Munchable reads a food label and tells you whether a product suits a digestive condition you have. To do that it needs to know your conditions, which means it holds a list of your diagnoses, your sensitivities, every product you have checked, and in the food log, how you felt afterwards.

Under UK and EU data protection law that is special category data, and the privacy notice says what we concluded about it:

The simplest way to protect it is not to hold it, so that is the architecture we built.

That sentence is easy to write and expensive to mean. This post is what meaning it cost: three features with no endpoint, a paid quota counted by the client, a server-side counter deliberately built so it cannot be joined to anybody, and a data export whose most interesting property is what it does not contain.

What stays on the device

The profile, the history and the food log are device state, persisted to local storage and never sent anywhere.…