What we encrypt (and don't)

The exact list — because "bank-grade security" is a slogan, not an answer.

The short version:

Who you are (name, email), your lab results and medications, and the daily readings behind your gauges are encrypted at rest. Everything travels over HTTPS.
Your health data lives in your own private store under a random ID — your name is never in it.
A few things are deliberately not encrypted, and we tell you exactly what and why below.

Encrypted at rest

What	Status	Detail
Your name & email	Encrypted	Stored in a separate identity vault, encrypted (AES via Fernet). Sign-in lookups use a keyed blind index, so even the lookup never stores your plain email.
Lab results & medications	Encrypted	Your lab draws (A1c, lipids, panels) and med list — the most sensitive content we hold — are encrypted with the same vault key.
Daily readings	Encrypted	The raw values inside every stored event — steps, sleep minutes, heart-rate variability, glucose, weight, workouts, your manual logs — are encrypted at rest.
Backups	Encrypted	Backups are passphrase-encrypted archives, and the vault key is deliberately excluded from them — a stolen backup is locked twice.

Not encrypted — on purpose, and here's why

What	Status	Why
Event timestamps & types	Plain	Each stored event keeps when it happened and what kind it is (e.g. "a sleep summary") in the clear — that's what lets us window your history by date and route events to the right rules without decrypting everything. The values inside are encrypted.
Content fingerprints	Plain	A one-way hash of each reading lets a re-uploaded export be recognized as "already have this" without decrypting anything. It reveals only whether two entries are identical — not what they say.
Your gauge scores	Plain	The derived 0–100 gauges, nightly snapshots, and your personal percentile bands are stored in the clear inside your private store. They're derived scores keyed to a random ID — not raw readings, and not tied to your name.
Nudge text	Plain	Nudges are deliberately written without numbers ("Your Calm has been on the quieter side lately…"), so the stored text contains no readings to protect.

The bigger protections around the encryption

Identity/health separation. Your health store is keyed by a random private ID and contains no name or email. The one place that links the ID to you is the identity vault — separate, and encrypted.
One store per person. Your data is not a set of rows in a shared table; it's your own database. Cross-user isolation is enforced in code and locked in by automated tests.
Sign-in without passwords. Magic links only — there is no password for anyone to steal or for you to reuse. Sessions are revocable server-side: sign out actually kills the session.
Usage analytics without your data. Our product telemetry stores a random ID, an event name ("dashboard viewed"), and a timestamp. No health values, no name, no email — ever.
Export & erase. You can download everything or delete your account — identity row, private store, uploads — any time, free, no questions.

What we'd still like to add

In the spirit of this page: full-volume encryption of the hosted server's data disk (the field-level encryption above already covers the sensitive content on it) and routine restore drills on a published calendar. When those ship, this page will say so — not before.