CIPHERCipher Tracker — encrypted habit tracking. Your data is sealed with AES-256 and unlocked by you alone.
Track sleep, caffeine, cycles, cannabis, screen time and seven more. Everything is encrypted on your phone with a key derived from your password — we only ever receive the ciphertext.
The beta is at capacity right now.
The same day, twice
What you see, and what we store.
On your phone
- Sleep
- 7h 20m
- Caffeine
- 240 mg
- Cycle
- Day 14
- Screen time
- 3h 05m
On our servers
v3:00030d40763cfe345d454d9f03c119e2d084df5a9fc7e139e5e7d034fd950323becb08db2dd5e7a3695e3e13a89ac98aa676a393a5ec3ee417b5bfcfa41edf8431b9c8dee72a79bc495c0b6c
Illustration of the stored format. The ciphertext above is sample data, not a real encryption.
Every record we hold looks like this
v3:3 chars
Format marker. PBKDF2 with the iteration count stored per blob.
iterations8 chars
200,000 rounds. Encoded in the blob and covered by the signature, so it cannot be downgraded.
IV32 chars
A fresh 128-bit initialisation vector for every single write.
ciphertext
AES-256-CTR. The key is derived from your password, on your phone.
HMAC-SHA25664 chars
Signs everything above it. Tampering breaks the signature.
Twelve trackers
One app instead of five.
What you're cutting down
Drinks, screen time, caffeine, cannabis and nicotine.
- Drinks
- Screen Time
- Caffeine
- Cannabis
- Nicotine
Drinks
Screen Time
Caffeine
Cannabis
NicotineSee how it works →
What your body's doing
Period, calories, hydration and exercise.
- Period
- Calories
- Hydration
- Exercise
Period
Calories
Hydration
ExerciseSee how it works →
What you're keeping up
Sleep, pills and a private diary.
- Sleep
- Pills
- Diary
Sleep
Pills
DiarySee how it works →
Analytics
Patterns you would not have spotted.
Weekly and monthly views, per-tracker trends, and cycle predictions that get sharper the longer you use it. All computed on your device.
See the analytics →
How it stays private
Three steps, and we are locked out of all of them.
01
Encrypt
Your phone derives a key from your password and encrypts the entry with AES-256-CTR before it goes anywhere.
02
Sign
An HMAC-SHA256 signature covers the iteration count, the IV and the ciphertext, so nothing can be altered undetected.
03
Sync
Only that sealed blob reaches our servers. We store it. We cannot open it.
The trade-off
There is no password reset.
Your key is derived from your password on your device, and never sent to us. That is what makes the encryption real — and it means if you forget your password, we cannot recover your data for you.
Your PIN unlocks the app on a device you are already signed in on. On a new device, your password is the only way back in.
The app asks you to write it down before you finish setting up. Please do.
Keep it to yourself.
Twelve trackers, two themes, and a server that cannot read a single one of your entries.
Get in touchThe beta is at capacity right now.