Runa Cycle Tracker
Private-first Android cycle tracking with zero network permissions
The Problem
Most commercial reproductive health applications transmit sensitive personal telemetry to centralized cloud servers, frequently sharing telemetry with advertising aggregators or third-party data brokers. Following global shifts in data privacy legislation, users require verifiable guarantees that their personal logs remain entirely inaccessible to external observers.
I built Runa as a strictly zero-network Android application designed from the operating system layer up to make data exfiltration technically impossible.
How It Works
Runa provides full cycle logging, symptom tracking, and predictive forecasting without requesting or granting internet permissions in the Android manifest.
Zero Network Permissions in Manifest
The application manifest explicitly excludes android.permission.INTERNET. The OS-level sandbox enforces that zero bytes of telemetry can leave the local device under any runtime scenario.
Hardware-Backed Keystore & SQLCipher Encryption
The SQLite database is encrypted via SQLCipher using a 256-bit AES key. The decryption key is never persisted in plaintext; it is generated inside the Android Keystore hardware security module and unlocked exclusively via biometric authentication.
Robust On-Device Statistical Modeling
Instead of opaque server-side heuristics, cycle predictions run locally using Median and Median Absolute Deviation (MAD) estimators that gracefully filter outlier cycles without overfitting or leaking raw records.
Decisions and Trade-offs
Zero network permissions vs Cloud backup conveniences
Many health apps compromise privacy by offering Google Drive or cloud sync features. In Runa, we opted for zero network connectivity. For backups, the application offers user-controlled encrypted export files that the user must manually transfer via physical USB or local storage.
Statistical robustness over heavy ML models
Running deep neural networks on low-power devices for basic time-series cycle forecasting consumes battery and increases binary size unnecessarily. We selected robust non-parametric statistics (median and interquartile spread) that provide explainable confidence bands with near-zero CPU and memory overhead.
Because the operating system sandbox physically disables socket creation, privacy is guaranteed by platform architecture rather than trust in a legal privacy policy.
Results
Security audits and performance profiles were validated on physical Android hardware.
Links and Code
Technical design specifications and local database schema documentation:
- Architecture Documentation: See repository design notes