HealthMaxxing does not use one blanket data path. Guest data can stay on the device; signed-in users can use private cloud backup; AI receives only the information needed for the feature a person chooses; and analytics is designed to exclude raw health logs, journal text, wearable values, photos, and voice recordings.
Audit status: HealthMaxxing reviewed the shipping app, API proxy, cloud-deletion functions, export flow, analytics sanitizer, and Mind Deep Dive safety path on July 21, 2026. This is a first-party code and product audit—not an independent penetration test, security certification, HIPAA attestation, or guarantee that software can never fail.
What leaves your device—and why
| Route | What can use it | Purpose and boundary |
|---|---|---|
| On device | Guest logs, local app storage, voice-memo audio, permission state, and selected sensitive fields. | A guest can use core tracking without creating a cloud account. Journal voice audio stays on the device; the resulting title, notes, and attached photos can be backed up when a signed-in user enables that path. |
| Private account cloud | Signed-in profile and wellness records stored through Firebase; optional wearable backup. | Sync and recovery across app sessions. Imported wearable backup is optional. Cloud data is associated with the signed-in account and is not a public dataset. |
| AI feature request | The content needed for the feature a person intentionally uses—such as a food image, meal description, journal text, or a prepared wellness summary. | The app sends the request through HealthMaxxing’s Cloudflare proxy to Anthropic. The payload differs by feature; HealthMaxxing does not claim that every AI request is aggregate-only. |
| Product and website analytics | Short product-event names and coarse context. App events may use an opaque account identifier. Website events are immediately added to daily totals without cookies, visitor identifiers, exact paths, or page titles. | Measure whether features and page categories work. The event sanitizer rejects forbidden keys, nested objects, long strings, and unsupported values. Raw health values, wearable data, journal content, voice audio, food photos, and identifiable website histories are outside the intended analytics payload. |
Mind Deep Dive has a stricter AI boundary
Mind Deep Dive uses a separate, versioned safety path. Before the network request, the app checks age, supported locale, consent, and feature kill switches. Private text can be examined locally for a safety decision, but the request sent to the server is built from a fixed aggregate allowlist: window length, check-in counts, mood category, approved emotion tags, practice counts, and support signals.
The Mind request excludes raw custom Mind text, notes, identifiers, calorie or macro values, weight or body data, and precise exercise data. The server rejects unexpected keys, and generated output must pass schema, grounding, prohibited-content, and independent safety-classifier checks before display. A malformed response, classifier disagreement, or safety-service outage fails closed to deterministic content.
Other AI tools are feature-specific
Food photo analysis needs the selected image. AI Chef and meal tools need the food or preference context required to answer. Journal Tidy needs the journal text a person asks it to organize. HealthMaxxing’s privacy promise is therefore purpose limitation and user choice—not the inaccurate claim that AI never processes health or personal content.
HealthMaxxing uses Anthropic’s commercial API through its own proxy. Anthropic says standard API inputs and outputs are automatically deleted from its backend within 30 days, subject to stated exceptions for separate agreements, law, and usage-policy enforcement. Anthropic also says commercial API data is not used for model training by default. Provider rules can change, so the linked source and the privacy policy are the controlling public references.
Controls available to the person using the app
- Apple Health permission: iOS presents granular read/write choices by data type. Apple intentionally prevents apps from learning whether read access was denied; HealthMaxxing treats unavailable data as missing rather than inferring it.
- Optional connections: Apple Health and cloud wearable backup are not required for manual logging.
- AI choice: generative features require the relevant consent and can be skipped.
- Export: selected categories can be assembled into CSV files and shared as a ZIP through the device share sheet.
- Deletion: in-app deletion clears app storage, secure fields, scheduled notifications, account cloud records, attributed telemetry, uploaded files, and the authentication account through coordinated local and server deletion paths. Partial failure is reported rather than silently presented as success.
Crash reports and defensive filtering
The app’s Sentry path applies a scrubber before an error event leaves the app. It redacts sensitive keys and recursively removes or replaces values that can contain private content. Like any rule-based control, this reduces exposure risk but is not described here as formal proof that no future code path could ever transmit an unintended value.
What this page does not claim
- HealthMaxxing is not claiming independent security certification or clinical validation.
- HealthMaxxing is not claiming that all app data stays only on the device.
- HealthMaxxing is not claiming that every AI request uses the Mind aggregate-only design.
- HealthMaxxing is not claiming HIPAA-covered status or a business associate agreement.
- HealthMaxxing is not selling personal information or identifiable health data.
Public references
- HealthMaxxing Privacy Policy — feature-specific collection, service providers, retention, analytics boundaries, and user controls.
- HealthMaxxing Data Deletion — account-deletion instructions and scope.
- Apple: Protecting user privacy in HealthKit — granular permissions, local encrypted HealthKit storage, and limits on advertising and disclosure.
- Anthropic: Commercial API data retention — the provider’s current standard retention statement and exceptions.
Corrections: email hello@maxxing.health with the exact statement and supporting evidence. Material changes update the review date.