Privacy

Perennia is offline-first by design. A user can stay in Local-only Mode permanently, and signing in only adds Synced Mode for account-backed sync. The privacy posture below is the baseline for both modes.

Data custody

Local data lives in the app sandbox and relies on OS device encryption for at-rest protection. Perennia does not claim a separate app-level encryption layer for the local database.

The server becomes authoritative only after a user chooses Synced Mode. A device that loses auth keeps its local replica and behaves like Local-only Mode again.

Telemetry

Zero behavioral analytics, ever. Perennia does not track funnels, retention, feature usage, exercises logged, workouts completed, or any other behavior analytics stream.

Crash reporting is opt-in and default-off. When a user or operator enables crash reporting, reports are sent to a self-hostable Sentry or GlitchTip-compatible backend. Leaving crash reporting disabled sends no crash events.

Structured observability and crash reports never carry training data, body-measurement data, comments, or PII beyond a user id. Client crash reports carry stack traces and device class only; breadcrumbs are scrubbed before they leave the device.

Portable export

The portable archive export works the same way in Local-only Mode and Synced Mode. Export is the Local-only safety net and the Synced Mode sovereignty escape hatch, so user data is never hostage to an account.