Work · Android app

Withy

Closed testing as of 28 September 2026

A private health logbook for Android: designed, built, tested and taken through Google Play's closed testing by one developer.

Withy is on Google Play's closed testing track, not in public release. The earliest date it can apply for production access is 8 October 2026. Nothing on this page is described as live until it is.

The problem

People who are asked to keep an eye on their blood pressure, weight or blood glucose, whether by a doctor, for a relative, or for themselves, end up keeping the numbers on paper, in a notes app, or in a phone app that wants an account, shows ads, and tells them what their numbers "mean".

Withy is built for a narrower job, and it does that job well. It is a fast logbook for the numbers you already take. It charts them, and it produces a clean PDF or spreadsheet to hand over at an appointment. It never interprets a reading, and it never sends one anywhere.

That last sentence was the hardest constraint on the project, and most of the decisions below follow from it.

What was built

A native Android app (Kotlin, Jetpack Compose, Material 3), designed, built, tested and published by one developer. The first build was on 27 August 2026 and the closed-track release on 18 September, with the first tester-reported fix shipping on 25 September.

• Six metrics: blood pressure with pulse, weight, blood glucose (tagged with when it was taken), body temperature, blood oxygen (SpO2) with optional pulse, and A1c. Users show the ones they use and hide the rest.
• Charts over any date range, with average, highest and lowest, and an optional least-squares trend line. There are also user-drawn target bands, splits by tag or by time of day, a comparison with the previous period, and overlays that put two metrics on one chart.
• Three exports. A print-ready PDF report with charts, a spreadsheet workbook with one sheet per metric, and a backup CSV. The app's own importer reads the backup back, and it recognises entries it already has, so importing the same file twice never doubles anyone's history.
• Profiles, so one phone can keep separate logs for more than one person. When the same person exists on two phones under different names, the importer maps one to the other, and two profiles on one phone can be merged.
• Withy+, a one-time $4.99 unlock through Google Play Billing. No subscription, no account.
• A light and a dark theme built on a shared design system. Every colour pairing is checked against the WCAG AA accessibility standard by a script that is run before any colour change is committed.
• A public site at mossforge.app/withy with the privacy policy Play requires and a tester guide that walks closed-test testers through opting in.

The decisions that shaped it

A logbook, not a health app

The rule every feature is checked against: everything the app displays is either something the user typed, or plain arithmetic over what they typed. Averages and a trend line are allowed. A "normal: 120/80" is not, because that number came from the app rather than the user.

So Withy has no colour-coded risk zones, no "high" or "stage 2" labels, no alerts that fire because of a value, and no example numbers placed in empty fields. The entry form's placeholders are the user's own previous reading. When the app gained target bands on its charts, the band had to be one the user types in. The app never suggests or presets one, and nothing changes colour when a reading falls outside it.

This protects the user, it keeps the app clear of Google Play's health-app policies and of personal liability, and it governs the marketing copy too: the store listing sells capacity and convenience, never an interpretation. The Play category is Health & Fitness rather than Medical, on purpose.

The overlay's caption, "Lines rising or falling together doesn't mean one affects the other," is that boundary showing up on screen: the app puts two metrics on one chart, and it declines to say what that means.

Private because there is no path out

"Withy never transmits your health data" is a claim about the code, and it is true by construction. The published build contains no networking code of its own. Its internet permission is there only because Google Play Billing adds it, for the purchase. An early experiment that read blood-pressure cuff displays through a cloud vision service was kept in debug builds only, so none of its code or keys can reach the published app. The privacy policy says exactly where data can go: Android's own backup to the user's Google account, a file the user chooses to share, and a purchase token sent to Google Play. It makes no broader promise than that.

Play's Data safety form reads no data collected or shared, and the privacy policy explains why that holds for an app holding blood-pressure and glucose readings.

Billing that can't cost the user money by mistake

The free tier is a complete logbook for one person. Every metric, all charting, import, and the backup CSV are free, and stay free after a refund. Withy+ adds capacity and output: more than one profile, unlimited PDFs (three are free), the spreadsheet workbook, and the chart splits and overlays, which free users can try on three days.

Google Play refunds a purchase automatically if the app doesn't acknowledge it within three days. That failure happened on the very first real test purchase. Google's service was briefly unavailable, the purchase went through, and the acknowledgement didn't. The design absorbed it: the feature unlocks whether or not the acknowledgement has gone through, and the acknowledgement is retried both in the moment and on every later launch. The purchase logic sits in plain code with no dependency on Android, so both of Play's traps are covered by ordinary unit tests.

A design system shared across a portfolio of apps

Withy is one of three apps in one codebase, and all three share a design system: one theme, one set of colour tokens, and shared cards and buttons. The palette is moss green, ember and rust, in a light scheme and a dark one. An automated contrast check reads the real colour definitions straight out of the source. On its first run it caught a dark-mode error button at 3.85:1, below the 4.5:1 standard, which four separate on-device reviews had missed.

Migrations that protect data

A health log is only worth keeping if an update never loses it. The database has gone through eight schema migrations (version 2 to version 10), and each one is proven against real rows by a test that seeds data in the old schema, migrates it, and checks what comes out. No migration is signed off on reasoning alone. A second test builds a fresh install and a migrated install side by side and fails if they differ.

Backup was verified the same way. Android's cloud backup was run end to end on two real phones (Android 13 and Android 17), each restoring 150 readings identical to the originals. That testing turned up something no code review would have caught: the database file on disk is an empty header, and every reading lives in a second file beside it. A backup rule naming only the database file, which is the obvious tidy-up, would restore an empty log without a single error.

A rename before launch

A trademark search, run before any public release, found the app's original name already registered in the same class, for another app in the same store. The app was renamed Withy on 15 September, three days before the first closed release, while a rename still cost a day's work and a new Play entry. After a public launch it would have cost the listing.

The release path

New personal developer accounts must run a closed test with at least twelve testers, who stay opted in for fourteen continuous days, before Google will consider an application for public release. One dropout restarts the fourteen days for everyone, so the opted-in count is checked daily until the application goes in.

One report, three fixes. A tester said Withy "isn't saving". The reading had in fact saved; the history list was keeping it just out of view. Tracing that turned up two further real bugs: the entry form could keep a stale time after the phone had been set aside, and the date picker could shift a reading by a day in US evening hours. All three were fixed, verified on a phone running the release build, and shipped to testers as 1.0.2 the next day.

The PDF report

The first page of the report a user hands over at an appointment, exported from synthetic sample data:

Numbers

About these screens

Captured on 28 September 2026 from the debug build of 1.0.2 on a Pixel 10 Pro emulator (Android 17), using the app's built-in synthetic sample data, so no real readings appear. The status bar is frozen in demo mode. The paid chart views were unlocked with the debug build's test switch rather than a purchase.

What is not claimed

• Withy is not publicly released. It is on the closed testing track. It has no public install count, ratings or reviews, and there is no download link to give.
• Production access has not been applied for, let alone granted. 8 October 2026 is the earliest date, and only if all twelve testers stay opted in.
• The Play listing's screenshots are older than the app. The listing still shows the 18 September set, so the chart views pictured here aren't on it yet.
• These screens come from a debug build on an emulator, with the paid views unlocked by a test switch rather than a purchase. The layout and features are the same as the release build, but these are not captures of the Play install.
• Nothing here is medical advice or a medical device, and the app says so itself.