Your records belong on your device. We built everything around that.

1. On-device storage by default

Your records live in an encrypted database on your phone, not on our servers. We use each platform’s native, battle-tested storage: Core Data or SQLite on iOS and SQLite (directly or through WatermelonDB) on Android and cross-platform builds.

• Apps work fully offline. A reminder never depends on a network call.
• Data is protected by the operating system’s file encryption, unlocked only with your device passcode or biometrics.
• No account is required unless a feature genuinely cannot work without one. PillTail, for example, has no sign-up at all.
• Deleting the app deletes the data. There is no shadow copy on our side to forget about.

2. Zero-knowledge encrypted backups

Where a product offers backup or sync, it is opt-in and encrypted before it leaves your device. The keys are yours alone, so the copy is unreadable to anyone else, including us.

1. Key derivation on device. A backup key is derived from a passphrase only you know, using a memory-hard key-derivation function (Argon2id or scrypt). The passphrase and key never leave the device.
2. Authenticated encryption. Data is sealed with AES-256-GCM, which protects both confidentiality and integrity, so tampering is detected.
3. Your destination, not ours. The encrypted file goes to storage you control: your private iCloud Drive or Google Drive, or a self-hosted vault, wherever the platform rules for that kind of data allow it.
4. What this means in practice. We hold no keys and no plaintext. If we are ever asked to hand over your records, there is nothing readable for us to give. The trade-off is honest: lose the passphrase and we cannot recover the backup for you.

3. No behavioural trackers. No data brokers. Ever.

We make this pledge for every app and website we ship:

• No Meta Pixel, Facebook SDK, Google Ads SDK, AdMob or any other advertising network.
• No third-party behavioural analytics or session recording.
• No selling, renting or sharing of personal data with data brokers or advertisers.
• Any product metrics we need (for example, whether the app crashes) are aggregate, contain no health or financial content and are disclosed in the store listing.
• This website sets no cookies and loads no third-party scripts. Fonts are served from our own domain.

4. App Store and Google Play compliance

Health and financial apps sit in the most sensitive store categories. We treat the platform rules as a floor, not a ceiling.

• Accurate disclosures. Every product completes Apple’s App Privacy details and Google Play’s Data safety section truthfully. Where an app collects nothing, its label says so.
• Health data rules. We follow App Store Review Guideline 5.1.3 and Google Play’s Health apps and sensitive-data policies: health data is never used for advertising or data mining, and we respect each platform’s limits on where such data may be stored.
• Permissions with a reason. We request only the permissions a feature needs, at the moment it needs them, with a plain-language explanation.
• Children and families. Products for young people will follow Apple’s Kids Category and Google Play’s Families policies, with no ads and no third-party analytics.
• Medical scope. Our tools support your routines and records; they do not diagnose or treat. Each product says so clearly.

Status by product

Where each product stands against this charter today.