The safest place for your health data is a server that doesn't exist.

The 3am entry that became inventory

In January 2021, the US Federal Trade Commission found that a period-tracking app used by tens of millions of people had been handing users' menstrual and pregnancy data to Facebook and Google, after telling those users it would keep the information private. The data didn't leak through a hack. It left through the front door, by design, because the app was built to send it. That's the part that should stop anyone who logs a symptom at 3am. A migraine entry, a mood note, a medication timestamp: the moment it lands on someone else's server, it stops being a health record and becomes an asset on their balance sheet. Not stolen. Just repurposed.

The custody principle

The safest place for a person's health data is a server that was never built. Call it the custody principle. If an app never takes custody of your symptom log in the first place, there is nothing to breach, nothing to subpoena, nothing to sell when the company runs low on runway, and nothing to hand a data broker during an acquisition. Privacy stops being a promise in a policy nobody reads and becomes a property of the architecture. You can test any health app against it in about thirty seconds, with four questions. We call it the custody test, and it works whether you're a patient deciding what to trust or an indie developer deciding what to ship.

Why 'we take your privacy seriously' is the wrong promise

Most health apps answer the privacy question with reassurance. A line in the onboarding flow. A policy page that runs four thousand words. A badge that says data is encrypted in transit and at rest. All of that can be true and still leave you exposed, because encryption keeps outsiders out. It does nothing about the company holding the keys. If the business model depends on the data, the company is the party you should worry about. Reassurance also has a shelf life. The team that meant every word of its privacy policy in 2021 can be acquired in 2024 by a buyer who reads that same data as inventory. A promise is only as durable as the corporate entity making it, and health apps get acquired, pivot, and shut down constantly.

Architecture outlasts intentions.

What the regulatory record actually shows

This isn't a hypothetical worry dressed up as principle. The enforcement record is specific and recent. In 2023 the FTC brought its first-ever action under the Health Breach Notification Rule against a prescription-discount app, penalizing it $1.5 million for sharing users' health data with advertisers. Weeks later it fined an online-therapy platform $7.8 million for handing mental-health information to Facebook and Snapchat after promising confidentiality. The pattern is consistent: the data left through integrations and analytics SDKs. Nobody broke in. Apple has drawn a harder line than most. App Review Guideline 5.1.3 bars apps from using HealthKit data for advertising or data-mining and from sharing it without explicit permission, and the App Privacy labels it started requiring in December 2020 force every app to declare what it collects. Useful guardrails. But a label tells you what an app collects, not whether it needed to collect it at all.

The custody test, run on a real decision

Picture someone with vestibular migraine downloading a new tracker on a bad week. They can't read fine print through the visual disturbance, so they need a fast read. Question one: does it work with no account? If the first screen demands an email and password, the data already has a home on someone's server before the first entry. Question two: where does the log live by default, on the device or synced to a cloud the company controls? Question three: can you export everything, in a format you can actually open and re-import elsewhere? Data you can't take out is data you don't really own. Question four: how does it make money? Subscriptions and ad SDKs reward retention of your data. A one-time or lifetime price doesn't need it. Four answers, and you know more than the policy page would tell you in twenty minutes.

What changes when on-device is the default

For developers, the custody principle is a harder business to run and a much easier conscience to keep. You give up the recurring-revenue lever of holding user data hostage and the growth-hack of analytics that watch every tap. In exchange you get a product that can't leak what it never stored, and a trust story that compounds instead of degrading with every acquisition rumor. For patients, the payoff is blunter: your symptom history survives the company. If the app shuts down tomorrow, an on-device log with a real export is still yours. A cloud account is only yours until the servers go dark or the terms change. The chronic-illness audience has learned this the hard way, app after app.

How we build it

We built Postdrome to pass its own test, because a migraine log is about the most sensitive timeline a person keeps. There's no account. You open it and start logging, on a bad-vision day, in Aura Mode. Every entry, the headache and the 24-to-72-hour postdrome after it, lives on your iPhone, written to HealthKit under Apple's own restrictions, not to a server we operate. You can export the full history whenever you want, in a format you can hand a neurologist or import somewhere else. And the price is paid once, for life, so we never have a reason to hold your data as leverage for the next renewal. The architecture is the privacy policy.

What we're watching

Two things. Apple keeps pushing computation on-device, which quietly makes the private architecture the capable one too, not the compromise it used to be. And US state health-privacy laws are multiplying past the old HIPAA gaps that never covered consumer apps in the first place. Both trends point the same direction. The apps that treated custody as the default won't have to retrofit trust when the rules catch up. The ones that built on data extraction will.