Why Your Health Logs Are End-to-End Encrypted
What “encrypted” means, precisely
Three different things get called encryption, and the differences matter enormously.
In transit. Data moving between your device and our servers travels over TLS. This protects against someone reading your entries on a shared café network, and against your internet provider seeing their content. It does not hide the fact that you are using SharedSky, since the destination is visible at the network layer.
At rest. Data stored in our database is encrypted on disk. This protects against a stolen drive, a discarded server, or an attacker who gets hold of a backup file without also getting the keys. It does not protect against someone with legitimate access to the running system, because the system decrypts data in order to work with it.
End to end. Keys exist only on user devices, and the server holds ciphertext it cannot read. This is the strongest option and it is what messaging apps mean by the term.
SharedSky uses the first two. We do not currently use end-to-end encryption. Being direct about that costs us a marketing line and buys something more valuable, which is that everything else on this page can be taken at face value.
The honest summary of our threat model: your entries are protected against network eavesdroppers, against theft of storage media, and against the ordinary run of external attacks. They are not protected against SharedSky itself, and they would not be protected against a lawful order compelling us to produce them. Any service that stores readable data is in this position. Services claiming otherwise are usually describing at-rest encryption in end-to-end language.
The protection that actually works: not collecting things
Cryptography is a control on data you hold. The stronger guarantee is data you never hold.
No account is required. You can use SharedSky without providing an email address, a name, a phone number or a password. There is nothing for us to leak because there is nothing for us to store.
Location is fetched on demand and coarsened. We request location when you open the app or submit an entry, rather than tracking you continuously, and coordinates are rounded to a broader grid before being used to look up environmental conditions. Air quality varies over kilometres, so we do not need your street to give you a useful reading.
The extra health profile is optional. Sleep, stress, hydration, activity, diet context and the rest are there because they help you rule out ordinary explanations before reaching for an environmental one. They are switched off unless you choose to fill them in, and you can leave them blank forever without losing the core function.
What “anonymous by default” does and does not mean
The app describes itself as anonymous by default. That phrase deserves unpacking, because “anonymous” has a specific legal meaning and it is stricter than most people assume.
Under EU data protection law, data is anonymous only if it cannot be linked back to a person by any reasonably likely means. Data that has had names removed but can still be connected to an individual is pseudonymous, and pseudonymous data is still personal data with the full set of obligations attached. The European Data Protection Board’s guidance is explicit that controllers should avoid calling data anonymous in privacy notices when it isn’t.
So, precisely: SharedSky does not ask who you are. We do not require an account and we do not collect identifying details. That is a meaningful reduction in risk and it is what “anonymous by default” is describing.
It is not a claim that your entries are mathematically unlinkable to you. We would rather explain this distinction than exploit the fact that most readers won’t notice it.
Health data has a higher bar
Information about your symptoms is a special category of personal data under Article 9 of the GDPR. Processing it is prohibited by default and permitted only under specific conditions, the relevant one here being your explicit consent.
Explicit consent is a higher standard than ordinary consent. It has to be specific, informed, freely given, and stated affirmatively rather than inferred from continued use. It also has to be as easy to withdraw as it was to give.
What we do not do
These are commitments we can state without qualification:
- We do not sell, rent or license your health entries or location history to anyone.
- We do not share individual entries with insurers, employers or health systems.
- We do not run advertising networks or third-party ad SDKs in the app.
- We do not build advertising profiles from your entries.
Aggregation and community insight
The ambition behind SharedSky is that individual experiences, taken together, say something about a city that no monitoring station can. We have written separately about what that kind of data can and cannot prove.
The status today: we do not publish community maps or aggregated symptom outputs. Your entries are used to show you your own history.
If we build it, these are the constraints we are committing to in advance:
- Separate, explicit opt-in. Contributing to an aggregate will be its own decision, not a consequence of using the app.
- A published method. We will describe the technique by its correct name and specify its parameters. If we implement k-anonymity we will state the value of k. If we implement differential privacy we will state the privacy budget. If we implement neither, we will not use either term.
- Suppression below threshold. Regions with too few contributors produce no output, because a sparse aggregate is a re-identification vector.
- Stated limitations on every output. Sample size and known biases published alongside any figure.
Note also that under EDPB guidance, anonymising data is itself a processing operation requiring a lawful basis and an Article 9 exemption. Aggregation is not a way around consent. It is something we would need consent to do.
Your rights, and how to use them
Under the GDPR you can request access to your data, correction, export in a portable format, and erasure. These rights apply regardless of what any privacy page says.
Deletion. The app has a “Delete my data” control.
We would rather publish a page with visible gaps than a polished one that overstates. If you find something here that does not match how the app behaves, tell us and we will correct it in public, as we did above.
SharedSky is not a medical device and does not provide medical advice. See our Medical Disclaimer.
References
Health Data Under Article 9 GDPR: Lawful Conditions. https://www.legiscope.com/blog/health-data-article-9-gdpr.html
European Data Protection Board, Anonymisation and pseudonymisation. https://www.edpb.europa.eu/topics/ai-and-technology/anonymisation-pseudonymisation_en
Bird & Bird, Key takeaways from the EDPB’s new anonymisation guidelines (2026). https://www.twobirds.com/en/insights/2026/anonymity-is-in-the-eye-of-the-beholder-key-takeaways-from-the-edpbs-new-anonymisation-guidelines
Have questions about our security infrastructure or data privacy standards? Read our full Privacy Policy page or contact our dedicated privacy team at contact@sharedsky.app.