The parts that would matter if we were wrong.
Most security pages say "bank-level encryption" and stop. Here is what is actually true, in enough detail that somebody who knows the field could tell if it were not.
On your phone
Encrypted where it lives.
- AES-256 at rest. Body metrics, food, workouts and commitments are held in EncryptedSharedPreferences with keys in the Android Keystore, so it is never written in plaintext.
- Excluded from Android cloud backup and device-to-device transfer. Uninstalling, or clearing app data, removes it permanently.
- No internet needed. The app is fully usable signed out and offline. Network features exist only where you switch them on.
- Meal photos never leave. Recognition runs on-device and the image is processed in memory. Barcode decoding is on-device too.
When you export or back up
Sealed before it moves.
- Your passphrase, not our key. Exports and cloud backups are encrypted on the phone first: AES-256-GCM, with the key derived by PBKDF2-HMAC-SHA256 at 210,000 iterations over a salt generated fresh for every file.
- Tampering is detectable, not just unlikely. GCM authenticates the file, so a backup that was edited or corrupted fails to open rather than restoring something subtly wrong.
- We cannot open them. The cloud copy is an opaque blob. That also means a forgotten passphrase is unrecoverable, which is the honest cost of the arrangement.
- Restoring is always free. Getting your own data back is not a paid feature, including after a subscription lapses.
The backend
Default deny, then prove it.
- Nothing is readable by default. The database rules refuse every read and write, then grant narrow exceptions checked against your signed-in identity.
- Requests are attested. App Check with Play Integrity gates the callable endpoints, so a repackaged build cannot talk to them.
- Rate limits on anything invite-shaped, with failures budgeted more tightly than successes, so guessing a code costs more than using one.
- HTTPS with HSTS for a year, a content security policy, and no third-party scripts on this site at all.
Where AI is not allowed
Some answers must not be a guess.
Allergy exclusions, whether a workout counts as completed, and how training progresses are ordinary deterministic code with tests. The language model writes sentences. It does not get a vote on any of those, because a model that is right ninety-nine times out of a hundred is the wrong tool for a peanut allergy.
Tell me, and I will say what I fixed.
There is no bounty, because there is no company yet, and offering one I could not honour would be worse than saying so. What I can promise is a real reply from the person who wrote the code, and a note in the changelog when it is fixed.
This is a young app in closed testing. Treat it accordingly, and do not put anything in it you could not stand to lose.