This notice explains how N-of-1 (“the app”, “the software”) handles information when you use the open-source application, and when you visit this project page.
1. Summary
There is no backend, so there is nothing for the developer to read. The app is offline-first. Your entries, settings and related files are written only to storage you control — plain JSON in a folder on your device that you choose. The developer cannot see, read or recover it unless you choose to send it yourself, for example by emailing a file. Note that those files are not encrypted — see section 7.
2. Data the app stores on your device
Depending on how you use the app, it may store on your device:
- Health and lifestyle entries (for example sleep, meals, exercise, symptoms, digestion, notes)
- Optional photos you attach to entries
- App preferences (for example data folder path, reminder times, rest days, medication-tracking opt-in)
- Optional lock settings (for example PIN or biometric unlock flags on the device)
That information stays under the path you configure. If you place the folder inside a third-party sync client (for example Syncthing, Nextcloud or Dropbox), that sync is entirely between you and that provider under their terms. The app itself does no syncing and has no cloud service.
3. Data the developer collects
None through the app. The application source is designed without accounts, analytics SDKs, advertising identifiers, or any upload of your entries to the developer. The Android build requests no internet permission at all, and the source is public, so this can be verified rather than taken on trust.
If you contact the developer — for example by email for support or contributions — you provide whatever you include in that message. That correspondence is used only to respond, and is not a health data processing service.
4. This project page
This page is static HTML and CSS. It loads no third-party scripts, fonts or analytics, and sets no tracking cookies. Your web host or browser may create ordinary technical logs, for example an IP address in server access logs, outside the control of this application's source code.
5. Permissions
On some platforms the app may request device permissions, for example notifications, optional biometrics, storage or folder access, and camera or photos for attachments. Those permissions are used only to provide the corresponding local feature. Denying a permission simply disables that feature.
6. Children
The app is a general-purpose tool. It is not directed at children. Do not store another person's sensitive health information without a lawful basis and their appropriate consent.
7. The data is not encrypted
Entries are written as plain, readable JSON. The app does not encrypt them, and the optional PIN or biometric lock guards the app, not the files behind it.
That means anyone with access to your unlocked device, your file system, or the folder you chose can read your entries — including a third-party sync provider if you place the folder inside one. Offline means the developer never receives your data; it does not mean the data is protected on your own machine.
If your threat model calls for it, use full-disk encryption, an encrypted sync tool, or an encrypted container for the data folder.
8. Your responsibilities
- You are responsible for backups, encryption, and who can access the device and data folder
- You are responsible for any sync, share or export you configure
- You should not rely on the app as a medical record system or emergency service
9. Changes
If this notice changes, the updated text will appear in the project repository. Continued use after an update means you should review the new text.
10. Contact
Privacy questions about this open-source project: [email protected]