Security & privacy

How your data stays yours — the technical detail.

What "offline-first" actually means

• The desktop app stores everything in WebView2 IndexedDB, scoped to the bundle ID com.mylife.desktop.
• The Android app stores everything in AsyncStorage, scoped to the package ID com.mylife.app.
• Neither app makes outbound HTTP requests during normal use.
• The single network exception: notifications fire locally on each device — there is no remote push service, no FCM token sent to a server.

You can verify this by running a packet capture (Wireshark, mitmproxy) while using the app. You will not see any traffic to our servers.

Backup format

Settings → Backup exports a JSON file containing your state. You can choose:

• Encrypted (recommended): AES-CBC with a 256-bit key derived via PBKDF2-SHA256, 50,000 iterations, over your passphrase + a per-export 16-byte random salt. 16-byte random IV per export. The passphrase never leaves your device — only the resulting key material is used to encrypt the JSON.
• Plain JSON: human-readable. Convenient for triage; not recommended for sharing.

The envelope format is documented in mylife-docs (ADR-003). Anyone can decrypt their own backup with the passphrase — there is no Diviners Group escrow, master key, or backdoor. Lose the passphrase and the data is gone.

What we hard-coded against

• No source maps in production builds.
• No console.log survives in shipping bundles — terser strips them, and a release-gate QA suite fails the ship if any survive.
• Hash-only chunk filenames so the app's internal structure doesn't leak from the installer file listing.
• R8 + ProGuard on every released APK — Java/Kotlin layer is shrunk and obfuscated; Hermes already bytecode-compiles the JS layer.
• No android.permission.INTERNET for data sync — the app requests internet only for OS-level notification scheduling. There is no remote sync endpoint to call even if it had the permission.

What we don't and won't have

• No analytics SDK (Google Analytics, Plausible, Mixpanel — none).
• No crash-reporting SDK (Sentry, Crashlytics — none).
• No advertising SDK (any).
• No social-login (Facebook, Google).
• No A/B testing framework.
• No feature flags fetched from a server.

Threat model

What we explicitly protect against:

• Casual inspection of your data by someone with your unlocked phone — the PIN gate + biometric unlock blocks them.
• Reading the data inside a backup file that you stored in a cloud drive — encryption protects it from the cloud provider's staff and from anyone who steals the file.
• Casual reverse engineering of the installer to read app logic — obfuscation makes it not worth the casual effort.
• Anyone seeing your data in transit between your devices — there is no transit. You share an encrypted backup file out-of-band.

What we don't protect against:

• A determined attacker with root access to your device. Use full-disk encryption.
• Forgotten passphrases. We can't reset them; we don't have them.
• A keylogger or screen recorder running on your device alongside MyLife. Keep your device clean.
• A skilled reverse engineer with hours of patience and modern tools. Obfuscation is anti-casual-inspection, not anti-attacker.

Medical disclaimer

MyLife is not a medical device. The medication reminders, lab storage, sleep tracking, baby growth charts, period calendar, and emergency SOS card are personal record-keeping tools — not diagnostic, not therapeutic.

• Always consult a licensed physician before acting on health data shown in the app.
• In an emergency, call your local emergency number (India: 112).
• The vaccination schedule is a convenience defaulting to widely-published recommendations. Your paediatrician's schedule overrides anything in-app.

See the Terms of Service §6 for the legal framing.

Reporting a vulnerability

Email support@divinerssolution.com with subject line "Security:". We respond within 3 business days.

← Back to MyLife