- Sync is off until you turn it on
- With it off, entries live only on your device, in an app-private
database no other app can read.
- The app can reach the network
- Earlier versions declared no internet permission at all, so Android
itself would refuse to open a socket even if a bug tried. That
guarantee is gone. What replaces it is weaker: one compiled-in
destination (api.bpdtools.cloud), cleartext traffic disabled, and a switch that is off
until you turn it on. That is policy enforced by this app's code,
where before it was enforced by Android regardless of this app's
code. It is worth knowing which of those you have.
- Sync brought in more than one permission
- Alongside internet access, the background scheduler adds network-state,
wake-lock, boot-completed and foreground-service permissions, and
Android may add local-network access at install. Android Settings
lists seven, not one — worth knowing before you go looking. None of
them read anything on the device, and with sync off nothing is
scheduled for them to do.
- The first sync uploads everything
- If you turn sync on, the first upload is everything: every entry,
including what you wrote in "What happened?", and including entries
logged long before sync existed. Each one is sealed on the phone before
it leaves. Nothing has ever been marked as synced, so the first
successful upload is your entire history. The app tells you this, and
the exact entry count, before it happens.
- Entries are encrypted end to end
- The phone seals the emotion, the intensity, the coping skills and the
trigger note together under AES-256-GCM, with a 32-byte key that never
leaves your device, before any of it is sent. The server stores a blob
it has no key for: nobody with access to that machine can read what you
wrote — not with administrator access, not from a disk snapshot, not
from the offsite backup. What it can still see is the public metadata:
the entry's id, when it was recorded, created and last updated, whether
it is a deletion, and when it arrived. Timing, not content. That
metadata is bound to the sealed blob rather than merely filed beside
it, so a server that reordered your entries, backdated one, or
un-flipped a deletion would fail the next decrypt rather than manage it
quietly.
- Turning sync off does not delete what was already sent
- There is no delete endpoint, so the app cannot make one. Removing data
from the server is done on the server.
- Deleting an entry does not unsend it
- Once an entry has synced, deleting it on the phone does not remove the
row from the server. The row is kept there as a tombstone so that a
restore is faithful, but its payload stays sealed — the server cannot
read what was deleted any more than it could read it before. Clearing
the app's storage does not reach it.
- No account, no login, no telemetry, no analytics
- Nothing about your usage is collected or reported. There are two
secrets, and you paste in both yourself: the sync token, and the
encryption key that seals your entries.
- Android's cloud backup is disabled
- The app declares backup off, and an explicit rules file excludes the
database, the preferences, and every other file domain. The only
upload is the one you switch on, to one address you can name.
- Device-to-device transfer is deliberately left on
- It copies your entries straight from an old phone to a new one without
touching a server. Neither of your secrets comes across — the token and
the encryption key are both wrapped with a key held in the Android
Keystore, and those keys do not transfer. You paste both in again on
the new phone.
- Deleting your data
- Deleting an entry hides it from the app — it stops appearing anywhere
in the interface. The row itself is kept as a tombstone so that sync
can report the deletion. To remove the data from the phone, clear
bpdtools's storage in Android Settings, or uninstall the app.
