Why TrackMedi keeps your health data on your device (and off our servers)

TrackMedi is a privacy-first medication and health tracker for Android. Many pill reminders sync your data to a server. This one does not. It handles dose schedules and appointment reminders, and it records the vitals people track day to day: blood pressure (BP) with pulse, blood sugar level (glucose), and body temperature (temp). Each person you care for gets their own profile, and all of it works entirely offline.

There are no accounts, no backend servers, and no cloud syncs. Every record is locked in an encrypted database on the phone that created it.

Three phrases dominate almost every health app listing, ours included: Local Storage Only, Military-Grade Encryption, and No Data Selling. They cost nothing to write and are close to impossible to verify from the outside. Here is what each one means in our code, and exactly where it stops.

Local storage: why your health data does not belong on a server

Health records are the one category where a broken privacy promise has consequences you cannot walk back. A central server holding medication schedules for thousands of people is a target. You can reset a stolen password, but you cannot un-disclose the medications someone takes.

The most reliable way to protect that data is not to hold it. If we do not run a server, there is no server to breach. There is no backup to leak, no employee with a production database console, and no future acquisition that quietly changes who owns your medical history.

So local-first is not a default we might revisit later. TrackMedi has nowhere to send your data. Reminders are scheduled locally by Android rather than by a push service, which means no server ever learns that someone has a dose due at 8pm. That is revealing metadata even without a medication name attached.

The rule holds with one exception, and it is under your control: you can export an encrypted backup.

The truth about "military-grade encryption"

The phrase is mostly marketing. It usually points at AES-256, the cipher the US government approves for classified material, and because that cipher is standard, free, and used by every serious app in the Play Store, seeing it in a listing tells you very little.

What actually differs between apps is how they handle keys.

In TrackMedi your records live in a SQLCipher database encrypted with AES-256. Both the database file and its write-ahead log are ciphertext. The key is a random 256-bit value generated on your phone and held in the Android Keystore, wrapped by hardware-backed protection where the device provides it, so it never sits in the app's own files and never reaches us.

Exporting a backup uses a second, separate key. The file is sealed with AES-256-GCM under a key derived from your passphrase with scrypt, and it authenticates its own header, so a tampered file refuses to open rather than opening wrongly. We never store or receive that passphrase.

Two consequences follow, and both are real. Lose the phone without a backup and the records are gone, because the database key went with it. Lose the passphrase and the backup is gone, because there is no reset link and no master copy for us to unlock.

Encryption at rest also protects a stored file, not an unlocked phone. Anyone holding your unlocked device, or reading notification previews over your shoulder, can still see your medication names. A screen lock still matters.

Secure backups: the one export you control

Backups are free for every user. Paying removes ads, and that is all it does. Charging for the feature that rescues your medical history from a dying phone felt like the wrong thing to sell.

You choose where the file goes. One option is a folder you pick through Android's own system folder picker, where the app takes access to that single folder and never asks for your storage as a whole. The other is your Google Drive, under a scope limited to files the app creates or that you hand it, writing to a visible folder named TrackMedi Backups that you can open and empty yourself.

There is no RaadCraft server in either path. You can also switch on a daily backup, which runs when you open the app or come back to it rather than in the background, and it keeps the seven most recent files at each destination. Restoring enforces a size limit, authenticates the file, validates every record and the relationships between them, and then asks you twice before it replaces what is in the app.

What a local-first architecture gives up

This is the part usually left out of privacy manifestos.

Refusing a backend costs several conveniences. There is no multi-device sync, and two phones never reconcile. Because the database key stays in one phone's Keystore, a copied database file is unreadable on new hardware. Moving to a new phone is deliberate, done with your backup and your passphrase, rather than something that happens quietly overnight.

There is no web version either. Support is harder, because when something goes wrong we cannot look up your account to see the error. We can only ask.

These are real limitations and our users live with them. We think the trade is right for this category of data. It is still a trade.

"We do not sell your data", and what actually leaves your phone

On its own, that sentence is nearly worthless. Almost no app admits to selling data, and plenty of them share it for advertising, which is the part that affects you. So here is the whole list of what leaves the phone.

Google AdMob, in the free version. The Google Mobile Ads SDK may collect your advertising identifier and app set ID, approximate location derived from your IP address, device and app information such as model and OS version, diagnostic information such as launch time and hang rate, and your interactions with the app and with the ads themselves. Google processes that as an independent controller and passes it to the ad technology providers we select in AdMob so they can bid on and measure the ads. Nothing you type into TrackMedi is in that list. Medications, dose history, blood pressure and glucose readings, body temperature, appointment reminders, and care profiles are never sent to AdMob and never included in an ad request. Buying the paid version removes the ads.

Google Play Billing. If you buy the paid version, Google processes the purchase. We never see your card, billing address, or Google account details. The app receives only the entitlement status it needs to know that ads should be switched off, and stores that on the device.

Google Drive, and only if you connect it. What travels is one encrypted file that Google cannot read, going to your own account at your own request.

Under California law, showing personalized ads through AdMob may count as "sharing" personal information for cross-context behavioural advertising, even though no money changes hands. We would rather write that down than hide behind the narrow meaning of "sell".

Google Play makes every app declare its collection in a Data Safety section, and the form is self-reported. When Mozilla reviewed the 40 most popular apps on Google Play in February 2023, it found discrepancies between those labels and the apps' own privacy policies in nearly 80 percent of them. Sixteen were graded "Poor", among them Facebook, Twitter, and Minecraft. Our own declaration says the same thing this article does, and the same thing as the full privacy policy, which goes through every category of record the app stores and how to erase it.

A tracking tool, not a medical device

TrackMedi is a tracking and reminder utility. It is not a medical device, it does not diagnose conditions, and it will never tell you what to take or when to adjust a dose. A BP or glucose reading gets range feedback, and that feedback is informational, not a diagnosis. Those decisions belong to you and your doctor. The app's job is to remember reliably, on a device you control.

The general lesson

Local-first is not the right choice for most software. It costs you cross-device sync and easy customer support, and it shifts data recovery onto the user.

It is the right choice when the data is sensitive enough that holding it is a liability rather than an asset. Medication tracking qualifies. The value of a pill reminder happens entirely on the phone, at the moment the alarm fires.

If you are building something in this shape, ask whether you need a server at all before you work out how to secure one.

You can read more about the app, and install it, from the TrackMedi page.