The maths runs on your phone, and that costs me things
A privacy claim is only interesting if you can name what it cost you.
Every health app says it respects your privacy. The sentence is free, so it tells you nothing. What tells you something is which features the company gave up to be able to say it.
The apps I build compute everything locally. Your watch writes into Apple Health or Health Connect, the app reads from there, and the models run on the phone. There is no account, no upload, and no copy of your training history on a server I control — because there is no server that stores training history. Here is what that forecloses.
No cohort comparisons
I cannot tell you that your critical power is in the 70th percentile for men your age on this platform, because I do not have the other men. Any reference range you see in my apps comes from published literature with a citation, not from other users. That is a weaker product feature and a more honest number, and I would rather defend the second one.
No server-side backfill
When I improve a model, the new version applies to sessions the phone can still read. I cannot silently recompute five years of history in a batch job overnight, because the history is not anywhere I can reach. Every migration has to be something the device can do, on battery, without the user noticing.
No cross-device continuity for free
Two phones, two independent local databases. Anything that syncs between them has to go through Apple’s or Google’s infrastructure with the user’s own credentials, or not happen. Most of the time it does not happen, and I have to say so.
No behavioural analytics worth the name
I know installs and I know crashes. I do not know which screen you spend the most time on, because the instrumentation that would tell me is exactly the instrumentation I said I would not ship. Product decisions get made on reasoning and on what people write to me, which is slower and occasionally wrong.
Why it is still the right constraint
Because of what the data is. A resting heart rate series is not a preference; it is a physiological record, and in aggregate it is one of the more revealing things a person can hand over. I have been building clinical software since 2000, and the rule that has never let me down is that the safest place for a health record is the smallest number of places.
There is also a design benefit I did not anticipate. When you cannot fall back on a server, every metric has to be defensible from the sensor data in front of you. You stop shipping numbers you cannot explain, because there is nowhere to hide the derivation. Each metric page in the apps names the paper the model comes from — Skiba for W′ balance, Wakayoshi for critical swim speed, Menz and Brach for gait reference ranges — and that discipline is downstream of the architecture, not of good intentions.
The constraint is real, it costs real features, and I would make the same choice again. That is the only version of a privacy claim that means anything.