Security

What we protect. Your account, your health data and the credentials you give Mahere for other services.

How. Your data is stored in the EU (Frankfurt) in a database where every row carries your user id and a policy that only your signed-in session can read or write it. Connections to other services are stored encrypted with a key that never leaves our server. All traffic is encrypted in transit. The app on your phone keeps a protected local copy of recent data so logging works offline; it is encrypted by iOS until your first unlock after a restart. We keep no analytics or advertising code in the app. Our server logs never contain your food, weight, sleep, lab or location values.

What we never do. Use a master database key in our code, store a shop or trainer password, sell or share your data, read your data without a written request from you.

Reporting a vulnerability. Email security@mahere.app with what you found and how to reproduce it. We answer within three working days, keep you informed, and credit you if you wish. Please do not access other people's data while testing, do not run denial-of-service tests, and give us a reasonable time to fix before publishing. We do not pursue researchers who follow these rules.

Keeping you informed. If a security incident affects your data we tell you without undue delay, say what happened, what it means for you and what we did.