We won't show you the whole codebase. Here's what actually happens instead.
A source that's held to a higher bar than marketing copy: every claim on this page is checked directly against our own source code, not just written once and left. Pick an app, see exactly what talks to the network and what never does — then go verify it yourself. We'd rather you check than trust us on our word.
Why not just publish the repository?
Because full transparency and full disclosure aren't the same thing, and pretending otherwise wouldn't earn trust — it would just move the question.
The honest answer: the source code is a business asset, and publishing all of it isn't something we're willing to do. We also don't think a raw repository would actually be more trustworthy to most people who ask this — it would mean wading through build tooling, internal docs and Flutter boilerplate to find the handful of things that actually matter: what leaves your device, and what a company you've never met can see about you.
So instead of "here's everything," this page is "here's exactly what talks to the network, cross-checked against the real code by someone who could see all of it." It's narrower than a public repository. It's also more direct than a privacy policy, because it's organized around one question — what actually goes over the wire — rather than legal categories.
Pick an app
Each app gets its own breakdown, because they don't share a backend or a data model. More Mintlane apps will get a tab here as they ship.
What talks to the network
An anonymous identity, created for every install
From the moment you first open Medifix, the app signs in anonymously to Firebase and registers a push-notification token in the background — for every install, not only for people who use Caregiver-Sharing. This is a random, device-bound identifier with no email address, password or real-world identity attached, and by itself it does nothing. It exists so that if you do turn on Caregiver-Sharing later, it can activate instantly instead of making you wait while a fresh identity gets created.
Caregiver-Sharing — off until you turn it on
Caregiver-Sharing itself stays off by default and only starts once you generate an invitation link and someone accepts it. When it's active, the medication-status snapshot relayed between your device and your caregiver's is encrypted on your device before it's ever written to our database — the encryption key is generated locally and never transmitted, so neither Mintlane nor Google can read it. The same is true for missed-dose and archival alerts sent as push notifications: they're encrypted the same way before they leave your device, and our server only ever relays ciphertext it cannot decrypt. A few small routing fields — device tokens, your display name if you set one, and a one-time pairing code — travel unencrypted, but are restricted so only your two paired devices can read them; they never leave that pairing.
Drug-name and interaction lookups
When you search for a medication, and once every 24 hours to re-check the medications already in your list, Medifix asks the FDA's public openFDA API for interaction information. Only the medication or ingredient name is sent — no personal data, no device identifier, no account. There's currently no toggle to turn this specific lookup off; if that matters to you, tell us and we'll factor it into what we build next.
Crash reports — opt-in, off until you say yes
If you explicitly turn this on, Medifix sends a stack trace, the app version, your device manufacturer and OS version, and a random installation ID to Firebase Crashlytics when the app crashes. It never includes medication names, doses, schedules or intake history.
In-app purchases
Premium and the Caregiver-Sharing subscription are billed entirely through Apple or Google. We receive only a signal that a purchase is valid — never your card details or billing address.
App Check
Every request our app makes to its database carries a device-integrity token (Play Integrity on Android, App Attest on iOS), so the database only accepts requests from genuine copies of the app rather than scripts or emulators. It doesn't carry any of your data — it's a proof-of-authenticity check, not a data channel.
What never leaves your device
- Your medications, doses, schedule and intake history — stored locally in an AES-256 encrypted database and never uploaded anywhere
- Backups — encrypted files written to a folder on your own phone, never a cloud service
- Biometric data — Face ID or fingerprint checks happen entirely inside the OS; the app only ever learns pass or fail, never the biometric data itself
What we tell Apple and Google we collect
In plain terms: crash logs (only if you opt in), an anonymous device identifier (always, for the reason explained above), your medication and health data (required, stays local), your display name (optional), the medication-name text sent to the FDA's API (always, for interaction lookups), and confirmation that a purchase happened (never payment details). Apple's label lists nothing under "data used to track you" — we don't use any advertising or cross-app tracking SDKs.
Show the literal Play Store / App Store declaration tables
| Google Play — Data Safety | |||
|---|---|---|---|
| Data type | Collected | Shared | Required |
| Crash logs | Yes | Yes (Firebase Crashlytics) | Optional |
| Device / other IDs | Yes (anonymous Firebase ID + push token) | No | Always collected on install; only used if Caregiver-Sharing is set up |
| Health info (medication, dosage, intake) | Yes | No | Required |
| Personal info (display name) | Yes | No | Optional |
| App activity (medication name text, sent to api.fda.gov) | Yes | Yes (US FDA, third party) | Always — on search, and every 24h |
| Purchase history | No — Apple/Google process it directly | — | — |
| Apple App Store — Privacy Nutrition Label | ||
|---|---|---|
| Category | Data | Linked to you |
| Health & Fitness | Medication names, dosage, schedule | Yes (local only, not shared unencrypted) |
| Identifiers | Display name (optional) | Yes |
| Identifiers | Device ID — anonymous, created on every install | No |
| Diagnostics | Crash data (opt-in) | No |
| Usage data | Medication name text sent to api.fda.gov | No |
| Used to track you | None | — |
What talks to the network
An update check — the one always-on connection
Once each time you open Noralia, and again whenever you bring it back to the foreground, the app asks Firebase whether the installed version needs an update prompt — for example after a fix that matters for reminder delivery. This is the one network call that isn't optional. It sends only an anonymous, random installation identifier; nothing about your cycle, symptoms, notes or name is included, because nothing else is ever passed into the request.
Backup — off by default, and never Mintlane's
If you turn on automatic backups, the file is encrypted on your device — AES-256-GCM, with the key derived from a backup password only you know, using 600,000 rounds of PBKDF2 — before it's written anywhere. On iPhone it goes to your own iCloud Drive; on Android it stays in a local folder on your phone and never touches the cloud at all. Either way, it's your storage, not ours: we operate no backend for this feature and couldn't decrypt the file even if we had it.
Crash reports — opt-in, off by default
If you turn this on, Noralia may send a stack trace, app version and a random installation ID to Firebase Crashlytics when something goes wrong — for example if an automatic backup fails, we may learn a short technical reason why and which screen it happened on. Cycle data, symptoms, notes, names and PIN state are never included; that's enforced by the code, not just a promise.
In-app purchase (Premium, one-time)
Handled entirely by Apple StoreKit or Google Play Billing. Noralia only ever reads back whether you own Premium — no purchase data is sent to us.
Ask Noralia — the in-app chat companion
Ask Noralia runs entirely on your device. It's a scripted conversation engine that reads your own local entries to answer things like your average sleep or cycle length back to you — there is no AI model call, no server, and no network request involved at any point. "Clear conversation" deletes the transcript from your device and nowhere else, because nowhere else ever had it.
Apple Health / Health Connect — Premium, optional
If you connect Health or Health Connect to see sleep, steps or workouts alongside your cycle, that connection is read-only and entirely on-device. Noralia never writes back to Health and never transmits what it reads to us or anyone else.
What never leaves your device
- Your cycle, symptom, mood, temperature and intimate-health entries — stored locally in an AES-256 encrypted database
- Your Ask Noralia conversation history
- Your name, if you enter one — used only to personalize messages inside the app
What we tell Apple and Google we collect
In plain terms: an anonymous device identifier (always, for the update check above), crash logs (only if you opt in), and nothing else — no cycle, symptom or health data is ever declared as collected, because none of it is ever transmitted. Apple's label lists nothing under "data used to track you": no advertising SDK, no analytics SDK, and no cross-app tracking of any kind.
Show the literal Play Store / App Store declaration tables
| Apple App Store — data collected | ||
|---|---|---|
| Data type | Linked to you | Used for tracking |
| Identifiers → Device ID (anonymous install ID, for the update check) | No | No |
| Diagnostics → Crash data (opt-in only) | No | No |
| Apple App Store — data not collected (stays on-device) | |
|---|---|
| Category | Note |
| Health & Fitness | Cycle, symptom, mood, BBT and intimate-health data; Health/Health Connect sync is read-only and local |
| Sensitive info | Intimate Health Log — on-device only |
| Contact info (name) | Local personalization only |
| Photos or videos | Today-screen photo — picked by you, stored locally, never uploaded |
| Purchases | Handled by StoreKit/Play Billing directly; we only read back entitlement state |
| Usage data | No analytics SDK of any kind |
Verify it yourself
We'd genuinely rather you check this than take our word for it. It doesn't take much.
A network-inspection proxy — mitmproxy, Charles Proxy, or HTTP Toolkit on desktop, or PCAPdroid directly on an Android phone — lets you install a local certificate and watch exactly what an app sends, in plain sight. Install one, run either app through it, and compare what you see against the breakdown above. It should match.
The one thing to expect: on Android, Medifix's connection to the FDA interaction API will show up as blocked, because that specific connection is certificate-pinned on purpose (explained above). Every other connection in both apps — including Firebase, Crashlytics, and Noralia's update check — should be fully visible.
Found something, or made your own write-up?
If you've captured the traffic yourself, spotted something that doesn't match this page, or recorded a walkthrough of what you found — we want to hear about it either way.
Send it to hello@mintlane.io. If this page turns out to be wrong about something, we'll fix it and say so. If you've done an independent review — a video, a blog post, a traffic capture — tell us and, with your permission, we'll link it right here, alongside our own claims rather than instead of them.