Zero-Access Architecture

Every entry is encrypted on your device before it ever reaches our servers. We couldn't read your habit data even if we wanted to.

AES-256-CTR

We use the Advanced Encryption Standard with a 256-bit key in Counter Mode.

  • Unique 128-bit random IV per write
  • No block padding attacks

PBKDF2 Key Derivation

Your password never leaves your device. Instead, your device derives your encryption key from it with PBKDF2-HMAC-SHA256 at 200,000 iterations.

  • Unique 128-bit random salt per user
  • Resistant to rainbow table attacks
  • A custom implementation that hashes hex-encoded input, so standard PBKDF2 libraries will not reproduce its keys
  • Entries saved before the upgrade to 200,000 iterations keep their older, lower count until they are next saved

To sign in, your device sends a separate proof, derived from your password with 50,000 iterations and a salt computed from your username. We store only a SHA-256 hash of that proof. Like any password hash, it could be used to test password guesses offline, so a long, unique password is what protects you.

How it works

1

Local Encryption

When you track a habit, your phone generates a unique Initialization Vector (IV) and encrypts the data locally using your derived key.

2

Integrity Signing

Your phone signs the iteration count, IV and ciphertext with HMAC-SHA256 and appends the first 128 bits of the signature. Nobody, not even a server administrator, can change a blob's contents without breaking it.

3

Secure Sync

Your entries reach our servers only as that encrypted blob, stored as one record per calendar month. We store it, but we can never read it. A few things we receive are not entries, such as your username at sign-in and food search terms; the Privacy Policy lists each one.

Because we use End-to-End Encryption, there is no "Forgot Password" feature. If you forget your password, we cannot recover your data. Your PIN unlocks the app on a device you are already signed in on. On a new device, your password is the only way back in. That is the trade-off, and we are not going to pretend otherwise.

Get in touch →

The beta is at capacity right now.