It started with an Excel spreadsheet.
Like many people, I noticed a pattern: the number of hours I slept seemed to dictate how I felt the next day. But tracking that in a spreadsheet was tedious. I had to be at my computer, and by the time I logged my mood, the moment had passed. I wanted something simpler—something that lived in my pocket and helped me understand why I was eating when I wasn’t actually hungry.
That curiosity became NourishNot (https://nourishnot.app and https://nourishnot.com)
I built it primarily for myself, using principles of neuroscience to map the connection between sleep, mood, and cravings. But as the app grew, I realized I wasn’t just logging numbers; I was logging my vulnerabilities. And in those moments of craving, what I needed most was someone to talk to—someone who understood what I was going through without judgment.
The 24/7 Companion
That need led to the development of the AI Coach. It’s not a generic chatbot; it’s a specialized companion designed to help you work through moods and social situations in real-time.
Because I built this for myself first, I knew that privacy was non-negotiable.
- Anonymity First: When the AI Coach interacts with a user, it doesn’t know who they are. Thanks to our Anonymous ID system, the API only receives numbers and patterns—the “what,” never the “who.”
- Guardrails & Safety: Unlike general-purpose AI, the Coach has strict guardrails. It is programmed to avoid providing medical advice or engaging in sensitive mental health diagnostics. Its role is supportive, not clinical.
Security as the Foundation of Trust
As the sole developer, I didn’t have a security team. I had to make choices that were both robust and realistic. I chose the path of least resistance—the methods that were easiest to implement but hardest to break.
1. Privacy as a Product Feature Most apps ask for your email first. NourishNot asks for nothing. A random identifier is generated locally. There are no accounts, no passwords, and no names. This means freedom from judgment and limits liability if a breach ever occurs.
2. Locking Down the Device
- Military-Grade Encryption: Every emotion log and mood entry is stored using AES-256-GCM encryption. Even if another app accesses the files, the data is unreadable noise.
- Minimal Permissions: I only request location data when absolutely necessary. No camera, no contacts, no microphone.
3. The “Secrets Stay Secret” Philosophy On the server side, API keys and database credentials are never hard-coded. They are loaded from environment variables and stored outside the public-facing web directory. This ensures that even in the event of a server misconfiguration, sensitive credentials remain inaccessible.
4. Trust, But Verify (Every Input)
- Strict Validation: Every piece of data sent to the server is validated against strict formats. We only accept known, expected event types.
- Parameterized Queries: Every database interaction uses prepared statements, neutralizing the risk of SQL injection.
- Intelligent Rate Limiting: To protect the AI Coach from abuse and ensure fair usage, I implemented a robust rate-limiting system. This prevents the system from being overwhelmed while keeping the experience smooth for genuine users.
5. Silence in Production I configured the build process to automatically strip all debug logging from the final release. Sensitive data never ends up in system logs where other apps might read them.
Context, Not Surveillance
One feature often misunderstood is location tracking. In NourishNot, this is entirely optional. Cravings don’t always happen at home; sometimes they are tied to specific environments, like the office breakroom or a particular commute. By enabling location, users can see where their triggers live. It’s not about watching where you go; it’s about helping you understand your environment so you can find ways to deal with cravings when you’re in those specific spots.
The Next Chapter
As I get closer to pushing NourishNot to the Google Play Store and starting the process of a closed beta (following my own private, closed testing), I thought it was the right time to show the world what this app is.
NourishNot is built on the idea that cravings are signals, not failures. By choosing the “easiest” secure paths—anonymous IDs, encryption, and strict validation—I didn’t just protect data; I protected the user’s willingness to be vulnerable.
This project demonstrates that security doesn’t require a massive budget or a large team. It requires a mindset. It requires treating privacy not as a compliance checkbox, but as the foundation of the user experience.
I built this app because I had nobody to talk to who understood what I was going through. Now, it helps others do the same—in a space that is as secure as it is supportive.
About The Author
