The short version: Sovereign Vault stores your records on your phone. There is no account, no server of ours, and no database we can look at. We do not collect your health information, because the app contains no mechanism by which we could receive it.
The app is not silent on the network, and we would rather show you exactly what it does than claim an absolute we cannot honestly claim. Every connection it makes is listed below, along with what moves and why.
Who we are
Barca Labs, LLC, a limited liability company registered in the State of Kansas, United States. Barca Labs, LLC is the developer and publisher of the mobile application Sovereign Vault ("the app").
For any question about this policy or about your data, contact [email protected].
What the app stores, and where
Sovereign Vault records the information you enter: compounds and doses, schedules, adherence history, lab biomarkers, body measurements, blood pressure, training sessions, cycle information, and any readings pulled from a wearable you connect.
All of it is written to an encrypted database on your device. None of it is transmitted to us. We operate no server that receives it, and there is no account under which it could be stored.
How the encryption works
The key that opens the database is derived from the PIN you set, and is not stored anywhere in a form that can be used without it. Biometric unlock, if you enable it, is a faster route to the same key rather than a second way in. Supporting key material is held in your device's secure hardware store — the Keychain on iOS, the Keystore on Android. The key never leaves your phone.
We have no copy of any of it. If you lose your phone we cannot recover your records, and if you forget your PIN we cannot reset it. That is a direct consequence of the design rather than an oversight, and you should plan your own backups accordingly.
The full specifics — cipher, key derivation, iteration count — are on the security page. Being straight with you about what this does and does not protect against:
- Device backups differ by platform. On Android, the supporting key material is excluded from cloud backups and device-to-device transfers. On iOS it is not — it is included in encrypted iCloud and computer backups and can be restored to a new device. Worth knowing before you rely on the app rather than after.
- An unlocked device in someone else's hands. If a person has your phone and your PIN or biometric, the app will show them your records exactly as it shows you.
- A jailbroken or rooted device. The operating system's secure storage can potentially be defeated where OS protections have been removed.
What we collect
Nothing. The app has no user accounts and no sign-in. It does not report usage, does not phone home, and contains no advertising or analytics software. We do not know who you are, that you installed the app, or whether you still use it.
Connections the app makes
Below is every connection Sovereign Vault makes, what it carries, and what it is for.
App updates
Sovereign Vault delivers updates over the air using EAS Update, a service operated by Expo. Each time the app starts, it contacts Expo's servers to ask whether a newer version is available. If one is, the app then downloads the updated application code and any changed assets from Expo's content delivery network.
According to Expo's documented update protocol, the request identifies the platform, the runtime version, and the release channel, so the service knows whether a newer version applies. As with any internet request, Expo's servers can also observe the IP address it came from. No health information, and nothing you have entered, is sent in this request or in any part of the update process.
This happens automatically on every launch and requires no action from you. Expo's handling is governed by Expo's privacy policy.
Polar sync
If you choose to connect a Polar account, the app signs in to Polar's servers on your behalf and requests your readings from them. This is a connection to a third party's servers over the internet — it is not a local read from your device.
It happens only if you set it up, and only when a sync runs. You can disconnect at any time. Data retrieved from Polar is then stored on your device like any other entry.
The connection runs directly between your device and Polar. There is no server of ours in the middle, and your Polar data does not pass through us at any point. Your relationship with Polar is governed by Polar's privacy notice.
Buying the app
Sovereign Vault is sold as a one-time purchase through the Apple App Store and the Google Play Store. Payment is handled entirely by Apple and Google. We never see your payment details.
Apple and Google collect their own information when you buy or download an app, and provide us with aggregate, anonymised sales statistics that cannot identify you individually. Their handling is governed by Apple's privacy policy and Google's privacy policy.
On your device only
Apple Health and Health Connect
Where the app reads from Apple HealthKit (iOS) or Health Connect (Android), that is a local read on your own device, mediated by your operating system and limited to the data types you approve. Nothing is transmitted over the network and no third party receives it. You can withdraw these permissions at any time in your device's system settings.
Taking your data out
Export
The app can produce a summary of your record — as JSON or as Markdown — so you can take it elsewhere: to your own notes, to a clinician, or to an AI tool you want to ask questions of.
That summary is copied to your device's clipboard, and that is the only thing that happens. No file is written to your device. Nothing is shared through your device's share sheet. The app does not transmit it anywhere. It is placed on your clipboard and left there for you to paste.
What you paste it into is a separate and deliberate act you perform.
Worth being clear about the consequence: once you paste or share an export into another application — an AI assistant, an email, a cloud drive — that copy is governed by that service's policies, not by this one, and it is outside our reach entirely. Nothing we do can protect a copy you have handed to someone else. That is the trade for being able to take your data anywhere you want it.
Diagnostics and analytics
Sovereign Vault contains no analytics software, no advertising software, no crash reporting service, and no third-party tracking of any kind. Beyond the connections described above, the app makes no network requests.
Your device's operating system and the app store you installed from may collect their own diagnostic information, independently of the app. That collection is controlled by Apple's and Google's settings and policies, and by the choices you have made in your device settings.
Deleting your data
The app includes an erase function that removes your records from the device. Uninstalling the app also removes its database.
Because we never hold a copy, there is nothing for you to ask us to delete, and no request process to go through. When it is gone from your phone, it is gone.
Your rights
Privacy law generally gives you rights to access, correct, export or delete the personal information a company holds about you. We hold none — no account, no profile, no copy of your records — so there is nothing for us to disclose or erase.
The third parties described above hold whatever they hold under their own policies. To exercise rights against Expo or Polar, contact them directly using the links in those sections.
If you believe we hold information about you and wish to exercise a right in relation to it, write to [email protected] and we will respond.
Children
Sovereign Vault is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children, which in this case follows from not collecting personal information from anyone.
Not medical software
Sovereign Vault records information you choose to record. It is not a medical device and is not intended to diagnose, treat, cure, or prevent any disease. Nothing in the app is medical advice, and no output of the app should be read as a clinical finding.
Decisions about your health belong between you and a qualified clinician.
This website
This website is a set of static pages. It sets no cookies, runs no analytics, embeds no third-party scripts, and loads no external fonts or trackers. Our hosting provider processes standard server request data, including IP address, in order to deliver the page to you.
Changes to this policy
If this policy changes, the effective date at the top of this page changes with it. If a change ever affected how your data is handled in a way that mattered, it would be announced in the app rather than quietly posted here.
If a future version of the app adds a connection not listed above, or begins collecting information we do not collect today, we will describe it here before it takes effect.
Contact
Barca Labs, LLC
Kansas, United States
[email protected]