Oolo

Privacy

Your records stay on your device.

This page says, in plain words, what Oolo does with your health data, what it can’t do, and how you can check for yourself instead of taking our word for it.

Written against the project’s design documents as of 17 October 2026. Oolo is pre-release, and sections marked “Planned” describe features that are not built yet.

At a glance

  • Nothing leaves by default

    Oolo works fully offline. Reading documents, charts and cycle tracking all run on your device. You don’t need an account.

  • Sync is your choice

    If you turn it on, sync is end-to-end encrypted. Our servers hold only ciphertext and a little metadata, never your keys. Planned for v2

  • No ads, no trackers

    Default builds contain no analytics, advertising, attribution or crash-reporting software. We never sell data or share it for value.

  • A short list of domains

    The app may only contact a short list of domains, and it logs every request on your device where you can read it.

  • Models run on your device

    Text recognition and language models run on the phone. The first release has no ordinary cloud AI service.

  • Take it out, or erase it

    Export to open formats, or destroy the key that makes your data readable. Neither is ever behind a paywall.

On your device

Your records are encrypted on this device. We can’t read them. You decide what, if anything, leaves it.

  • An encrypted database. Records live in an encrypted SQLite database (SQLCipher). Its key is a random 256-bit key kept in the phone’s secure storage (Keychain on iPhone, Keystore on Android).
  • Every document is encrypted on its own (XChaCha20-Poly1305), inside the app’s private storage.
  • Kept out of backups. The database and files are excluded from Android Auto Backup and from iCloud backup. On iPhone this uses a flag that Apple treats as a hint, not a guarantee.
  • Never in iCloud. Oolo does not store health data in iCloud or CloudKit. Apple’s rules for health apps don’t allow it.
  • Never written back. Oolo never writes values it read from your documents back into Apple Health.
  • Deleting is real. Deleting on the device destroys the master key, so everything becomes unreadable.
  • App lock. Biometrics or a PIN open the app.

Discreet mode, for shared phones

Oolo is designed for phones that other people can reach, including households with a controlling partner. Discreet mode includes:

  • a neutral alternate icon and name
  • notifications with no health text
  • quick exit: one tap jumps to a neutral screen
  • a decoy PIN that opens a harmless view
  • a blurred app-switcher snapshot
  • widgets that show nothing sensitive on the lock screen
  • an optional “never sync” mode
  • a panic wipe, designed so it can’t be triggered by accident

Where reproductive health data can carry legal risk, the app suggests local-only mode and explains why. It decides this from your store region, never from your location.

If you turn on sync Planned for v2

Sync is optional and off until you turn it on. It lets several devices share the same records. It is not built yet.

  • End-to-end encrypted. Your devices encrypt everything before it leaves them. The server holds ciphertext, so we can’t read it. We say “we can’t read it” only about data that is end-to-end encrypted.
  • Two ways back in. Before sync turns on, you must have two independent ways to unlock: a passkey and a 24-word recovery kit. An optional password can be a third.
  • Lose every way in and the data is gone. We keep no copy of your keys, so we can’t recover it for you. Oolo says this plainly during setup.
  • Regions. Your account has a home region, EU or US, chosen from your store country unless you change it. Where local law may require data to stay in a country, or to sit with a certified host, sync stays off at launch and your data stays local-only while we wait for legal advice.
  • Your own storage. If you pass the storage cap, you can point sync at your own S3-compatible bucket or a self-hosted relay. Everything is encrypted before it leaves the device.
  • Deleting an account removes the key slots and the ciphertext. Our backup storage is locked for 30 days, so deleted data can remain there for up to 30 days.
What our server holds when sync is on
KindWhat
Stored Account ID, home region, your wrapped key slots (as ciphertext), device public keys, your purchase entitlement, and the creation date.
Visible when you connect Padded sizes, timestamps and IP addresses. We keep logs minimal.
Never stored Your name, your date of birth, any health data in readable form, and your keys.

Technical detail: privacy and security design and the sync relay.

No ads, no trackers, no data sales

  • No third-party software that watches you. Default builds contain no analytics, advertising, attribution or crash-reporting SDKs.
  • No ads, ever. We don’t sell data or share it for value. Apple’s and Google’s store rules also forbid using health data for advertising.
  • No in-app browser. Links open in your system browser, so no web page runs inside the app.
  • Diagnostics are opt-in. Usage events and crash reports are off by default. They use a fixed list of event names, never include health values, and crash reports have personal data scrubbed. Planned for v2
  • Notifications carry no health text. Reminders are local notifications. Any server push has no content, and visible text stays generic.

What the app can contact

The app may only reach a short allowlist of domains: model downloads, sync, the token service for wearables, the email inbox, and store purchase checks. Each is optional or happens only when you ask for it. The one place readable data arrives is an email you choose to forward, which is encrypted as soon as it arrives. The full table, with when each is used and what it can see, is on the transparency page.

Every request is logged on your device with its time, domain, purpose and size, and the Privacy center shows the log.

We treat zero egress as something to test, not to promise. Our web end-to-end tests already fail on any request outside the allowlist (e2e/support/fixtures.ts), and the plan is to run every core flow behind a recording proxy on every build.

Where AI runs

  • On your device, by default. Small open models, licensed Apache-2.0 or MIT, run on the phone. Open weights running locally means no data goes to the maker of a model.
  • Downloaded once, and checked. Models come from our own mirror when the build has one, because outside download networks would see your IP address. A build without a mirror downloads from huggingface.co, which then sees your IP address; the in-app network log shows which host was used. The app checks each file against the hashes in a manifest and won’t load a file that doesn’t match. The table is on the transparency page.
  • Optional “Private Cloud Boost”. For phones too weak to run a model, a single request can run on attested confidential-computing hardware: Apple Private Cloud Compute, Tinfoil or Privatemode. It is off by default and asks per request. Planned for v2
  • No ordinary cloud AI services in the first release, even ones with zero data retention.
  • Documents can’t give orders. Text in a document is treated as data. The tools are read-only, Ask has no network tools, and the app warns you if a document contains instructions aimed at an AI.

How to check for yourself

Privacy you can’t verify is a promise. These are the ways to check, starting with the ones that exist now.

  1. Read the code

    The app, the services and the cryptography are open source under the AGPL-3.0. Start at the repository.

  2. Read the network log

    The Privacy center lists every request the app made: time, domain, purpose and bytes, so you can see when it reached out and why.

  3. Try airplane mode

    Every feature except sync and downloads is designed to work with no connection. If it doesn’t, that is a bug, and we want to hear about it.

  4. Watch it from outside

    Run the app behind your own proxy or firewall. You should see requests only to the domains on the allowlist, and only when you used a feature that needs them.

  5. Build it yourself

    Planned for v1 Android builds are planned to be reproducible, so F-Droid and you can verify that the APK matches the source. See how to build it.

  6. Check the release

    Planned for v1 Each release is planned to carry a signed attestation that links the binary to its source commit, plus a software bill of materials. See release signing.

Your choices and your data

  • Consent arrives one question at a time. Oolo asks when a feature first needs a permission, such as reading your documents or a health-store permission. There is no wall of toggles at install.
  • Take everything out. Export a FHIR R4 bundle, a CSV, or a PDF summary for your clinician. Or export an encrypted file that open-source tools can open, even if we disappear. Every export and share asks you to confirm and is logged on your device.
  • Erase everything. Export, deletion and your full history are never paywalled.
  • Research is a separate, later choice. Donating data to a study needs your informed consent for that study and ethics approval. It is off by default, it can be withdrawn, and we never sell data. Planned for v3
  • Adults only at launch. Oolo is for people 18 and older.

What we can’t promise

  • If your phone is unlocked in someone else’s hands, they can open the app unless app lock is on. On shared phones, use app lock and discreet mode.
  • If your records live only on one phone and you lose it without a backup, they are gone. Keep an encrypted export. Oolo sends a reminder every quarter.
  • An app can’t defend against a phone whose operating system is already compromised.
  • Oolo is pre-release. Don’t use it as the only copy of any health record.

Policies and legal status

Placeholders. Placeholder The formal privacy policy, and the separate consumer health data policy that some US states require, will be published here before the first release. Both depend on the legal entity, which is not decided yet.

Details that depend on the legal entity
DetailStatus
Legal entity and data controllerPlaceholder Not decided
Privacy contactPlaceholder To be published
Privacy policyPlaceholder To be published before release
Consumer health data policy (US states)Placeholder To be published before release

What about HIPAA?

We don’t claim HIPAA compliance. HIPAA covers health plans, clearinghouses and providers that bill electronically, and the companies that work for them. A personal health app that you choose to use isn’t one of those, so HIPAA doesn’t apply to us. We use safeguards modelled on the HIPAA Security Rule, such as encryption and access logs, because they are good practice. Pending legal review

Oolo is a personal health record and wellness app, not a medical device. See the medical disclaimer.