The architecture underneath the practice.

The body data you generate is sensitive. Treating it like that informs every choice in our stack — from where it lives, to who can read it, to how it moves between services.

• At rest: AES-256 across our Supabase Postgres tables and object storage.
• In transit: TLS 1.3 between every service that touches user data.
• Authentication tokens are short-lived and rotated on each session.

• Row Level Security on every user-scoped table — Postgres enforces that each user can only read their own rows.
• Service-role credentials are never present in client-side code.
• No employee has routine access to individual user health data. Production access is broken-glass and logged.

• Database and Edge Functions: Supabase on AWS (us-east-1).
• Web hosting and CDN: Cloudflare Pages.
• Email delivery: Resend (sending domain restoremindset.com is DKIM/SPF verified).
• Audio assets: Cloudflare R2, served behind the Cloudflare CDN.

• We follow Apple HealthKit guidelines and Google Health Connect policies for collection, storage, and disclosure.
• Health data never leaves your device without an explicit, revocable permission grant.
• Health data is never combined with advertising identifiers and never used for advertising, insurance, or employment purposes.

• Automated daily backups of the Supabase database.
• Backups retained for 30 days and encrypted at rest.
• Restore procedures are tested on a recurring schedule.

If you believe you have found a security issue, please write to security@restoremindset.com. We acknowledge reports within two business days and credit responsible disclosure where requested.

• GDPR — for users in the European Union.
• CASL — for Canadian users (email consent and unsubscribe).
• Apple HealthKit guidelines and Google Health Connect policies.