Security
The strongest security is having nothing sensitive to steal. Kata keeps your health data off its servers and seals the one copy that leaves.
There is no central store of readable health data. Someone who reached our servers would find accounts, counts and sealed bytes, not anyone’s diary.
On a shared device, each account’s data is kept apart, so signing in as someone else never shows your entries.
Every connection is encrypted with TLS.
The sealed copy on Android and the web is encrypted on your device with AES-256-GCM, under a random key made on your device. The key is never sent to us.
Accounts run on Supabase in Switzerland and hold no health data. Sign in with Apple, Google or email; with Apple you can hide your email address.