Trust needs clear foundations.

The website today

The public website is delivered over HTTPS. Browser security headers restrict framing of the site, reduce unnecessary referrer information, prevent content-type guessing, and disable camera, microphone, and location access on this presentation website.

Product interactions run in the page. They do not connect accounts or send your entered journal or food values to our servers. No live credentials, health imports, financial imports, or AI analysis are requested by these views.

The app we’re building

Our planned foundation includes access controls for each person’s records, private attachment storage, source-specific permissions, protected provider credentials, and traceable calculations. Export, deletion, revocation, and the handling of corrected records are part of the implementation plan.

These controls must be built and tested before personal-data features launch. We do not claim that the future app is already certified, independently audited, or compliant with a particular healthcare or financial standard. A hosting provider’s certification is not a certification of Metric Diary.

Report a security concern

Email admin@metricdiary.com with “Security report” in the subject. Include the affected URL, a description, steps to reproduce using information you are authorized to access, and the potential impact. Redact personal information and credentials from screenshots or logs.

Use non-destructive methods and avoid accessing another person’s data, disrupting the service, or testing third-party systems. If you encounter private information, stop and describe the issue without copying or sharing that information. Contact us before sending sensitive evidence so an appropriate exchange can be arranged.

We review reports through this mailbox. We do not currently operate a paid bug-bounty program or promise a fixed response time. Our reporting contact is also published in security.txt.

Privacy questions

For information about website visits and correspondence, read our privacy notice. You can use the same contact address for a privacy request, a product question, or an immediate concern.