● My Health Tracker
×
‹ Back to app

Privacy Policy

Last updated: 2026-08-18

The short version

What stays on your device only

By default, all of this lives in your browser's IndexedDB on your device and never reaches our servers:

You can keep using the app this way forever. Nothing above is uploaded unless you sign in and turn on cloud backup, create a doctor-share link, or use Smart Import.

If you create an account

An account is optional. If you sign up, we store:

What we store if you enable Cloud Sync

Cloud Sync is opt-in and requires an account. When enabled, an encrypted blob of your data is uploaded so you can restore it on another device. The server stores:

We cannot read the blob. We do not store your password or your encryption key. If you lose your password, the cloud copy cannot be recovered. Your local copy on this device is unchanged.

Smart Import — the one plaintext exception

Smart Import is optional and only runs if you are signed in and you choose to upload an export from another tracker (or a CSV). The file is sent to our server, then to an AI model (Google Gemini, reached through our own LiteLLM gateway / OpenRouter) so it can be turned into shots and weights.

Reminders

If you turn on shot or daily reminders and allow notifications, your browser gives us a push endpoint. We store that endpoint and the times you asked to be buzzed. The notification wording is chosen from a fixed list on the server. We do not send your dose, weight, or notes in a notification.

Payments

Premium is billed by Stripe ($1.99/month or $19.99/year, 14-day trial). Checkout and the customer portal run on Stripe's site, not inside the app. Stripe sees the email and payment details you give them. We store Stripe's customer and subscription IDs so we can keep Premium in sync. We do not store card numbers.

How the encryption works

Plain-English glossary

If any of the terms above are unfamiliar, here's what they actually mean.

Local-first
The app runs on your device and saves your data on your device. Nothing leaves the phone or computer unless you turn on Cloud Sync, create a doctor-share link, or use Smart Import.
IndexedDB
A built-in storage area inside your web browser where the app keeps your shots, weight, and settings. It stays on your device — like the notes app on your phone.
End-to-end encrypted (E2EE)
Your data is scrambled on your device before it's sent to our server, and only your device has the key to unscramble it. We can't read it. Same approach used by Signal and Bitwarden.
Ciphertext
Scrambled data. Without the key, it's a jumble of random-looking bytes — useless to anyone who steals it, including us.
Encryption key
The secret that turns ciphertext back into your readable data. We never see it. It's derived from your password on your device and never leaves.
PBKDF2
The way we turn your password into an encryption key. We run the password through 600,000 rounds of a math function so it's slow to guess, even with a powerful computer.
AES-256-GCM
The actual scrambling method. AES-256 is the gold-standard encryption used by banks and governments. GCM is the mode that also detects if anyone tried to tamper with the ciphertext.
IV (initialization vector) / nonce
A random number we mix in each time we encrypt, so the same data encrypted twice produces different ciphertext. Stops attackers from spotting patterns.
Lookup ID
An older anonymous ID used by the original sync method. Current accounts are keyed by email plus the hashed auth token, not a lookup ID.
Web Crypto API
The cryptography toolkit built into every modern browser. It's what does the encrypting on your device. Standard, audited, and runs locally.
PWA (Progressive Web App)
A website you can install to your phone or computer like an app. Works offline, sends notifications, no app-store middleman.
HIPAA, GDPR, CCPA
Health and privacy laws — U.S. health (HIPAA), European general privacy (GDPR), and California consumer privacy (CCPA/CPRA). They give you rights like exporting your data and deleting it. The export/delete buttons in the app cover those rights.

Server logs

Our reverse proxy logs basic request metadata (IP address, user agent, timestamp, request size, response status) for security and rate-limiting purposes. These logs are rotated and retained for no longer than 14 days. They are not joined to user data.

Cookies, analytics, third parties

The marketing site and the app both load our own self-hosted Umami analytics at analytics.willhitestrategy.org. It counts page views and a few in-app events (for example: signed up, tried without an account). It does not set an advertising cookie, does not sell data, and does not follow you across other sites. We do not embed ad networks, social pixels, or other companies' trackers.

Third parties that can see something, and only when you use that feature:

Cloudflare sits in front of the site for TLS and abuse protection. It sees the same request metadata any CDN would.

Your rights

HIPAA

My Health Tracker is a personal tracking tool used directly by individuals. It is not a Covered Entity under HIPAA, is not integrated with healthcare providers or insurers, and does not handle Protected Health Information on behalf of any covered entity. Nothing in this app constitutes medical advice. Talk to your doctor about your medication.

Breaches

Your Google Drive backup is encrypted on your device using client-side AES-256 GCM encryption before being uploaded. Nobody without your local key can read your data.

Children

My Health Tracker is not directed to children under 13. We do not knowingly collect data from children.

Changes to this policy

If this policy changes materially, we will update the "Last updated" date and post a notice in the app.

Back to My Health Tracker  ·  Terms of Use