Private Recovery Data: How PHALANX Handles It

Q: What recovery information is synced for account recovery?

The reviewed source syncs progress and profile metadata including alias, streak, total reset count, campaign history, rank, progression, cosmetics, balances, and check-in timing. Journal text, optional assessment answers, and task-completion records are excluded from that routine profile-sync path.

The short version

Native device storageJournals, optional assessment answers and scores, Fortify notes, reset notes, and personal anchors are primarily stored in encrypted local storage on the native app.

Recovery syncSigning in can create a bounded Firestore recovery profile. It contains progress metadata, including a total reset count, rather than journal text.

Optional processingAnalytics, attribution, subscriptions, paywalls, crash reporting, optional email, and the optional AI coach use third-party services.

Private recovery work should not depend on people guessing where their information goes. PHALANX is built around a 30-day system for risky moments, but a useful system needs a visible data boundary too.

What stays on your native device

Documented in the reviewed native source and current policy: PHALANX creates a unique encryption key and stores it using device-only secure storage. The native app uses that key for encrypted MMKV storage and refuses a plaintext fallback if secure storage cannot initialise.

The current policy lists journal entries, private reflections and notes, optional questionnaire answers and scores, Fortify logs, reset notes, urgent-use records, personal anchors, and saved reasons as primarily local. Local blocker settings, including custom blocked and allowlisted domains, are also held on the device.

This is not a claim that every PHALANX-related value uses the same encrypted store. Authentication sessions, account recovery, subscriptions, diagnostics, attribution, and optional AI are separate routes described below.

What may leave your device

Account recovery and progress sync

If you sign in, PHALANX can create a Firestore recovery profile. The reviewed source syncs a bounded set of fields: warrior alias and appearance settings; current and highest streak; total reset count; campaign history; progression, cosmetics, and balances; check-in timing; and related timestamps. Routine profile sync excludes journal entries, optional questionnaire answers, and task-completion records.

That is recovery metadata, and it is still personal recovery data. It should not be described as harmless simply because it is not journal text.

Sign-in, optional email, and optional AI

Apple Sign In, Google Sign In, and Firebase Authentication may process account identifiers. If private campaign email is enabled, contact, consent, subscription, and attribution fields may be retained to send or suppress those messages.

Centurion is optional. When you use it, your message and limited recent journal context may be routed through Cloudflare to OpenAI to generate a response. The current policy says PHALANX does not store those coach transcripts in its own databases. It also says OpenAI API abuse-monitoring logs may retain prompts and responses for up to 30 days by default, subject to OpenAI's terms and lawful exceptions.

Analytics and attribution: the actual boundary

Documented in the reviewed code and tests: the PostHog route sanitizes analytics properties, blocklists specified user-written recovery fields on specified events, and does not use Firebase user ID to identify a signed-in person in PostHog. This is a narrow source-reviewed statement, not a claim that every measurement route is anonymous or that no data leaves the device.

AppsFlyer and Meta may process limited device identifiers, campaign/source data, and coarse funnel events for attribution. The reviewed source also contains an AppsFlyer customer-association path for the signed-in app user ID. The source provides consent handling for PostHog, AppsFlyer, and Meta event routes; public policy and deployed configuration must remain aligned.

Services that help run PHALANX

Service	Current role	Boundary stated in reviewed source or policy
Firebase / Google	Authentication and recovery-profile storage	Account identifiers and bounded recovery metadata may be processed. The reviewed Firestore rule is owner-scoped, but production rule deployment remains a separate verification gate.
RevenueCat	Subscription management	Used to determine product access and manage subscription state.
Superwall	Paywall presentation and conversion measurement	The policy says user-written recovery content is not sent to Superwall.
Cloudflare and OpenAI	Optional Centurion routing and AI response generation	Coach messages and limited recent journal context may be processed when you choose to use Centurion.
PostHog	Product analytics	The reviewed code blocklists specified user-written recovery properties and avoids Firebase-ID identification in PostHog.
AppsFlyer and Meta App Events	Install attribution and advertising measurement	Limited device/campaign data and coarse funnel events may be processed. This is not a local-only route.
Sentry	Crash and error monitoring	Used for reliability reporting. This page does not make a blanket no-log claim.
Email delivery provider	Optional account, lifecycle, and marketing email delivery	Used only when private campaign email is enabled or service messages are permitted.

Current limits and unknowns. The native authentication session uses AsyncStorage rather than the encrypted MMKV store. The reviewed Firestore rules are source-reviewed and contract-tested, but production deployment and live-rule proof are separate gates. Sentry scrubbing and notification-route allowlisting remain hardening work. This page cannot promise deletion from every third-party vendor or historical log.

Why specificity matters

Reported external context: researchers and 404 Media reported that QUITTR user records were accessible through a Firebase access-control issue. 404 Media's named report described sensitive behavioural and recovery-related material. The underlying PHALANX evidence pack reports that the vulnerable route was fixed before 10 March 2026.

What the reporting does not establish: passwords, payment data, email addresses, tokens, a confirmed number of people whose data was taken, or QUITTR's current security posture. PHALANX does not use this reporting to claim it is superior. The relevant lesson is simpler: intimate recovery data deserves a clear explanation of storage, sync, access control, processors, and limits.

What PHALANX does not claim

That an encrypted device store makes breaches impossible, that this is a zero-knowledge service, that every record remains local, or that cloud processing never occurs.
That device encryption removes the need for device security, account protection, vendor controls, or ongoing engineering review.
That a source-reviewed control is the same as a completed production audit.
That the reported QUITTR incident proves the current security posture of another company.

Read the complete record

Privacy PolicyThe controlling notice for data handling, retention, processors, and rights. Private RecoveryHow PHALANX avoids a public recovery feed or confession wall. Private ProgressHow a personal recovery record supports pattern review. Recovery AppHow the 30-day system and Fortify fit into the product.

FAQ

Are my journal entries stored in the cloud?

The reviewed native source excludes journal entries from routine Firestore recovery sync, and the privacy policy lists them as encrypted local storage. If you choose Centurion, limited recent journal context may be processed to generate a response.

Does PHALANX use cloud services?

Yes. Sign-in, bounded recovery metadata, subscriptions, paywalls, analytics, attribution, crash reporting, optional email, and the optional AI coach can involve cloud services.

What recovery information is synced for account recovery?

The reviewed source syncs alias, streak, total reset count, campaign history, rank, progression, cosmetics, balances, and check-in timing. Journal text, optional assessment answers, and task-completion records are excluded from routine profile sync.

What does PHALANX send to analytics providers?

The reviewed code sends product and funnel events with sanitization. It strips specified user-written recovery fields from specified PostHog events and does not use Firebase user ID for PostHog identification. Attribution services can still process limited device, campaign, and coarse funnel information.

Is PHALANX breach-proof or zero-knowledge?

No. PHALANX does not make those promises. The relevant question is whether storage, sync, access-control, analytics, and processor boundaries are clear and continuously reviewed.

Can I delete my data?

The current policy says you can delete local data in Settings or by removing the app, and delete your account and cloud recovery profile from Settings. Third-party processor retention can differ, particularly for legally required records or service logs.

Sources and evidence limits

PHALANX Privacy Policy: controlling public policy notice.
404 Media follow-up: reported researcher warnings, access-control issue, and remediation timing.
404 Media named report: reported sensitive field categories and named disclosure.
PHALANX implementation claims are limited to the reviewed Build 63 source and tests recorded in the page's source ledger. They are not a penetration test or production deployment proof.

Build a private system you can inspect.

Recovery needs a clear plan for the hard hour. Privacy needs the same standard: visible boundaries and no slogans that outrun the evidence.

Start the 30-day campaign

Important: PHALANX is a private self-improvement and discipline tool. It is not therapy, diagnosis, treatment, medical care, a medical device, or crisis support. If you are in immediate danger or having thoughts of self-harm, contact local emergency services or a crisis line now.

Your recovery data deserves specific answers.