Security

We don't sell your info — for ads or anything else

We only store what the product needs: your measurements, your journal, your goals, and the credentials that collect them. Subscriptions are the only money that comes in, so there is no second business your data could be the raw material for.

Nothing here profiles you. This site ships no analytics, no tracking cookies and no third-party scripts, and we never work out your age, income or address the way ad-funded apps do — nothing about this business would be improved by knowing.

The whole story is in the privacy policy, written against the code rather than from a template.

Your data is protected and safe with us

Sign-in runs on Firebase Authentication. We never see or store your password — Firebase holds it, and Google sign-in means it is never typed here at all.

Keys and tokens for the services you connect are encrypted with a Google Cloud KMS key before they are written to the database, so the database never holds a usable credential. The plaintext exists only in memory, only while a collection is running.

We ask each service for the narrowest access that lets its metrics be collected — enough to read your sleep, your workouts, your transactions. Collection only ever reads: nothing here writes to your accounts or moves anything on your behalf.

Traffic is encrypted in transit, the database is encrypted at rest, and every request has to carry a verified sign-in token before it can read a single row — one account’s data is never reachable from another’s session.

Payments run on Stripe’s own checkout page, so card numbers never reach our servers. Files you upload are read once, turned into measurements, and deleted.

Trusted partners

Handling your most sensitive data happens on a short list of vetted, independently audited providers — the same three the privacy policy names, and the complete list:

Google Cloud — runs the service, holds sign-in via Firebase Authentication, and guards the key that encrypts your source credentials with Cloud KMS.

Neon — hosts the Postgres database your measurements live in, encrypted at rest and in transit.

Stripe — takes the payment and runs the subscription, to the card industry’s strictest audit level. Card details go to Stripe and never to us.

No system is perfectly secure, and we won’t pretend otherwise. If you find a weakness, tell privacy@quantifiedlife.io before you tell anyone else, and you will get a real answer from a real person.