AbilityMosaicWhat is stored
The profile, words, goals, skill history, activity logs, sleep, behaviour entries and settings live in the browser database on the device. Media clips use the same local browser storage. The event history is append-only so regression and differing caregiver observations are not silently overwritten.
What reaches the network
The browser downloads the app from Cloudflare. Email sign-in uses Resend and Cloudflare Turnstile. When sync is enabled, event batches are encrypted on the phone before upload. Cloudflare sees account email, roles, ciphertext size and timing, but not readable child events.
The core application and local record continue working offline; synchronization pauses. AbilityMosaic adds no analytics, advertising or crash-reporting SDK.
Backups are your responsibility
Use Settings to save a backup regularly. An encrypted backup is protected by the passphrase you choose; AbilityMosaic does not store or recover that passphrase.
Sharing with a therapist
Nothing is shared automatically. You decide whether to show a screen, print a page, or send a backup, clip or summary using another service. Once sent through messaging or email, that service's privacy terms apply.
Camera and microphone
The app requests these permissions only for features you start, such as keeping a clip or listening snapshot. Audio analysis retains counts rather than a transcript. Recordings remain local in the first account release and are not cloud-synchronized.
Deleting everything
Settings deletes local data. Removing local data does not remove synchronized ciphertext. Household deletion will be added before accounts become mandatory for existing families.
Security posture
- HTTPS and a restrictive Content Security Policy.
- Email-code sessions use HttpOnly Secure cookies.
- Child events are encrypted on-device with a household recovery key.
- No third-party analytics, advertising or social login.
- Build checks reject unreviewed network paths.