DEV Community

CBT Tools
CBT Tools

Posted on

Your Mental Health Data Never Leaves Your Browser: 36 Tools with Zero Backend, Zero Signup, Zero Cookie

#webdev #javascript #productivity #discuss

Every mental health app I've ever tried has the same problem: it asks me to create an account.

That means my anxious thoughts, my depression patterns, my relationship anxieties — the most private data I generate — gets uploaded to a server I don't control. Stored in a database I can't see. Protected by a company that might get acquired, breached, or shut down.

So I built 36 mental health tools that don't do any of that.

The Architecture: Zero Backend

Every tool in the CBT Toolkit follows the same constraint:

No backend server
No database
No API calls
No account creation
No cookies
No analytics tracking
No data leaves the browser
Enter fullscreen mode Exit fullscreen mode

All data lives in localStorage — the browser's built-in key-value store. It persists across sessions, survives refreshes, and never touches the network.

// The entire "database" is 40 lines
const DB = {
  save(entry) {
    const records = JSON.parse(localStorage.getItem('entries') || '[]');
    records.push({ ...entry, id: Date.now(), timestamp: new Date().toISOString() });
    localStorage.setItem('entries', JSON.stringify(records));
  },
  getAll() {
    return JSON.parse(localStorage.getItem('entries') || '[]');
  },
  clear() {
    localStorage.removeItem('entries');
  }
};
Enter fullscreen mode Exit fullscreen mode

That's it. No fetch(). No axios. No WebSocket. No GraphQL. The network tab in DevTools is silent.

Why This Matters for Mental Health Specifically

Mental health data is uniquely sensitive. Consider what a typical CBT app records:

  • Catastrophic thoughts: "What if I'm having a heart attack?" (panic attacks)
  • Core beliefs: "I am unlovable" (depression)
  • Safety behaviors: checking the stove 12 times before leaving (OCD)
  • Trauma triggers: specific memories and their emotional charge (PTSD)
  • **Relationship patterns": "I always choose emotionally unavailable partners" (attachment)

Now imagine this data in a breach. Or sold to a data broker. Or subpoenaed in a custody case. Or used by an insurance company to deny coverage.

This isn't hypothetical. In 2020, a mental health app called Cerebral shared user data with Meta and Google for ad targeting. In 2022, BetterHelp was fined $7.8M by the FTC for sharing health data with advertisers.

The 36 Tools

Here's what's in the toolkit — all vanilla JS, all client-side, all privacy-first:

Cognitive distortions (the core of CBT):

  • Cognitive distortion detector (200 lines, pattern-matching)
  • Core belief detector (downward arrow technique)
  • Safety behavior detector (9 CBT categories)
  • Catastrophic thought reframer (rule-based generation)
  • Habituation pattern detector (ERP tracking)
  • Prediction calibration detector (behavioral experiments)

Condition-specific tools:

  • CBT for OCD (with ERP protocol)
  • CBT for ADHD (with executive function strategies)
  • CBT for panic attacks (with arousal reappraisal)
  • CBT for PTSD (with trauma processing)
  • CBT for body image
  • CBT for imposter syndrome
  • CBT for shame
  • CBT for low self-esteem
  • CBT for anger
  • CBT for health anxiety
  • CBT for social anxiety
  • CBT for perfectionism
  • CBT for procrastination
  • CBT for test anxiety
  • CBT for burnout
  • CBT for insomnia

Utility tools:

  • Thought record (the core CBT worksheet)
  • Mood tracker
  • Analytics dashboard (zero Chart.js, zero D3)
  • Price discrimination detector (consumer protection)

The Trade-offs (Honest)

Client-only architecture has real limitations:

No cross-device sync. Your data lives on one browser. Clear your cache? It's gone. I added an export/import feature (JSON download + file upload) so you can manually transfer data, but it's not automatic.

No cloud backup. If your hard drive dies, your data dies with it. This is the cost of zero-server. For mental health data, I think this is a feature, not a bug — but you might disagree.

No collaborative features. You can't share a thought record with your therapist in real-time. You'd have to export and email it (which re-introduces the privacy problem). A therapist portal would require a server, which breaks the model.

No ML/AI. The distortion detector uses keyword pattern matching, not NLP. It catches "I'm a failure" but misses "I never seem to get things right." An LLM would be more flexible — but an LLM requires sending your thoughts to a server. The trade-off is precision for privacy.

Why Rule-Based > ML for This Domain

People ask why I didn't use GPT or Claude for the cognitive distortion detector. Three reasons:

1. Medical accuracy. CBT distortions are precisely defined (Beck, 1963). "All-or-nothing thinking" has a specific meaning. An LLM might hallucinate a distortion that doesn't exist in the literature. Rule-based returns only validated CBT categories.

2. Zero latency. An LLM call takes 1-3 seconds. My detector returns in <1ms. For a tool you use mid-anxiety-attack, that difference matters.

3. Zero cost. No API key, no rate limits, no token usage. The tools work offline. They work in countries where OpenAI is blocked. They work when you're broke.

The Privacy Audit

I ran the toolkit through a privacy audit:

Check Result
Network requests on load 0
Network requests on data entry 0
Cookies set 0
Third-party scripts loaded 0
localStorage keys used 1 per tool (namespaced)
Data sent to any server None, ever
Works offline (after first load) Yes
Works with network disabled Yes

Open DevTools → Network tab → use any tool. The log stays empty. Not "empty after analytics batch" — empty, permanently.

How to Use the Toolkit 

git clone https://github.com/alexcoledev/cbt-toolkit
cd cbt-toolkit
# Open any tool in your browser
open docs/cognitive-distortion-detector.html
Enter fullscreen mode Exit fullscreen mode

Or just visit the live hub — it's a static GitHub Pages site. No login. No tracking. No popup asking you to subscribe.

The Bigger Question

Why does every mental health startup build a server?

Part of it is genuine — some features need a backend (therapist chat, cross-device sync, insurance billing). But part of it is the default: we've been building server-first for so long that "client-only" feels wrong, even when it's possible.

The CBT toolkit proves that a meaningful mental health product can exist entirely in the browser. 36 tools. 15,000 lines of vanilla JavaScript. Zero servers. Zero data breaches. Zero FTC fines.

If you're building a mental health app, ask yourself: does this feature actually need a server? Or am I adding one because that's what I always do?

All 36 tools are open source (MIT license). No paywall, no freemium, no "pro tier." If you want to contribute, PRs are welcome. If you want to fork it and build your own, go ahead.

The most private data you have is your mental health data. It should never leave your browser.

Top comments (0)