Every health app promises privacy. The promises are in the marketing pages, in the terms of service, in the onboarding screens. And then, quietly, the data flows: to analytics platforms, to advertising networks, to "partners" whose names appear in no user-facing document. We know because we read the SDKs before we chose not to use them.
DB.Life makes money from subscriptions. That is the entire business model. We do not run ads. We do not sell data. We do not broker data. We do not permit third-party analytics tools to touch health data. Google Analytics runs on our marketing pages; it does not run inside the app. We use a self-hosted, open-source analytics tool for product metrics, and it processes aggregated counts, not individual records.
We encrypt data in transit with TLS 1.3 and at rest with AES-256. Database backups are encrypted with a separate key. We store data in the European Union. We do not replicate health data to other regions. We conduct annual third-party security audits and publish the summary findings on our security page.
But privacy is not just about encryption and storage. It is about defaults. Every pattern in DB.Life starts private — visible only to you. Sharing with family is opt-in, per pattern, revocable at any time. We do not have a "make everything public" toggle because we do not think that decision should be easy to make accidentally.
The hardest privacy decision we made was about the family graph. When two family members log similar patterns, we could surface the match to both of them automatically. We chose not to. Both users must have shared the relevant pattern with family before a match is surfaced. This means some real matches go unnoticed. We accept that trade-off because the alternative — revealing a pattern someone intended to keep private — is worse.
We do not train machine learning models on user data. Pattern matching in DB.Life is rule-based: string similarity, category overlap, family-relationship weighting. It is less impressive than an ML approach. It is also auditable, explainable, and does not require us to feed your health observations into a training pipeline. We will keep it this way.