For security reviewers and integrators
MetricBridge is local-first and read-only: there is no account and no developer server, so the developer is never in your data path. This page documents how the product and its surfaces are hardened. Using the app? The plain-language version lives on the privacy page.
Every page asset (styles, fonts, images) is served from our own origin, and the site is built to pass independent security-header audits. The MCP server itself is two zero-dependency Node files.
Two things measure traffic on this marketing site, and we would rather name them than let you find them in the network tab. A self-hosted visitor counter we run ourselves: no cookies, nothing written to your device, no cross-site identifier, and the request never leaves our own domain. It runs without asking, because it stores nothing on your device to ask about. A Meta advertising pixel, which is a third-party tracker and does set a cookie, so it does not load at all unless you say yes. We ask once, on your first visit, with the same sized button either way, and remember the answer. You can change it any time on the privacy page.
That used to read “a content blocker or Do Not Track will stop it”, which was true and not good enough: it put the work on you and the pixel had already fired by the time you could act. Under the UK’s PECR rules an advertising cookie needs to be asked for first, not opted out of afterwards, and that is now what happens.
Neither runs anywhere near your health data. That claim used to cover the app and the server in one sentence; the two now differ, so here they are separately. The MCP server carries no telemetry at all: it is open source and makes zero network calls, which you can verify line by line. The iOS app carries no health telemetry, but it does carry Meta’s advertising SDK so we can tell which ads lead to an install or a purchase. It sends three app events (install, trial start, purchase, the last two with an amount and a currency but no product name) and the advertising identifier, and nothing else; iOS asks you first with the App Tracking Transparency prompt, and until you say yes the app does not start the SDK at all: no Meta code runs, so nothing is sent and nothing is held in a queue to send later. Your health data is never used for advertising, tracking, or analytics. It never reaches the SDK, and that is the promise that actually matters here.
The MCP server artifacts are minisign-signed with a public key that is pinned from a second, independent source (the GitHub repository and SKILL.md, not only this site), so a compromise of the origin alone cannot swap both an artifact and its signing key. Every download is also SHA-256 checksummed. Agents and integrators should verify the signature and the checksums and fail closed on any mismatch before running anything. The verify recipe is in SKILL.md.
For reviewers, the edge and DNS are configured with:
'self' Content-Security-Policy (object-src, frame-src, and frame-ancestors set to none)p=reject + SPF: spoofed email claiming to be from the domain is rejectednosniff), and a restrictive Permissions-PolicyEmail [email protected]. Machine-readable contact details are at /.well-known/security.txt.