Effective 28 October 2026
Bodhara is built so that the most sensitive data never leaves your phone. This page says plainly what protects it, what does not, and how to report a problem. It describes controls that exist in the code today. I do not claim certifications I do not hold.
What protects your data
| Area | Control |
|---|---|
| Health data | Stays on your phone. The server has no endpoint that accepts a health record. Android backup and device transfer are off for app data. |
| Sign-in | Firebase Authentication. Unverified email accounts are rejected. Every authentication failure returns the same response. |
| Server access | Only authenticated requests. The database denies all direct access from apps, and users can reach only their own records. |
| Abuse protection | Firebase App Check, bounded request sizes, bounded sync ranges and page sizes, request timeouts, and limits on AI use. |
| Provider tokens | When providers launch: encrypted, server-side only, bound to the owner and deleted on disconnect or account deletion. One-time sign-in codes are single-use, expire and are never logged. |
| AI | Optional. Only calculated facts are sent, with zero-retention routing, and answers are validated before you see them. Data from providers that forbid AI use is blocked. |
| Logs | Method, path, status and request id only. No emails, tokens, request bodies or health values. |
| This website | HTTPS, a strict content security policy, no third-party scripts, fonts or trackers, and no cookies. |
Known limits
- The local database relies on Android’s app sandbox and your device encryption and is not separately encrypted by Bodhara.
- I am one independent developer. I have no security certification and no 24-hour monitoring team.
- Some controls are verified only with automated tests and fakes so far. Real-device and live-service testing is part of the work before release.
Report a vulnerability
If you believe you have found a security problem in Bodhara or this website, please email sj@passthebot.dev with “Bodhara security report” in the subject. Please include what you found, steps to reproduce and the impact. Please do not include real people’s health data. You can also find this in our security.txt.
What I commit to
- Acknowledge your report within 7 days, and keep you updated.
- Fix confirmed issues as quickly as I reasonably can and tell you when I have.
- Not take legal action against you for good-faith research that follows this policy.
- Credit you, if you wish, once the issue is fixed.
What I ask of you
- Test only with your own accounts and data.
- Do not access, change or delete other people’s data, and stop and report if you reach any.
- No denial-of-service, spam, social engineering, physical attacks or testing of Google, Firebase, Cloudflare or other third-party services.
- Give me reasonable time to fix a problem before telling anyone else.
There is no paid bug bounty at this stage.
If there is a breach
If a personal data breach is likely to put your rights at risk, I will tell you and the relevant authority without undue delay and within the periods the law requires. See the privacy policy.