One account, one boundary
Persistent records are tied to an internal owner identifier. The personal space never selects another owner from a free URL parameter.
Privacy
Your data stays under your control
Every account has its own data boundary. Access, correction, export and deletion are normal parts of the product lifecycle.
Access and correction
The My data center lets you review account information, update it and revoke other sessions.
Export
You can export what the server holds for your account. Encrypted health payloads are not decrypted by administration.
Seven-day deletion window
A deletion request starts a seven-day safety window that can be cancelled before a private worker performs the purge.
Photos and OCR
Photo reading is assisted. Human confirmation remains mandatory before a detected value is stored.
Contact
Messages are encrypted before storage and the notification email does not repeat the message body.
Separate administration
Account, access, security and privacy workflows stay separate from decrypted health measurements.
No third-party telemetry
The public runtime includes no advertising tracker or external analytics platform.
Documented limits
Technical limits are stated without absolute promises, especially for backups and devices that remain offline.