An app about shame should not have a login

Burn My Desire has no sign-up screen. There is no email field, no password, no social login, and no account to delete. This was decided early and it is not going to change. Since this was written the app gained an optional iCloud backup — encrypted with your own passphrase before it leaves the phone, which is what makes it compatible with everything below.

What people actually log

The wedge is impulse purchases, so the obvious mental image is a pair of headphones. But once you give people a place to put a craving, they put the real ones there: the drinking, the smoking, the 1am scroll, the ex whose profile they keep opening.

A database of that, tied to an email address, is a liability no amount of encryption-in-transit makes acceptable. The safest possible version of that database is the one that never leaves the phone.

What that means concretely

• The database is SQLCipher-encrypted, with the key stored in the iOS Keychain rather than in the app bundle.
• Photos and written thoughts are written with complete data protection, so they are unreadable while the phone is locked.
• There is no analytics SDK, no crash reporter that ships content, and no network call that carries anything you typed.
• Erase everything genuinely destroys the database, the images, the preferences and the key. There is no copy elsewhere, because there was never a copy elsewhere.

The trade we are making

This costs us things. No cross-device sync. No web dashboard. No recovering your history if you lose the phone without a backup. Growth loops that depend on knowing who you are do not exist for us.

We think that is the correct trade for an app people use at their least composed moments. If the promise is that your temptations never leave your phone, it has to be architecturally true, not a paragraph in a policy.