Security

• Every account has its own 256-bit data key (AES-256-GCM). The keys are wrapped by a master key kept in a separate secrets vault, never in the database.
• Sign-in uses passkeys or one-time email codes. There are no passwords to steal or reuse.
• Journal notes are encrypted in your browser (AES-GCM with a key derived from your passphrase). We store only ciphertext.
• All traffic is encrypted (HTTPS). Session cookies are HttpOnly and Secure. Pages run under a strict content security policy.
• Tracker connections are read-only and their tokens are encrypted with your data key.
• We keep a written breach response plan. If a breach ever affects your health data, we notify you, the FTC and, where required, the media within the deadlines of the FTC Health Breach Notification Rule (no later than 60 days).

Found a vulnerability? Email [email protected]. We answer every report.