Eight quiet promises
Each promise has a verification command we can run. We re-run them on every release. If a check ever fails, this page says so before any product copy does.
Inside the app, you will never see a marketing popup, upsell modal, or "rate us" interruption. The only modals exist for genuine functional moments — confirming a destructive action, showing your recovery phrase, or a subscription paywall you opened yourself.
$ rg -i "showDialog|showModalBottomSheet" lib/ \
--type dart | grep -vi "confirm\|recovery\|paywall"
# expected: 0 marketing matches
QiFlux ships zero ads for everyone — free and Premium alike. There is no AdMob SDK in the binary. No rewarded-ad option, no banner, no interstitial. The promise is enforced by the absence of the SDK, not just a UI toggle.
$ grep "google_mobile_ads" app/pubspec.yaml # expected: 0 matches — SDK not present
The first launch creates a local-only profile with no account, no email, no phone number. Sign-in is opt-in only, used solely for encrypted cloud backup. We never ask for an email "to save your data".
$ flutter test integration_test/anonymous_default_test.dart # fresh install logs a cycle; asserts no sign-in prompt
By default, no cycle data leaves the device. The cloud "How am I today?" check is opt-in. Encrypted cloud backup is opt-in. The marketing site uses 0 third-party trackers — no Google Analytics, no Mixpanel, no PostHog.
$ grep -E "mixpanel|amplitude|firebase_analytics" \
app/pubspec.yaml
# expected: 0 matches (no analytics SDKs, ever)
We ship at most 5 third-party network SDKs. The current binary ships 3: RevenueCat (subscriptions), Sentry (crash reporting, PII-filtered), and the Health SDK (HealthKit / Health Connect OS bridge — no external server). Sign in with Apple and Google Sign-In are OS bridges used only for backup login. Every dependency is auditable in our public pubspec.
$ grep -E "purchases_flutter|sentry_flutter|health" \
app/pubspec.yaml
# RevenueCat + Sentry + Health — 3 of ≤5 allowed
Cancel a subscription in two taps: Settings → "Manage subscription" deep-links to the OS-native subscription page. We never put a cancel flow inside our own UI — Apple and Google both forbid the dark patterns we'd be tempted to use there.
$ flutter test test/integration/cancel_subscription_test.dart # asserts settings row → openManageSubscriptionsUrl()
Three locks on every checkout: (1) the bold-faced first-charge date and amount above the Confirm button, (2) a "next charge in N days" countdown always visible in Settings, (3) a one-tap "cancel now" that skips our UI entirely. No "free trial" headline without the math underneath. The trial is 7 days.
$ flutter test test/widget/paywall_transparency_test.dart # asserts charge date, countdown, cancel-now visible pre-confirm
If you opt in to the cloud "How am I today?" check, the prompt sent to Google Gemini contains only cycle phase, your constitution tag, and a few chosen symptoms — no name, no email, no birthdate, no device ID. We use Google's paid tier, which carries a no-train commitment. You can switch back to on-device-only at any time.
$ grep -E "user_id|email|exact_birth" \
worker/src/routes/ai_check_in.ts
# expected: 0 PII fields in the outbound prompt builder
If a promise fails
No silent edits. No quiet rollback. If we ship a release that breaks one of these, this page changes from green to amber and explains what happened, what we shipped to fix it, and when.