clientAPT app icon

CLIENTAPT

The opposite of the default calendar.

A privacy-first appointment manager for solo service businesses, on iOS and Android. End-to-end encrypted on-device vault, dual-PIN sensitive tier, duress decoy. No network. No cloud sync. No exits.

▸ Download on the App Store ▸ Get it on Google Play

— What it is —

Solo service businesses — tattoo artists, home cleaners, nail technicians, mobile service providers — hold materially sensitive client data: photos of in-progress work, home addresses, visit schedules. The default tool for tracking that information is the calendar app that ships with the phone — Calendar on iOS, Google Calendar on Android — a piece of software whose main feature is propagating its contents everywhere it can. iCloud and Google Drive. Spotlight and Google Search. Siri and the Google Assistant. Lock-screen widgets. Share extensions. Any third-party app that asks for calendar access.

That is the wrong default for this data. clientAPT is the opposite default: a system whose main feature is keeping the data inside one device, behind several locks, with no exits.

The threat model assumes the worst plausible adversary for a small business — someone steals the phone while it is unlocked and tries to extract addresses, contacts, and photographs. That person fails. The deeper threat — a coerced unlock — is addressed by a duress PIN that opens a populated but fake vault. The real vault remains sealed.

— Highlights —
  1. Encrypted on-device vault.

    AES-256-GCM under Argon2-derived keys, SQLite via GRDB on iOS and Room on Android. No network. No iCloud or Google Drive. No system calendar exposure. No Spotlight or Google Search indexing. No Siri or Google Assistant donations.

  2. Dual-PIN sensitive tier.

    Flagged clients show as "Private Client" with a 🔑 glyph. Their name, phone, address, and photos require a second, per-client unlock.

  3. Duress PIN.

    A separate PIN opens a believable decoy vault — seeded with a plausible personal-trainer client list — under coerced unlock. The real vault stays sealed.

  4. Encrypted in-app camera.

    In-app camera capture. EXIF stripped before encryption. Photos encrypt with AES-GCM before they touch disk — nothing ever appears in the system photo library or its cloud backups.

  5. Hardened clipboard.

    Phone and address copy carry the platform's local-only flag — UIPasteboard.localOnly on iOS, EXTRA_IS_SENSITIVE on Android — with a 30-second expiration. The value never reaches Universal Clipboard or Google's cross-device handoff, and self-destructs after the timeout.

  6. In-session timer.

    A live countdown ring for a running appointment, with pause/resume, completion notification, and idle-timer override so the device doesn't lock mid-session.

— Getting started —
  1. Install on iPhone (iOS 17 or later) or Android (13 or later).
  2. Create your app PIN. Optionally enable biometric unlock.
  3. Set a duress PIN. Pick a decoy seed.
  4. Add clients. Mark any that are sensitive — they become "Private Client" behind a second-tier PIN.
  5. Schedule appointments. The services catalog and add-ons prefill duration. Weekly recurrence follows an RFC 5545 RRULE subset.
— Built with —
Swift SwiftUI Kotlin Jetpack Compose GRDB.swift Room AES-256-GCM Argon2 Keychain + Secure Enclave Android Keystore StoreKit 2 Play Billing AVFoundation Media3 iOS 17+ Android 13+