Security

Passwords are hashed using PBKDF2-SHA256 with 600,000 iterations, so Calmr never stores or logs your password itself.

When you sign in, your device receives a random session token. The server holds only a SHA-256 hash of that token, so the stored values cannot be replayed as credentials, and each session expires after 90 days without use. On phones, tablets and Macs, the token is held in the system Keychain or Keystore. In a browser, it is held in a secure cookie that cannot be read by the page's scripts or used by other websites.

To protect against password-guessing attempts, sign-in is temporarily paused after repeated incorrect attempts. Resetting your password also signs you out on every device, so that every previously issued session token is invalidated.

Every request is verified against the signed-in account, and every read and change is limited to that account's own data, so other accounts cannot reach it. Automated tests that sign in as two separate accounts check this for every part of the service.

Images are protected in the same way. Image requests cannot carry sign-in details, so each image link is individually signed and expires after approximately two hours.

All connections to Calmr are encrypted using HTTPS. Your health data, comprising the measurements in your weigh-ins and blood pressure readings, your health conditions, the names, strengths and notes of your medication, your height and your BMI ranges, is additionally encrypted in our database with AES-256-GCM, as are the names, amounts, notes and reasons in your finances and the password of any email account you connect, using a key held separately from the database, so the stored ciphertext, including in backups, is unreadable without that key.

On phones, tablets and Macs, the offline copy of your data is encrypted in the same way, with a key that remains in the device's Keychain or Keystore and is never backed up to another device.

All data sent to Calmr is validated on the server, regardless of any checks already performed on the client.

Actions that could be abused, such as signing in, signing up, resetting a password, uploading files and exporting PDFs, are rate limited. Error messages never reveal internal details, and our logs never contain your email address or your content.

Calmr stores a copy of your data on your device for offline access, so that copy is only as secure as the device itself. In a browser, it is not encrypted. We therefore recommend keeping your device locked and signing out of Calmr on any shared computer.

In the unlikely event of a personal data breach that is likely to result in a risk to individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, in accordance with Article 33 of the UK GDPR. Where the risk to you is high, we will also notify you without undue delay, explaining what happened, what data was involved and what you can do about it.

We welcome reports of security vulnerabilities. If you believe you have found one, please email [email protected] with a description of the issue and the steps to reproduce it. We aim to acknowledge every report within 24 hours. While we investigate, please do not access other people's data, disrupt the service, or disclose the issue publicly until it has been resolved.