Privacy

What our server can actually see

31 August 2026

Every fitness app says it takes your privacy seriously. That sentence costs nothing to write, so it tells you nothing. This is the version with the receipts: what Hejje sends, what our server keeps, and the handful of things it genuinely can read.

You do need an account. It just does not know who you are.

Start here, because it is the thing most articles like this get to fourth and we would rather say it first. Hejje requires an account. Registering is the first screen, and there is no way past it into the app.

What it asks for is a first name. There is no email address, no password, no phone number, no code to confirm, and no button to sign in with somebody else's identity. Nothing you enter is verified against anything, because there is nothing to verify it against.

So the account is not an identity in the usual sense. It is a keypair generated on your phone, plus a name you picked, plus a recovery key you are shown on a screen you cannot skip. That is also why registration works with the radio off: there is no credential for a server to check, so there is nothing to wait for and nothing to fail.

From there the whole app is a database on your phone. Recording a run, logging a lift, reading back a year of history: all of it happens locally and all of it works with no signal at all.

And when the phone does have a connection, your vault syncs itself. There is no sync switch to go and find. Sealing your data and shipping it is simply what the app does, automatically, in the background, from the moment you have an account, which is from the moment you have the app.

That deserves stating without decoration, because it is the honest shape of the trade. There is no mode of Hejje where your training stays on your phone and nowhere else. If you use the app with a connection, an encrypted copy of your vault exists on our server. We cannot read it, and the rest of this article is the detail of exactly why. But it is there, and an article about what a server can see should begin by admitting that the server has something.

Three locks, and you hold the last one

Nothing is uploaded in a form we can read. Each thing you log is sealed on your phone first, using a scheme called envelope encryption. The name is literal: it is envelopes inside envelopes.

Every activity gets its own random key, generated on your phone at the moment you save it. Those keys are locked by your vault key. Your vault key is locked by your recovery key, which is the 28 character code Hejje shows you once when you create an account.

The per activity layer is not decoration. It is what lets you share a single session later without handing anyone the rest of your history, because one key can be passed on while everything else stays shut. That is a subject for its own article.

What actually crosses the wire

Here is the honest split. A few things have to stay readable or the product cannot work: someone searching for your handle needs to find it, and a follow request has to know where to go. We keep that list as short as we can, and we are not going to pretend it is empty.

The complete list

Rather than leave that as prose, here is the whole thing as a table. If you only bookmark one part of this article, make it this one. It is checked against what the server database actually stores, not against what we would like it to store.

What the shape of your data still shows

That last group deserves more than a row in a table, because it is the limit of the whole design and it is the part these articles usually skip.

Encryption hides what is inside a record. It does not hide that the record exists. When your phone syncs, each sealed row arrives labelled with which part of the app it came from, when it was written, and how big it is. Our server needs those labels: it is how one device's edits get merged with another's in the right order, and how a sync knows where it left off.

So while we cannot read a single one of your runs, we could tell that a run was recorded on Thursday evening and that a longer one was recorded on Sunday morning, because a bigger route seals into a bigger payload. We could see that you weighed yourself most Mondays. We can see a training rhythm without ever seeing a session.

We do not look at any of this, and nothing in the product surfaces it or reports on it. But "we do not look" is a promise about our conduct, which is a weaker thing than "we cannot look", and the difference is exactly what this article exists to be honest about. Hiding metadata properly means padding every record to a fixed size and decoupling uploads from the moment you train, which costs battery and bandwidth for a threat most people tracking their 10k do not have. We chose not to, and we would rather write that down than let a diagram imply otherwise.

No password to steal

Hejje has no password because it has nothing to check one against. When you create an account your phone generates a cryptographic key pair, and every request it makes afterwards is signed with it. Our server verifies that signature against the public half and answers accordingly.

This is a quiet difference with large consequences. There is no credential database on our side to be dumped, no reset email to intercept, and nothing you could be tricked into typing into a convincing fake login page. The private half never leaves your device.

We also stopped keeping the addresses our own server used to record. To be precise about what that does and does not mean: like any machine on the internet, our server can see the connecting IP address for as long as it takes to answer a request, and it uses that to slow down brute force guesses against account recovery. What it no longer does is write one down. There is no address in your account history and no log of one anywhere.

The column used to exist. A phone's IP address changes hourly, was never shown to anyone, and was the one plainly readable location trace sitting on the box, so it was dropped and every stored address went with it.

The weather chip, and why it goes the long way round

Small details say more about a posture than headline claims do, so here is one. A finished activity shows the weather you trained in. That reading comes from a forecast provider, and the obvious way to fetch it is to let your phone ask them directly.

We do not do that. A direct call would hand an outside company your coordinates, your IP address and the exact time you finish training, several times a week. Put together, that is an approximate home address and a schedule, delivered to a vendor you never chose.

So your phone asks our server, and our server asks on your behalf. The provider sees us and nothing else. Your phone rounds the coordinates to about a kilometre before sending them, our server rounds them again in case an older build forgot to, and no coordinate is ever logged or stored next to your account. When that endpoint is down the chip is simply missing, because quietly falling back to a direct call would undo the entire point of having it.

The part that costs you something

Real end-to-end encryption has a price, and it would be dishonest to bury it. Your recovery key is the only way back into your vault. We cannot reset it, email it to you, or pull it out of a backup, because we never had it.

If you lose your phone and your recovery key, your synced history is gone for good. Every service that can reset an account for you can also be compelled, tricked or breached into opening it for someone else. We took the other side of that trade. Write the key down and keep it somewhere real.

This is why Hejje shows you the recovery key and asks you to store it before you start relying on sync, rather than mentioning it later in a settings screen you may never open.