Security

Keys

No secrets ship inside the app

An API key compiled into a mobile app is not hidden. On Android it is a constant in the DEX file; on iOS it is a string in the binary. Either takes minutes to pull out with free tools.

So Praana's AI key does not live in the app at all. Calls go to a Cloudflare Worker, the Worker holds the key and talks to the provider, and the app never sees it. The files that hold local credentials are excluded from version control and stay that way.

Clients

The backend checks who is calling

Firebase App Check runs on both platforms: App Attest on iOS, Play Integrity on Android. The server can tell a request from a real, unmodified build of Praana from a script pointed at the same endpoint.

Without it, a public endpoint is a public endpoint, and the first thing that finds it is a bot spending your AI budget.

Rules

Database rules live in files

Firestore security rules are kept in the repository and deployed from there, not edited in a web console. A rule changed in a console is a rule nobody can review and nobody can roll back.

On the device

What the phone protects

• Health data sits in Apple Health or Health Connect, under the operating system's encryption and your passcode.
• The journal can be locked behind Face ID, Touch ID or your fingerprint.
• Praana asks only for the health permissions it uses. Five Health Connect permissions were removed after an audit found nothing was reading them.

Accounts

Sign-in and deletion

Sign-in is handled by Firebase Authentication, including Sign in with Apple and Google. Praana never sees or stores your password for those.

Account deletion runs server-side and purges the stored collections rather than flagging a row as inactive.

Honest limits

What is not claimed

• Praana has not been through a third-party penetration test or a formal audit.
• It is not HIPAA-certified, and is not intended for use by covered entities.
• It is one developer's work, reviewed carefully but not by a security team.

Reporting

If you find something

Email it. Include enough detail to reproduce the issue, and please do not test against other people's accounts or publish before there has been a chance to fix it. You will get an acknowledgement within two working days.