Security
Private and recoverable were never opposites.
Every honest security claim answers three questions. Where your data lives, who can read it, and what happens the day your phone goes in a lake. Here are ours, answered with mechanisms rather than adjectives.
You have almost certainly read a privacy policy that said all the right things and told you nothing. Policies describe intent, and intent is revisable. What you actually want to know is what the software does when nobody is looking, and whether there is any way for you to check.
There is also a trade you have been taught to expect. Apps that keep your records on a server can hand them back when you buy a new phone. Apps that keep everything on your device cannot, and they tend to tell you that this is simply the price of privacy. We accepted that trade for a while too, and then we did the work to stop accepting it.
One
Where your data lives
In one place: an encrypted database on the phone in your hand. Lirea stores everything in SQLCipher, which encrypts the database whole rather than column by column, so there is no plaintext table sitting alongside the protected one and no partial copy to find.
The passphrase that opens it is not in the app, not in our source, and not derived from anything about you. It is generated at random on your device the first time you open Lirea, and then handed straight to the platform’s own secure storage: the Keychain on iOS, the Keystore on Android. On Android the key that wraps it is marked non-exportable, which means the operating system will not hand it out to anything, including to us.
We call that layer Aegis. It is the reason a stolen phone is a stolen phone rather than a disclosed medical history.
Two
Who can read it
Nobody, and the part worth dwelling on is that this is structural rather than promised. There is no account, so there is no row anywhere with your name set against a dose. There is no server holding records, so there is nothing to breach and nothing to subpoena. There is no analytics SDK, no crash reporter and no ad network, so there is no quiet second stream of data leaving alongside the first.
A company that wanted to reverse all of that could not do it in a policy update. It would have to rebuild the product.
Turn the network off
Put your phone in airplane mode and use Lirea normally. Log a dose, edit a vial, backfill a day you missed, read your history. It all works, because there is nothing on the other end waiting to be called. One screen is the exception and we would rather name it than have you find it: Levels is a Pro screen, so if you have not bought Pro, opening it puts the paywall up, and the paywall asks the App Store or Google Play what a subscription costs. Offline, that is the one call that fails. Nothing that holds your records needs the network at all. Try any of this with a tracker that keeps your data on a server.
Read Apple’s own report
On iOS, Settings has App Privacy Report. It is Apple’s feature, not ours, and it lists every domain each app on your phone has contacted. There is no server of ours on that list, because there is no server of ours. The one connection any part of Lirea makes is Apple’s own: when the paywall asks the App Store what a subscription costs, StoreKit talks to Apple. We wrote no networking code at all, and there is no arrangement under which we could make this report say something untrue.
On launch day, check what we filed
Both store listings will carry a data declaration: App Privacy on iOS, Data Safety on Play. Ours will say Data Not Collected. Neither listing is public yet, so this is the one check on this page you cannot run today. When they are, read them before you install: those are answers filed with Apple and Google that we are accountable for, which is a different thing from a badge we drew ourselves. If either one says something other than what this page says, do not install the app.
Lirea is not open source, and we are not going to imply that reading source code is how you would have verified this anyway. Almost nobody does, and a published repository is not proof that the binary on your phone was built from it. So we went the other way and made the claim checkable from outside the app, using tools Apple and Google built and we do not control.
Three
What happens when the phone is gone
This is the question local-first apps are worst at, and it is the one that actually costs people years of records. The usual answer is a shrug and a reminder that privacy has a price. We think that answer is a design failure wearing a principle as a costume.
Here is what happens instead. Your records travel inside your phone’s own backup, still encrypted, in exactly the way your photos and messages do. The key that opens them travels a completely separate road: iCloud Keychain on iOS, Block Store on Android. Neither road passes through us, we hold neither end of it, and the two only meet again on your new phone.
For most people that is the whole story, and it happens without a prompt, a passphrase or a ceremony. You set up the new phone the way you always do, open Lirea, and your history is there.
The counterintuitive part
We sync your encryption key, and it makes Lirea more private rather than less.
That sounds backwards, so here is the whole reasoning rather than a reassurance.
Apple encrypts iCloud Keychain end to end for every user, as one of a short list of categories protected that way by default. iCloud Backup is not end to end encrypted unless you have switched on Advanced Data Protection, and the large majority of people have not.
Before this change, Lirea’s key sat inside the backup scope next to the database. Moving it into the Keychain lifts the key out of a channel Apple can technically reach and puts it into one Apple cannot, while the encrypted database stays exactly where it already was. The floor goes up for nearly everybody, which is the reverse of what the phrase “we sync your key” sounds like it should mean.
Android works differently and we gate it accordingly. The key is only allowed to reach Google’s cloud when the device reports that end-to-end encryption is available, which requires a screen lock to be set. Where it is not available, the key is held back from the cloud entirely and rides a direct phone-to-phone transfer instead. It is never uploaded unprotected, and that condition is checked on every single write rather than once at setup.
And the fallback
A file that depends on nobody
Everything above runs on Apple’s and Google’s machinery. It works for almost everyone, and it is still somebody else’s machinery. So there is one more layer underneath it that answers to no one but you.
Lirea can write your entire history to a single file you hold. Every dose, every vial, every measurement, complete enough to rebuild the app exactly as it was, and restoring it is one action on a fresh install. Making one is free on the free tier and always will be, because charging for the exit would undermine the only claim this product rests on.
That file is not encrypted, and the decision was deliberate. A password you set today and cannot recall in eighteen months converts a recoverable situation into a permanent loss, which is precisely the failure the file exists to prevent. It never passes through us. You choose where it goes, and you should choose somewhere you trust.
What we cannot do
Three limits, said now rather than later.
Architecture that rules us out of your data also rules us out of helping you in specific ways. You should know which ways before you need to, not during.
We cannot recover your data
Not as a policy. As a fact. There is no copy at our end and no key at our end, so writing to us will never produce your history. Any company that could do it for you is a company holding your records, which is the arrangement this product exists to avoid.
We cannot promise recovery lasts forever
Platform backups expire once a device goes unused for long enough, and neither Apple nor Google publishes a figure we would be willing to repeat to you. This is exactly why the backup file matters: it is the one layer with no clock on it.
We cannot reach past an erase
Erase clears every record on the phone the moment you confirm it, and the database file is then rewritten so the deleted rows are not left sitting in free space. There is no recycle bin and no soft delete at our end, because we have no end. What erase cannot reach is anything already outside the app: a backup file you saved somewhere, or a copy sitting in your phone’s own cloud backup. Those are yours to delete, and only you can.
The short version
Everything above is a mechanism, not a promise.
That distinction is the entire point. A promise holds until the quarter it becomes inconvenient. A mechanism has to be dismantled, in code, by someone willing to rebuild the product to do it. It is the strongest guarantee software can honestly offer, and it is the one we built for rather than the one we wrote down.
The formal policy lives on Privacy, and what happens to your money if we ever break any of this is spelled out on Pricing. If something here is unclear or you think we have got it wrong, Support reaches a person.
Launching soon
Keep it, and keep it yours.
Track your weekly dose, your titration, and how you’re feeling, all on your device. No account required. Be first to know when Lirea is live.