Introduction
Move / Eat / Count (the everyday app)
Useful in plain sight.
Private when needed.
Keep sensitive records private
Familiar first. Control throughout.
One file. Five words.
Fast to leave. Help within reach.
Tamper-evident, not tamper-proof
Built for what comes next
A fitness app. And a safe place.

Shake

A fitness app on the outside. A private place to tell the truth on the inside.

Cox Sponsored: Social Good | Side challenge: Shock Tracker: Zero Data

Why we built this

Domestic violence is usually described in numbers, and the numbers are huge. The CDC's national survey found that 1 in 4 women and about 1 in 7 men have experienced severe physical violence from an intimate partner in their lifetime. It also found that more than 12 million women and men a year experience rape, physical violence or stalking by a partner (CDC NISVS, 2010 data).

We started this project in October, which is Domestic Violence Awareness Month. We kept coming back to the same question: behind each of those numbers is a person who has been told, again and again, to document everything. Dates. Photos. Threats. Recordings. That advice can decide a protective order, a custody case or a prosecution.

But there's a part that doesn't get said enough. For many survivors, the phone is not a safe place to keep that evidence. In a 2014 survey of more than 750 U.S. victim-service agencies, 72% said abusers had tracked survivors through smartphones or other devices, and 75% said abusers had accessed survivors' accounts, like email and social media (NNEDV). A notes app can be opened. A camera roll can be scrolled. A cloud account can be logged into by anyone who knows the password.

So the act of collecting proof of abuse can be the very thing that puts someone in more danger. We couldn't stop thinking about that, and it's why Shake exists.

What Shake is

On the surface, Shake is the most ordinary app you could imagine. It's a fitness tracker. It counts your steps, logs your meals, tracks your workouts, and gives you a tip of the day. It works offline, it needs no sign-up, and it asks you for nothing. If someone picked up the phone and opened it, they would see exactly that and nothing more.

Then comes the part we're proudest of. Open the Help page and ask a question. If you type your private phrase, the fitness app quietly becomes something else: an encrypted, tamper-evident evidence journal that lives only on that phone. If you type anything else, including your decoy phrase, you get ordinary help-search results, such as "Articles that might help" or "No matching articles." Nothing gives it away.

If you need to leave in a hurry, you shake the phone. The journal locks and you're back on the fitness Dashboard.

It was a fitness app all along. It's also a safe place to keep the truth.

How Shake is different from other apps for victims

We looked hard at how apps for survivors tend to fail, and we built Shake around four of those failures.

The usual problem	What Shake does instead
The app looks like a safety app, so finding it is a warning sign	It is a real fitness app. Nothing on screen mentions the journal, and even setup is invisible
Data lives on a server or behind an account, where it can be found, hacked or demanded	No accounts, no servers, no tracking. Everything stays on the phone
Entries can be edited or deleted, so the record can be challenged or destroyed	No edit, no delete. Every entry is hash-chained, so any change is detected
Evidence is trapped on one device	An encrypted backup plus five random words restores it on a new phone, or can go to a lawyer, with no account or install

Most apps ask a survivor to trust the app. We wanted Shake to work differently, so that nobody else even has to know it's there.

What it does

The everyday app

A real, usable fitness app: Dashboard, workouts, calorie tracker, and a step counter with live walk tracking. Steps and meals reset every day, like a real tracker.
It installs to the home screen like a native app and works offline.

Hiding in plain sight

A believable help center. Wrong phrases, the decoy phrase and random questions all return normal results. Every search takes about a second, so a phone with a journal answers no faster than one without.
Hidden setup. There is no menu item and no settings page. A setup code, shared in person, works only on a phone that has no journal yet. Once one exists, that code is just another search.

The private journal

Notes, pasted messages, photos, audio and video, each timestamped: when it was saved, when a file was recorded, and an optional "when it happened."
No edit and no delete, with a warning before saving.
Tamper-evident: every entry is linked to the one before it with SHA-256. "Verify entries" catches edits, removals and reordering, including of attached files.

Sharing it safely

One encrypted backup file plus a random five-word code. It restores the journal on a new phone, or can go to a lawyer, advocate or trusted friend, who opens it at /#/receive with no account, no install and no upload.
A PDF export with times, hashes and the integrity result.

Fast to leave, help within reach

Shake to exit: about three firm shakes lock the journal and return to the Dashboard. It ignores walking, running and a single drop. It works on the setup screen too.
Auto-lock after 2 minutes idle or when you switch apps.
911, the National DV Hotline (call, or Text START) and the Georgia Statewide hotline are inside the journal, with a note that calls and texts show up in phone records.

How we built it

Shake is a React 19, TypeScript, Vite and Tailwind PWA with no backend at all. The host only delivers the code.

Encryption: your phrase is stretched with Argon2id (WebAssembly) and unwraps a random master key. Entries and files are sealed with AES-GCM (Web Crypto) and stored in IndexedDB. The key lives only in memory while the journal is open.
A decoy you can't tell apart: two fixed-size key slots are saved in random order, so a real journal and a decoy look identical on disk. The app always tries both.
The hash chain: entryHash = SHA-256(id | contentHash | createdAt | prevHash), computed over plaintext so a backup can be restored and re-encrypted without breaking the chain.
Backups: Argon2id from a five-word code (from the 2,048-word BIP39 list) plus AES-GCM, with the file header authenticated. Restore only works into an empty journal, so nothing can be overwritten.
Shake detection: the phone's motion sensor, requiring several sharp hits inside one second. On iPhone, motion permission is asked once, like any fitness app would, and never inside a private screen.
Locking: idle and visibility timers, paused while recording or saving so it never locks mid-write.
Presentation: we built our slide deck in Figma Make.
Testing: Node tests for the crypto and hash chain, Playwright browser flows for setup, lock, backup and restore, simulated iPhone permission rules, and a real iPhone for shake-to-exit.

Challenges we ran into

Our first version gave itself away. It had a "Passwords" section on the Profile page, which would have told any abuser exactly what to look for. We tore it out and rebuilt setup as a code typed into Help, then removed every public mention of the journal.
Speed can be a tell. If a phone with a journal answered a search faster than one without, that difference could leak. So every search takes the same amount of time.
iPhone fought us. Web apps can only read motion after a specific tap, so shake did nothing when someone opened the app and went straight to the journal. We caught it on a real phone and rebuilt how permission is requested, so it's asked once like a fitness app and renewed silently.
Finding honest words. "Cannot be changed" really means the app offers no way to change it. Someone with developer tools, or who clears browser data, can still alter or wipe local storage. We call Shake tamper-evident, not tamper-proof, because people in danger deserve accurate claims.
No escape hatch, on purpose. We left out an in-app "erase everything," so someone forced to hand over their phone can't be made to destroy their own evidence. The tradeoff is that people need to keep an encrypted backup somewhere else.

Accomplishments that we're proud of

Zero accounts, zero servers, zero tracking. Nothing leaves the phone.
A decoy that returns exactly the same results as any random search.
A fitness app people could genuinely use, because a disguise only works if it holds up.
A backup anyone can open on any phone with one file and five words.
Shake-to-exit works on a real iPhone.
We published our own limits, because we think trust comes from honesty.

What we learned

Safety design is mostly about what you leave out. A menu label, a settings toggle, a response 200 milliseconds faster than it should be: any of them can give the app away. We also learned that a survivor's biggest risk often isn't a missing feature. It's the app being found. And we learned to say "we can't promise that" out loud, which mattered more to us than any feature.

Our honest limits:

Clearing browser data loses the journal, so an encrypted backup should be kept elsewhere.
The phone's clock isn't independently verified.
An installed app can still show up in app lists.
The exported PDF and "Download copy" files are not encrypted.
On iPhone, Safari's own "Shake to Undo" popup can appear after a shake. A native wrapper would remove it.
We haven't yet had the design reviewed by domestic violence advocates or legal experts, and whether a court accepts a record varies by jurisdiction.

What's next for Shake

A moving disguise. The home-screen icon will change periodically (weather, calculator, notes) so Shake never becomes familiar or recognizable over time.
On-device transcripts of audio and video, with nothing uploaded.
Silent trusted alerts to a person the survivor chooses, triggered by them and never automatic. We deliberately skipped auto-calling 911 because a false alarm can escalate a dangerous situation.
Verified timestamps, optional and privacy-preserving.
Expert review by domestic violence advocates and legal reviewers before any real-world use, plus a native wrapper for background recording and Apple Health.
Discreet distribution only: through support groups, shelters and health clinics. Never an app store, never an ad.

Shake is a prototype, and we want to be clear about that. Please use fake data when trying it. It is not a substitute for professional help or emergency services. In an emergency, call 911. National DV Hotline: 1-800-799-7233 (text START to 88788).

Shake: small moves, big change.