Why I Built an Open-Source, Zero-Cloud Period Tracker with React 19 & Capacitor

Aradar — Sun, 23 Aug 2026 17:11:13 +0000

In an era where health data is increasingly commodified, tracked, and exposed in data breaches, personal data privacy isn't just a bonus feature — it's a fundamental requirement.

Most period and cycle tracking apps require cloud accounts, transmit deeply intimate health telemetry to remote servers, and integrate third-party ad SDKs. When data lives on a central server, it is vulnerable to leaks, corporate sales, and subpoenas.

We asked a simple engineering question: What if the server simply didn't exist?

That philosophy led to Mooneva Cycle — a 100% offline-first, private, and open-source (GPL-3.0) period & cycle tracker built for web, iOS, and Android.

🎯 Core Architectural Philosophy: Zero Trust, Zero Cloud

Our design rule from day one: Data that never leaves the user's device cannot be leaked or compromised.

Traditional Cloud Trackers	Mooneva Cycle
Stored on third-party cloud databases	Stored exclusively on-device (`localStorage` / Secure Storage)
Third-party analytics & telemetry trackers	Zero analytics, zero ad SDKs, zero crash loggers
Requires email/phone registration	No account, no signup, instant access
Susceptible to remote breaches	No centralized database to breach

🛠️ The Tech Stack

To deliver a snappy, native-like mobile experience across iOS and Android without maintaining separate native codebases, we opted for a modern web-to-native stack:

Frontend Core: React 19 + TypeScript
Build Tool: Vite 6
Native Runtime: Capacitor 8 (iOS & Android bridge)
Styling: Tailwind CSS + Vanilla CSS tokens
Internationalization: i18next (supporting 12 languages + RTL layout)
Reporting & Export: html2pdf.js for on-device clinical PDF reports
Testing: Vitest + @testing-library/react

🔐 Key Technical Highlights & Design Decisions

1. Local-First Encrypted Backups with PBKDF2 & AES-GCM

Since there is no remote database to restore from, data portability and secure backup exports are critical. We use standard Web Crypto APIs for user backups:

Password-derived cryptographic keys via PBKDF2 (high iteration counts + dynamic salt).
AES-GCM (256-bit) authenticated encryption for backup archives.
Zero external cryptographic dependencies needed — fully native to modern Web and WebView runtimes.

// Client-side key derivation & encryption flow
async function deriveKey(password: string, salt: Uint8Array): Promise<CryptoKey> {
  const enc = new TextEncoder();
  const baseKey = await crypto.subtle.importKey(
    'raw',
    enc.encode(password),
    'PBKDF2',
    false,
    ['deriveKey']
  );

  return crypto.subtle.deriveKey(
    {
      name: 'PBKDF2',
      salt,
      iterations: 250_000,
      hash: 'SHA-256'
    },
    baseKey,
    { name: 'AES-GCM', length: 256 },
    false,
    ['encrypt', 'decrypt']
  );
}

2. Push-Less Local Notifications

Most apps use FCM (Firebase Cloud Messaging) or Apple APNs coupled with backend cron jobs to send reminders.

To eliminate cloud triggers, Mooneva schedules all alerts strictly on-device using @capacitor/local-notifications. The device OS manages the alarm queue locally for:

Predicted cycle & period starts
Ovulation & fertile windows
Daily symptom/mood logging reminders
Contraceptive pill/patch/ring adherence schedules

3. "Discrete Mode" & Local PIN Protection

Privacy extends to shoulder-surfing. We engineered:

Discrete Mode: Disguises the app launcher icon and name into a neutral utility.
Biometric & PIN Lock: Guarding the interface with configurable timeouts using encrypted storage for authentication state.

4. Non-Gregorian Calendar & True RTL Support

Health apps often overlook regional accessibility. Mooneva includes full support for the Persian (Jalaali) solar calendar alongside Gregorian dates, accompanied by automatic bidirectional (RTL) layout switching via Tailwind's logical directions.

5. Migration Freedom (Import from Flo, Clue & drip)

Vendor lock-in is hostile to user autonomy. We implemented client-side parsers that ingest export files from major platforms (Flo, Clue, drip), normalizing historical cycle dates, flow intensities, and logs into Mooneva's local schema directly in the browser/app memory.

🚧 Challenges Solved

Deterministic Predictions on Sparse Data: Designing cycle prediction algorithms that run entirely on client hardware without heavyweight ML dependencies, providing robust rolling-average predictions while gracefully handling irregular cycles and birth-control withdrawal bleeds.
True Air-Gapped Verification: Configuring mobile manifests (AndroidManifest.xml and Info.plist) to ensure no extraneous network privileges or background tracking services are requested.
Cross-Platform PDF Generation: Generating doctor-ready clinical PDF summaries on the fly directly inside mobile WebViews using canvas and DOM rendering without leaking document data to an external PDF generation API.

🤝 Open Source & Contributing

Mooneva Cycle is 100% free and open source under GPL-3.0. There is no venture capital, no monetization through data harvesting, and no paywalls on essential features.

If you care about local-first software, client-side encryption, and accessible health tools:

⭐ Star the repository: github.com/aradar46/Mooneva-Cycle-Private-Period-Tracker

📱 Try it on Google Play: Mooneva on Google Play

🍎 Try it on App Store: Mooneva Cycle on iOS

🌐 Website: mooneva.se

We welcome contributions — from translations and UI tweaks to cryptographic audits and prediction algorithm improvements!

Silence Is a Feature

Aradar — Sun, 23 Aug 2026 17:03:40 +0000

Originally published at aradar.top.

The server room is too loud. You picture blue LEDs blinking in the dark. It’s actually a wall of sound - thousands of small fans screaming in slightly different keys, a noise that gets into your teeth. I had the yellow ear protection on and could still feel it in my jaw. Aaron didn’t seem to notice. Or he noticed years ago and made his peace.

He walked the row, found the machine, pressed the release. The drive slid out. He held it up, turned it once in the light, and pointed at it with his chin. Grab this.

He seated the new one, waited for the light to go from amber to green, and that was it. Upstairs, a lab full of people kept working on data that had never stopped being there. Not one of them looked up.

Past the double doors, when the noise dropped away and my ears were still ringing, he said: “Silence is a feature.”

I said something. Something like sure.

“No, it’s a feature. Somebody pays for it. You pay, I pay, everybody pays. It’s just not free.” He tapped the dead drive in my hand. “This is the bill.”

We walked. He wasn’t done.

“Think about it. No alert. No status page. No email from IT. That’s the product. That big boring nothing - that’s what all the money buys. And when it breaks, the first thing you lose is the quiet. Then somebody walks back in there.” He tipped his head toward the doors behind us. “Everybody loves builders. Fine. But what you actually depend on, every hour, is maintainers. Water at the pressure you expect. Electricity that’s just there. Cables under the ocean so you can reach the whole world without once wondering how. Somebody is awake right now so that all of it feels like nothing to you.”

He dropped the dead drive in a bin by the door with a dozen others just like it. He had a ticket to close and lunch to get.

Somebody has to deal with the noise so you never feel the lack of silence.

DEV Community: Aradar