Security — My Beanie · Kidney Bloom

In one line. Labs, blood pressure, weight, meals and dialysis records live only on your device (browser storage). There is no operator server and no account, so there is no health record on the operator's side to leak. The site and the app are served over HTTPS only.

1. How records are protected today

On-device

Records stay on the device

Everything you enter is stored in your phone's or computer's browser storage. The operator does not collect, transmit or view it, and the app contains no code that sends records out.

No account

No account, no password

There is no sign-up, so no email, password or phone number is collected. Account takeover and password leaks cannot occur.

HTTPS only

Encrypted in transit

kidneybloom.com and app.kidneybloom.com are served over HTTPS only; HTTP requests are redirected. Certificates are issued and renewed automatically by the hosting provider.

No tracking

No analytics, no ads

No visitor-tracking scripts, ad SDKs or social plugins. The only external resource loaded is a Korean web font (jsDelivr).

Static

Static files only

The app runs as static files (HTML, CSS, JS) with no server-side code. With no database, server-class vulnerabilities such as injection do not apply.

Offline

Works offline

Once opened, it works without a network (service-worker cache). On public Wi-Fi, records never travel over the network.

2. What a mirror-card link protects

A mirror card is a snapshot of the items the patient selected, compressed into the link itself. It never passes through a server, so the operator cannot see its contents. The link, however, is the key, so use it knowing the following.

Anyone who has the link can read it. Send it to people you trust, through a messenger you trust.
Unselected items are not in the link. Showing your name is also your choice.
The link is a snapshot from when it was sent; later records do not update it. Send a new link to refresh.
The link is compressed and encoded, not encrypted. Do not post it on public boards or social media.

3. What is up to you

Because records live only on the device, protecting the device is protecting the records.

Set a lock (passcode or biometrics) on your phone or computer. The app has no separate lock of its own.
On a shared or public computer, tap "Delete all records" or clear browser data after use.
Export a backup from Settings regularly in case of a lost or replaced device. The backup file contains your health records as they are, so keep it somewhere safe.
Clearing browser data deletes the records too. Export first.

4. What the operator handles

The operator encounters only two kinds of information: transient access logs kept by the hosting provider (Vercel) — IP, time, browser — and what you write when you email us. Access logs are not separately collected or retained by the operator, and enquiry emails are used only to reply.

5. Standards applied once a server exists

Supporter subscriptions, clinic and community passes and auto-updating views require a server and accounts. At that stage the following are launch conditions.

Health records are treated as sensitive data under the Korean Personal Information Protection Act, with separate consent and no processing beyond its scope.
Encryption at rest and in transit, storage in a Korean region, access logging and role-based access control.
Only items the patient allows reach the server. The item filtering the mirror-card builder performs today is applied to server sync as it is.
Clinics and communities see only what the patient allows; communities receive anonymous statistics only, with items under five people suppressed.
An internal review equivalent to a privacy impact assessment, an external security review, and an incident response and notification procedure are in place before service begins.
Payments are processed by app stores or a licensed payment gateway; the operator never stores card numbers.

6. Reporting a vulnerability

If you find a security problem, write to hello@kidneybloom.com with steps to reproduce and the affected scope. We reply within three business days, fix confirmed issues and record them in the change log on this page. Good-faith reporters face no legal action; please refrain from tests that access other users' records or disrupt the service.

7. Current stage

My Beanie is in real-user validation and the operator is pre-incorporation. This page describes the current structure (no server) and will be revised after the server is introduced, the company is incorporated and legal review is complete. Each revision is logged below with its effective date.

Change log — 2026-10-04 v1.0 first published