Some Health Data You Cannot Skimp On: The Case for a Zero-Backend App When the Default Is Sync-to-Someone's-Server
Every health app makes one architectural decision before you ever see it, and almost none of them mention it: does your data live on your phone, or on a server? You can usually find the answer in about a minute, and for the metrics you would least want in a marketing database it is the only thing about the product that really matters.
AI-assisted, human reviewed. How we use AI
Quick answer
A zero-backend app is one with no server of its own in the data path: no account, no sign-in, and no database holding your health history that the company can read, lose or hand over. The work happens on the device. That is narrower than "nothing ever leaves your phone", which is false for any app that exports or syncs, and stronger than "encrypted in the cloud", which still requires a server to exist. The useful part is that it is checkable: create no account, turn on airplane mode, use the app. If it still works, the server was never in the loop.
The default is a server you never asked for
Most health and wellness apps are built server-first, and for understandable reasons. One database, one dashboard, one place to fix a bug without shipping a new app version. It is the easier shape to build. It is also the shape that turns your history into something the company has to secure, back up, retain for a period it chooses, and account for when something goes wrong.
None of that requires anyone to be careless. The cost is structural. Once the data exists on a server, you inherit every failure mode that comes with it:
- A breach is a breach of your record, not just theirs.
- An acquisition means your history changes hands as part of the deal.
- A shutdown means you are relying on the export button having worked.
- A retention policy is a promise about a system that still holds the data.
Every one of those is a consequence of the data being somewhere it did not have to be. The fix is not a better policy. It is not having the server.
What "zero-backend" actually means
Take the phrase literally and it is simple. The app has no backend of its own: no server the vendor operates that your health data passes through or rests in. Concretely, that shows up as a few things you can observe.
- No account, no sign-in. A login exists to tell a remote system who you are. If an app asks for one before it shows you your own data, there is a server on the other end of it.
- Computation on the device. The numbers in the app are calculated from your records, on the phone, not fetched from an API that did the work for you.
- No vendor in the data path. If you export, the file goes to a destination you pick: a folder, your own drive, a machine you own. Not to a company endpoint that then forwards it.
The reason this is worth stating precisely is that "private" has become a marketing word with no agreed meaning. "We take privacy seriously" and "encrypted in transit and at rest" both describe a server that holds your data carefully. Zero-backend describes an app that has nowhere to hold it in the first place. Those are different products, and only one of them can be checked by a person with a phone in their hand.
Why the most personal metrics are where this matters
All health data is personal. Some of it is a different category of personal. Cycle history, sleep and recovery patterns, mood and wellbeing entries, lab values you had to ask a clinic for, anything a person tracks quietly and would rather not explain. For those, "the vendor has a copy" is not a footnote. It is the product.
The asymmetry is easy to miss when you are comparing feature lists. Two apps can show the same chart of the same week and be nothing alike underneath: one computed it on your phone, the other sent your week to a database and drew the reply. The chart looks identical. Only one of them created an obligation to keep that database safe forever.
A server is also permanent in a way an app is not. Apps get replaced, redesigned, renamed. A database keeps its rows. So when you pick the app that syncs, you are not really choosing a company you trust today. You are choosing to make your history their problem for as long as they exist, which is a longer commitment than the one you think you are making.
The one-minute test: airplane mode
You do not have to read a privacy policy to learn which architecture you installed. Put the phone in airplane mode and use the feature you actually care about.
On our app, an answer still comes back with the phone offline. The question is parsed and the number is computed on the iPhone, and the answer renders as a provenance card showing the samples, the date range and the calculation behind it. Three of the on-device paths need nothing from a network at all, and the optional downloaded model only needs Wi-Fi once, to arrive. If a health app needs a spinner and a connection before it can tell you about your own week, the answer was computed somewhere else, and the somewhere else had your data.
The test in one line. Airplane mode on, ask the question. Answers instantly: on-device. Spins, fails, or shows a login: there is a server, and it just learned what you asked.
That is the whole reason to prefer a checkable claim over a reassuring one. You cannot audit a policy. You can watch a phone work with the radios off.
What zero-backend does not buy you
It is worth being exact, because the honest version is still a good pitch and the oversold version is not. No server means the app has nowhere to put your health data. It does not mean the data can never leave, and it should not, because exporting is the point: the moment you send a file to your own drive, your own Mac or your own agent, it moved, and that was your decision. A file you own is a file you can move.
It also does not mean the app is above every other data practice. MetricBridge's iOS app reports three app events to Meta for ad attribution, install, trial start and purchase, the last two as an amount and currency with no product name, and it does that only if you allow tracking when iOS asks. No health data is ever in those events, not a metric, a value, an export or a question, and that separation is enforced in code by a wrapper that cannot reach HealthKit. But it is a real third party, and you deserve to hear it in the same breath as the privacy claim rather than three clicks away.
So the precise sentence is the one we use everywhere: your health data never reaches us or a cloud AI. Not "we are perfect". Not "nothing leaves your phone". The narrow claim, which happens to be the one that holds.
How MetricBridge is built this way
MetricBridge is a private, on-device health AI for iPhone, with a Mac app and an Apple Watch app, plus a free open-source MCP server. It reads Apple Health read-only, answers your questions on the device with a provenance card on every answer, and writes 194 metrics as clean JSON or CSV to a destination you choose. There is no account, no sign-in, and no server of ours in the path.
The developer half is the same decision in a different shape. The health-export-mcp server runs as a local process on your machine, ships with zero dependencies, and makes no outbound network calls, so the read path is greppable: clone it, search for a network call, find none. It exposes 22 tools, 20 of them read-only, and it reads the folder the app wrote to. Nothing to host, nothing to sign up for, no vendor in the middle of your own agent reading your own data.
It is one product: a 7-day free trial, then a $24.99 one-time unlock that covers the export, the MCP tools, on-device Ask, the Weekly Brief, and the Mac and Apple Watch apps. Not a subscription, and not something that meters the parts you use most.
And the boundary that applies to all of it: this is a wellness tool, not a medical one. It reads your own data and describes it against your own baseline. It does not detect, treat or monitor a condition, and it should never be asked to.
FAQ
What is a zero-backend app?
A zero-backend app is one with no server of its own in the data path. There is no account, no sign-in and no database holding your history that the company can read, lose or hand over. The work happens on the device. It is a narrower claim than "nothing ever leaves your phone", which is false for any app that exports or syncs, and a stronger one than "encrypted in the cloud", which still requires a server to exist.
How do I tell whether a health app has a server?
Look for an account. If the app makes you create a login or an email-based profile before it shows you anything, there is a server, because a login only exists to identify you to something remote. Then try the offline test: turn on airplane mode and use the core feature. If it still works, the work is happening on the phone. If it spins and fails, the work was happening somewhere else.
Can an app answer questions about my health data with AI and still have no server?
Yes. Modern iPhones can run a language model locally, and a well-built app can also answer without a model at all by computing the number directly from your records. In both cases the answer is produced on the device and the server is not needed. What is not possible is doing that on a cloud model without sending your data to it, because a cloud model runs somewhere that is not your phone.
If there is no server, what happens to my data when I stop using the app?
It stays where it already was. Your data lives in Apple Health on your iPhone and, if you exported, in the folder you chose. Deleting the app does not delete your Apple Health history, and there is no remote copy for a company to keep, sell or lose. The only thing you have to manage is the files you exported yourself, which is a real responsibility and also the whole point.
An app with nowhere to put your data
Ask your Apple Health anything and get an answer computed on your iPhone, with the numbers behind it. No account, no sign-in, no server of ours in the path.
Where it goes: answers are computed on the iPhone and your health data never reaches us or a cloud AI; exports go only to the destination you pick. What you get: all 194 metrics, on-device Ask with a provenance card on every answer, the Weekly Brief, and the Mac and Apple Watch apps. Price: $24.99 one time after a 7-day free trial, not a subscription. Wellness, not medical advice.