Staminabar security

LAST UPDATED 10/17/2026EFFECTIVE DATE: 10/17/2026

HOW WE PROTECT YOUR DATA.

Staminabar handles health data, so we try to keep as little of it in reach as we can, and to be plain about what is and is not built. The app is coming soon to the App Store and is not available there yet. The Service may still change, and the Skyrim mod is the only game that can connect so far. Anything not built is taggedPlanned

Sign-in without passwords

/There is no password to steal or reuse.
/You sign in with a link we email you. It works once, for 1 hour, and a new email cancels the old link.
/Your phone then makes its own sign-in key. The private half stays in your phone's secure keychain, on that device only, and is never backed up. We store only the public half.
/Every sign-in failure gets the same answer, so nobody can use our replies to find out who has an account.

What a game can reach

/A game connects only through its own server, and only after Staminabar has verified that server.
/You pair by scanning a QR code with the Staminabar app. The app shows the game's name and publisher from our records, never from the game. You tap Allow or Deny.
/The code works once and expires after 5 minutes. Five wrong tries and it is dead.
/The game's server makes its own key pair and gives us only the public half. Staminabar's account and pairing services never hold its private key. For our own Skyrim and Minecraft mods, Staminabar runs that game server, and it keeps its private key sealed and separate.
/A game receives only nine scores from 0 to 100, with a tier, state, trend and change from your usual. Never your readings, never a clinical value, never your name or email.
/Remove a game's access in the app and it loses access within about a minute.

Where your data lives

/Our servers and data are on Amazon Web Services in the us-east-1 region (northern Virginia).
/Traffic between your phone, a game server and our servers is encrypted with TLS 1.2 or higher, and HTTP is redirected to HTTPS. Calls between our own services stay on a private network; encrypting those too is planned.Planned
/Data is encrypted at rest.
/You can delete your account in the app (Settings > Delete account). Deletion is immediate and removes your account record and email, sign-in devices and keys, game connections (revoked, and each game's server is told), health readings and daily summaries. Database point-in-time backups can hold copies of deleted data until they age out within 35 days.
/Keys and secrets are protected with AWS Key Management Service. Service secrets live in AWS Secrets Manager, never in code, images or config files.

How our systems are built

/Each service has its own permissions and can reach only its own data.
/The routes our services use to talk to each other are on a separate listener that the internet cannot reach. A second secret guards them as well.
/Our logs never contain your health values or key material. When a reading is refused, we log which field was wrong, not its value.
/Debug logging cannot be turned on in production.
/The app has no third-party code: no analytics, no ad SDKs.

What we do not do

Never

Sell your data

Never

Run advertising

Never

Tell any game who you are

Report a security issue

Tell us what you found, how to reproduce it, and how to reach you. Please give us a fair chance to fix it before you share it, do not access or change other people's data, and stop testing once you have shown the issue. We will reply and keep you updated.

security@staminabar.ioNO CURRENT BUG BOUNTY

For app help, email support@staminabar.io.