What an Efferent archive can see

Efferent lets an agent work with Apple Health history without opening a connection to the iPhone. The phone sends encrypted days to an archive, and a reader running beside the agent downloads and decrypts the days needed for a question.

This page describes the design used by the internal TestFlight build 27. Efferent is preparing for its first App Store release and is not publicly available yet. Encryption protects the health contents; the archive service still sees the metadata below.

The archive service can see

• which calendar days exist;
• the encrypted size of each day;
• when a day was uploaded or replaced;
• which days arrived together;
• the size and timing of an encrypted edit request;
• whether the phone later applied, partly applied, or rejected that request, including counts and a short failure word.

These facts are needed to address a day, keep an archive synchronized, enforce storage limits, and report whether a queued change finished.

The archive service cannot see

• health metrics or values;
• workout, sleep, heart-rate, or activity contents;
• times of individual readings inside a day;
• the question an agent asked;
• the private reading key.

Each day is stored as one sealed object. The service transports and stores ciphertext. Decryption happens on the computer that holds the reading key.

Why nothing connects to the phone

iOS suspends applications in the background, phone addresses change, and home and mobile networks normally sit behind network address translation. Efferent therefore uses the phone as the initiator: it reads Apple Health with the permissions granted in iOS, encrypts complete days, and pushes them on its own schedule.

An agent reads through a local helper. The remote interface explains how to connect and accepts no reading key. For archives with a registered read key, requests for encrypted days are signed by the local reader. The reading key stays on the machine running that reader.

The agent must be able to run local code with network access. Pasting a prompt into a web chat does not provide that capability.

This privacy boundary describes the archive service. The agent and any model provider it sends decrypted data to can see that data.

A safe example question

With fictional data, a reader could answer:

How did weekly walking distance change during the last twelve weeks, and which weeks have incomplete daily coverage?

The reader asks the archive for that date range, decrypts those days locally, calculates the weekly totals, and reports missing coverage separately. The service sees the requested encrypted day objects, not the question or the answer.

Efferent is being prepared for its first App Store release. This page explains the privacy boundary before purchase rather than asking readers to trust a general “encrypted” label.