Not a promise. An architecture. Here's exactly how it works — and why XtrkR is built so your records stay on your device, not on servers I operate.
XtrkR uses Apple's SwiftData framework to store your records in a local database on your device. There is no XtrkR account. There is no XtrkR server storing your records. There is no cloud sync unless you explicitly enable encrypted iCloud backup.
When you log an encounter, that data is written to a SQLite database inside the app's sandboxed container on your iPhone. XtrkR does not send that record to a server I operate.
SwiftData + SQLiteXtrkR uses limited Apple-provided network services for specific features. One is Apple's StoreKit framework, which handles in-app purchases. That is Apple's code talking to Apple's servers about whether you made a purchase. I do not see your payment card details.
Another is Apple's MapKit, which can translate a location coordinate into a city or place name when you choose to add a location to an encounter. That request goes to Apple's servers, not mine, and only when you choose to use that feature. If you never add locations, MapKit is never called.
Beyond those Apple-provided services, there are no ad networks, analytics SDKs, or third-party tracking tools in the app. You can optionally share diagnostics from Settings, but nothing is sent to me without your action. The app is otherwise designed to stay quiet on the network.
Most apps include dozens of third-party libraries that phone home. XtrkR includes zero. The entire app is built with Apple's native frameworks and nothing else.
Zero external dependenciesIf you choose to back up your data, XtrkR creates an AES-256-GCM encrypted file and saves it to your personal iCloud Drive. You set the password. The encryption happens on your device before the file is written.
You tap "Create Backup" and enter a password you choose
Your data is encrypted on-device using AES-256-GCM with your password
The encrypted file is saved to your personal iCloud Drive container
Only you can decrypt it with your password — and I cannot decrypt it
AES-256-GCM is the same encryption standard used by banks, governments, and Signal. The "GCM" part adds authentication — meaning the backup can't be tampered with without detection.
AES-256-GCM encryptionThis isn't a policy decision — it's an architectural constraint. The app is designed so that the following are technically impossible:
If you save a photo or screenshot to XtrkR using the iOS Share Sheet, it is processed entirely on your device:
You are responsible for what you choose to save. Do not use XtrkR to store unlawful content, including nonconsensual intimate images or images of minors.
Because your data lives on your device — not on my servers — I have nothing to hand over in response to a subpoena or legal request. I literally don't have your data.
However, your device itself can be subject to a warrant or physical seizure. If law enforcement obtains a valid warrant for your iPhone, the data inside XtrkR — like all data on your phone — could potentially be accessed. This is true of any app that stores data locally.
If you enable encrypted iCloud backups, the encrypted backup file is stored in your iCloud Drive. Apple could be compelled to produce that file in response to a legal request, but it is AES-256-GCM encrypted with a password only you know — without the password, the file is unreadable.
XtrkR's architecture protects you from data breaches, corporate surveillance, and developer access. It does not — and cannot — override the legal authority of a court order directed at your own device. Protect your device with a strong passcode and keep your backup password private.
If you're using XtrkR to track PrEP adherence, STI test results, encounter history, partner details, or other sensitive health information, you're storing deeply personal data. Many apps in this space require accounts, sync to cloud servers, or include analytics that track user behavior.
That kind of architecture creates risks this app is designed to avoid.
XtrkR was built so your records stay on your device, not because of a privacy promise that could change, but because of an architecture designed around local storage.
Full Premium access. No credit card. No account. Your data stays on your iPhone, not on servers I operate.
See pricing