Security
How your family's data stays safe.
The short version
Your data stays on your device unless you turn on sync. Synced data is encrypted in transit and my offsite backups are encrypted, but the live database is not, and I can technically read synced records. End-to-end encryption is planned.
1. Local-first architecture
Tracking, analytics, and predictions all run on your device, and the app works fully offline.
2. Sync encryption
With household sync on, traffic is encrypted in transit (TLS) and offsite backups are encrypted. The live database is not encrypted at rest, and I hold the keys. I don't read your data, but I could. End-to-end encryption would close that gap, and I'm working on it.
3. Authentication
Sessions use HttpOnly cookies that aren't accessible to JavaScript. Tokens are scoped and short-lived. CSRF protection is enforced on all authenticated routes.
4. Infrastructure
Each household's data lives in an isolated database. Sync replicates across independent nodes in separate geographic regions so a single datacenter failure doesn't affect availability.
The app enforces Content-Security-Policy headers, Strict-Transport-Security, and blocks access to internal database endpoints at the reverse proxy layer.
5. Backups
Encrypted backups run daily and are stored offsite on a rolling schedule: 7 daily, 4 weekly, 3 monthly. If you delete your account, your data is removed from servers right away and ages out of backups within 90 days.
6. What I don't do
- No ad-tracking scripts or third-party analytics
- No selling or sharing of data
- No server-side analytics or algorithms running on your data
7. Limitations
Rhythm is a web app. Browsers can clear stored data under storage pressure (low disk space, for example). Turning on household sync is the best way to make sure you don't lose anything.
I'm one developer, not a security team. I take security seriously, but I haven't done formal third-party validation.
Found something?
If you find a security issue, please report it via security@rhythm.baby. I'll respond as quickly as I can.
Rhythm App, LLC
Incorporated in the State of Delaware