“Private” is a marketing word until you can trace the data. Local-first describes a product decision: sensitive records are designed to work on your device instead of requiring a company-controlled health database.
Three architectures that sound more similar than they are
Encryption matters in all three models. The larger privacy difference is who receives the readable record, who controls recovery, and whether the core product works without an account.
| Model | Where the sensitive record lives | Main tradeoff |
|---|---|---|
| Cloud account | Company-controlled servers, usually with a device copy | Easy sync and recovery; the operator possesses more sensitive data |
| Device-only | One phone or tablet | Minimal operator access; uninstalling or losing the device can lose history |
| Local-first + user export | Device by default; encrypted backup only when the user creates it | More control, but the user must store and restore the backup |
What can stay on the device
Entries such as urges, lapses, sexual activity, cycle dates, LH status, notes, and training records do not need to be uploaded to create their core value. Trends and reminders can be calculated locally.
This reduces the amount of intimate information the operator can expose, misuse, or be compelled to produce. It is not the same as claiming that a phone is invulnerable; device access, backups, screenshots, and notification previews still matter.
What may still leave the device
A marketing site still receives ordinary web requests through its hosting provider. An app may send a small operational event—such as “onboarding completed” or “paywall viewed”—if the user agrees. Those events should be separated from the sensitive record and shown in plain language.
The FTC’s 2023 action involving the Premom ovulation app is a useful reminder that health-app disclosures and advertising data flows deserve close scrutiny. A privacy label alone is not enough; users need a product-level view of what is actually sent.
Backup is where the tradeoff becomes real
If the company does not keep your sensitive record, it cannot silently restore that record after a lost phone. A responsible app says this before you build months of history.
A practical middle path is a user-initiated encrypted export. You choose when to create it and where to store it. The app should document the format, test restoration, and explain that losing both the phone and the backup means the record cannot be recovered.
Five questions to ask any sensitive health app
You should be able to answer these from the product and privacy policy without translating legal language.
- Can I use the core product without creating an account?
- Which exact record categories leave my device, and why?
- Can I inspect or disable optional analytics?
- What happens to my history if I lose or replace the phone?
- Can I export and permanently delete my data without contacting support?
Local storage still needs a private interface
Local storage does not help if another person can freely open the app on an unlocked phone. System Face ID or biometrics, discreet notification text, a neutral icon option, hidden preview content, and a fast lock action are part of the privacy model.
On Apple devices, apps using Face ID receive an authentication result; they do not receive the enrolled face data. Virise uses system authentication rather than creating its own biometric database.
Questions people ask
Frequently asked questions
Does local-first mean an app never connects to the internet?
No. Downloads, purchases, optional analytics, help pages, and website requests may still use the internet. The important question is whether the sensitive record itself is required to leave the device.
Is cloud storage unsafe even when it is encrypted?
Not automatically. Encryption is an important control, but cloud storage means another operator possesses and manages the record. Local-first reduces that possession; it does not make every cloud product unsafe or every phone perfectly secure.
How can I move local-only records to a new phone?
Use a user-initiated encrypted export when the app supports it. Store the file somewhere you control, then import it on the new device. Without a device or backup, the operator may be unable to recover the record—and should say so clearly.
Can Face ID reveal my face data to the app?
Apple says apps receive whether authentication succeeded; they do not receive the enrolled Face ID data. The app should use the system prompt rather than create a separate biometric database.