Barca Labs

How your data is protected

The specifics, for people who want them — including what this protection does not cover.

The encryption

Component	Implementation
Database	SQLCipher, via the `expo-sqlite` config plugin. The database file is ciphertext at rest.
Key derivation	PBKDF2-HMAC-SHA256 at 310,000 iterations, derived directly from the PIN you set.
Salt storage	`expo-secure-store` — the Keychain on iOS, the Keystore on Android.
Biometric unlock	Generates no separate key material. It gates access to the same PIN-derived key behind `requireAuthentication`.

The key is derived on your device and never leaves it. We hold no copy of it and no copy of your data. If you forget your PIN, we cannot reset it, and your records cannot be recovered. That follows from the design rather than being an oversight — plan your own backups accordingly.

Biometric unlock is a faster route to the same key, not a second way in. If someone has your PIN, biometrics do not add a second lock. If they have neither, the database is unreadable ciphertext.

What this does not protect against

Encryption at rest solves one problem well and several others not at all. Rather than let the phrase imply more than it delivers:

Device backups, and the two platforms differ. On Android, the supporting key material is excluded from cloud backups and device-to-device transfers. On iOS it is not — the default Keychain accessibility class carries into an encrypted iCloud or computer backup and can be restored to a new device. It is excluded only from unencrypted local backups. If your threat model includes someone with access to your encrypted backups, that is a real difference and you should know about it.
An unlocked device in someone else's hands. With your phone and your PIN or biometric, the app shows them your records exactly as it shows you. No encryption scheme helps here.
A jailbroken or rooted device. Keychain and Keystore isolation can potentially be defeated where the operating system's protections have been removed.
Anything you export. Once a copy leaves the app it is governed by wherever you put it. See below.

What leaves the device

The app makes a small number of network requests and none of them carry your records. Each one is described in full, including what it sends and why, in the privacy policy.

We run no server. There is no account, no sync service, and no infrastructure of ours holding a copy — which also means there is nothing of yours for us to lose, sell, or be compelled to produce.

Exports

The app can copy your record out as text — JSON or Markdown — onto your device's clipboard. No file is written and nothing is shared through the operating system's share sheet.

Once you place it somewhere else — an AI assistant, an email, a cloud drive, a printout — that copy is governed by whatever you put it into, and it is outside our reach entirely. Nothing we do protects a copy you have handed to someone else. That is the trade for being able to take your data anywhere you want it.