# Household data lives on the device

The repository's architectural decision, rationale and consequences.

# Household data lives on the device

**Status:** accepted · **Date:** 2026-11-06 · **Related:** [ADR-0003](0003-organizations-are-the-tenant.md), [ADR-0020](0020-account-optional-household-app.md)

**Enforcement:** a mobile-only `packages/local-db` with Node tests on `better-sqlite3-multiple-ciphers`; a network test that no vault document or health flag reaches the server.

The product ARD stores household data in PostgreSQL on the server. The template does the same: every row belongs to an Organization in Postgres ([ADR-0003](0003-organizations-are-the-tenant.md)). Varu cannot follow either. The kit, plan, vault and crisis mode must work offline and without an account, and health data and vault documents must never leave the device (HANDOFF rules 1–3).

## Decision [#decision]

1. **The household's kit, plan, vault and settings live in an encrypted SQLite database on the phone.** SQLCipher through `expo-sqlite`, accessed with Drizzle, in a mobile-only `packages/local-db`. The pattern is the one proven in `~/work/doro/packages/local-db`; it is adapted, not copied, and carries no unrelated tables.
2. **The key is a random 256-bit value in `expo-secure-store`** with `AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY`. It is not derived from a password, is not backed up, and does not move to a new device.
3. **Node tests run on `better-sqlite3-multiple-ciphers`**, so the same schema and queries are tested without a simulator.
4. **The server holds no household rows.** It receives only end-to-end encrypted family-sync blobs and opt-in municipality aggregates. Medication (name and quantity, never a dose) and vault documents are never synced, backed up or counted.
5. **The template's Postgres tables, RLS and Organizations are unchanged.** They serve family sync, municipality users and the list editor, not the household's data.

## Consequences [#consequences]

- Losing or resetting a phone loses the kit unless the household uses family sync or a local export. The app says so plainly.
- Schema migrations run on the device at app start; they must be additive and tested against old fixtures.
- Features that need the whole household (aggregates, support) cannot read it; they work from what the household chooses to send.
- Web gets no household data. The web app serves municipalities and the editor.