. Disconnect removes the current app’s iframe and clears its in-memory key references. Revoke durable permissions in the wallet under connected apps. Future automatic requests must read the current server policy.
Accounting trust
The permission service coordinates budgets and revocation. It has no user signing key, but clients rely on its current counters. Signed policies prevent it from inventing a larger allowance; a malicious or rolled-back service could misreport spending. See the complete trust model.