| Component | Status | Detail |
|---|---|---|
| Loading… | ||
Your check-in feeds a core system on Cloudflare (Worker, database, storage, and the daily scheduler). That core system relies on five outside services: Resend for email, Twilio for text messages, Healthchecks.io as an independent watchdog — one check notices if the daily job itself stops running, a second notices if Email and Text messages ever both stop working at the same time, since neither of those two channels could reliably report that about itself — Backblaze for a monthly offsite backup copy, and GitHub, whose real commit history feeds the "Developer activity" row above — the one piece of evidence on this page that isn't self-reported. The app works normally with zero access to GitHub specifically; it's read for this one row's sake, not for anything the app needs to run.
Click any line below for more detail.
Encryption happens right in your browser, using the Web Crypto API — a real, built-in browser feature, not a library loaded over the network — so the system's servers only ever receive already-scrambled data, never your actual files or notes.
Unlocking anything requires a secret passphrase that is never stored anywhere in this system — not in the database, not in the backups, nowhere. Even the people running this system can't see it.
Every sign-in is cryptographically signed and checked on every request, so nobody can forge access to your account by guessing or copying a piece of it.
Changes are rolled into one email (and text, if you have a phone on file) within about an hour of the first one — sent whenever you've had to sign back in since your switch went live. Changes made during an already-open session don't trigger a separate alert, since nobody but you was asked to re-authenticate.
There are built-in minimum waiting periods before anything is ever sent to a recipient — even someone with access to the dashboard can't force an immediate delivery.
Names, emails, and phone numbers are stored in their own encrypted form, so a breach of one part of the system doesn't expose your family's information along with it.
The email that reaches your recipient states exactly what web address to expect, so they're protected from a scam pretending to be this system.
A separate service — not run by the same company that hosts this app — automatically verifies the encryption tool hasn't been tampered with, and the owner is alerted right away if anything looks different.
If this system's own daily process were ever silently broken, this independent watchdog would notice — because it doesn't run on the same infrastructure it's watching.
A second, independent watchdog notices if this app's two ways of reaching you both go quiet at the same time, and alerts through infrastructure that depends on neither one — the one case where the app's own two channels couldn't reliably report on themselves.
So a problem with one service can't also wipe out the backup copy.
Hosting, email delivery, and backups all run on free-tier services that don't require an ongoing payment to keep functioning. Text messages are the one piece tied to a credit card staying active — if that ever lapses, reminders and delivery still work fine by email regardless.
The delivery email points to a download that streams straight from storage after checking a one-time confirmation code — the encrypted file itself never sits in an inbox anywhere.