Security

A short, honest summary of how PhenoTrack protects your data. This page reflects what is shipped today; planned work is called out as "planned" rather than dressed up as done.

Authentication

• Email + password and Google Sign-In.
• Brute-force protection: client-side lockout after repeated failed sign-in attempts.
• We don't store your password on our servers — credential storage is handled by our authentication provider.

In transit

• All network traffic is over HTTPS / TLS 1.2+.
• Our edge layer provides TLS termination, WAF, and DDoS protection.

At rest

• Cloud data is encrypted at rest.
• On Android the local database is encrypted at rest with a 256-bit key held in the device's secure storage; the app refuses to open the database at all if the cipher is not active, so it cannot silently fall back to storing your data unencrypted. The web app has no separate database cipher — there, local data is protected by your browser's storage isolation instead.
• Photos are EXIF-stripped (GPS, device serial, software) before being saved or uploaded.

Authorisation

• Each user can only read or write their own data. Cross-tenant reads are denied at the database layer.
• Photo storage uses the same model — only the owner can read or write their own files.
• Client integrity verification is planned (monitor mode first, then enforce).

Privacy

• Crash reports and analytics are off by default and require explicit opt-in.
• Account deletion (Settings → Account → Delete account) is a hard delete, not a soft one: your data is erased from our servers and the local database on this device is wiped, with no in-app recovery. Some copies outlive it: encrypted backups hold the data for up to 30 days before they age out; deleted photo originals stay restorable by us for 7 more days before our storage provider erases them for good; on Android the photo files the app saved on that device, including full-resolution originals and any photos written there by a restore, are not removed; any other device you were signed in on keeps its own copy until you uninstall PhenoTrack or clear its site data there; and a rate-limit counter carrying your account's internal ID is kept indefinitely, holding nothing but call counts.
• Data export (Settings → Account → Data → Export Data) produces a ZIP archive with a JSON file, your photos, and CSV copies of your journal and environment readings that you can take with you — covering the great majority of what we hold; a small number of device-specific or internal records aren't included yet. If any photo cannot be retrieved, the manifest lists which ones and why.

Disclosing a vulnerability

If you find a security issue, please write to security@phenotrack.com before disclosing it publicly. We'll acknowledge within 72 hours.