ROUTN

Security

How your data is protected

ROUTN holds photographs of your face and scalp and a record of your personal-care routine. That is personal, so the protections below are built into the system rather than left to the app to remember.

Your data is separated from everyone else’s

Every table that holds user data has row-level security switched on, and the policy is the same shape everywhere: a row is visible only to the account that owns it. This is enforced by the database, so a bug in the app cannot hand you someone else’s data — the query simply returns nothing.

Automated tests sign in as two separate accounts and assert that each one is refused access to the other’s photos, routines, products, check-ins and Coach messages. Those tests block a release if they fail.

Photographs

  • Stored in a private bucket. There is no public URL, and none can be created.
  • Shown to you through short-lived signed links, generated per request and expiring quickly.
  • Filed under a path derived from your account, with a storage policy and a database constraint that both refuse a path belonging to anyone else.
  • A photo used only for an analysis is deleted once the analysis finishes. Only a photo you explicitly save is kept.
  • Not used to train general AI models.

Keys never reach your device

No AI provider key is present in the mobile app or in this website’s JavaScript. Every privileged call runs server-side, where the key stays. The high-privilege database key is used only by server functions and is never shipped to a client.

Sign-in tokens on your phone are held in the platform keystore — Keychain on iOS, Keystore on Android — not in ordinary app storage.

What we deliberately do not collect

  • Error reports never carry your photographs, your Coach conversations or your health questionnaire answers.
  • Analytics records that something happened — a routine was built, a check-in was saved — never what it contained. Photos, photo URLs, conversations, concern free-text and observation values are all excluded, and the event allow-list is enforced in code.
  • ROUTN does not ask for your location, your contacts or your microphone.

The AI Coach cannot change your routine on its own

Suggestions from the Coach are proposals. You see exactly what would change, before and after, and nothing is written until you approve it — at which point the server re-checks the change and applies it as a single transaction. The routine logic itself is ordinary deterministic code, not a model deciding for you.

Reporting a vulnerability

If you believe you have found a security problem, please tell us before telling anyone else. Email [PRIVACY_EMAIL] with enough detail to reproduce it. We will confirm we received it, keep you updated while we work on it, and we will not pursue anyone who reports a genuine issue in good faith and does not access, modify or keep other people’s data.

Please do not run automated scanning that degrades the service for other people.

What this page does not claim

ROUTN is not certified against any security standard, and no third party has audited it. This page describes controls that exist in the code today. If that changes, it will be because it actually changed — see the Privacy Policy for how your data is handled and who processes it.