Kintsugi — a private wellbeing and recovery companion
A private wellbeing and recovery companion — recovery, ADHD, mood and daily life in one app. Web and mobile, EU-hosted, no adverts and no tracking.


Kintsugi is a wellbeing and productivity app for the unglamorous work of putting things back together. It takes recovery, ADHD, mood, grief, learning and everyday admin — the things people usually juggle across five apps that know nothing about each other — and holds them in one place, so the craving tool and the planner are part of the same day rather than separate errands.
Visit: kintsugiwellbeing.com
The challenge
Build something genuinely useful on a bad day, not just a good one — and do it while handling special-category health data to a standard that stands up to scrutiny. Two constraints shaped everything: nothing that helps someone in difficulty may sit behind a paywall, and the counter does not reset to zero because someone had a hard week.
What we built
- Planner, journal, calendar and routines for the ordinary run of a day
- Recovery tooling — a sober journey that counts forward rather than punishing a lapse, plus crisis routes that are always one tap away
- Bodyweight training from first-week beginner upwards, every movement with an easier version
- Food and diet logging with the numbers off by default and switched on only if wanted
- Insights that build a picture quietly over months, without asking anyone to score themselves daily
- A find-help directory for the moment someone needs a person rather than an app
Handling special-category data
Health data is Article 9 data under UK GDPR, so the privacy work is architecture rather than policy. Access decisions are audited — grants and denials, because a denial that leaves no trace cannot be reviewed. Erasure is a soft-delete followed by an audited hard-delete, so a deletion request is evidenced rather than asserted. Data minimisation is a design constraint applied before a field is added, not a clean-up afterwards. The application is hosted in Frankfurt so the data stays in the EU.
There are no adverts and no tracking. That is a product decision with an engineering consequence: there is no analytics pipeline quietly accumulating behavioural data about people at their most vulnerable.
Technology stack
- Backend: Node.js, Express, Knex migrations, Socket.IO for live updates
- Database: PostgreSQL 18
- Auth: Firebase Authentication with server-side verification
- Validation and hardening: Zod schemas, Helmet, rate limiting on every public route
- Clients: responsive web app plus iOS and Android
- Hosting: Render, Frankfurt region — EU data residency by placement, not by promise
- CI/CD: Bitbucket with deploy on commit
Screens from the project




















Want to talk about something similar?
We would be glad to share honest, senior advice on your project.
Get in touch