Skeleton Key

Inspiration

Your sleep and health data is some of the most personal data you generate, and a lot of it is locked away. We kept hitting the same wall: the apps and devices that record your heart, your breathing, your sleep stages will happily show you a dashboard, but try to get the raw numbers out and you find no export button, no API, or a proprietary binary file that only the vendor's software can read.

What it does

Skeleton Key pulls your health data into one open folder (plain CSV, one normalized shape) from three kinds of sources, hardest to easiest:

Keyed apps (the novel core). For an app with no export button and no public API — we used RISE, a sleep tracker — Skeleton Key talks to the app's own backend the way the app does, authenticates as you, and pulls your own data. No emulator at runtime, no vendor software.
Raw files — "Lockpick". Given an undocumented binary biosignal recording, Lockpick figures out how to read it from the bytes alone. It infers the five unknowns — where the header ends, the sample type (int16/int24/int32/float32, signed/unsigned, little/big-endian), how many channels are interleaved, and the sample rate — by searching for the interpretation under which the decoded data looks like real ECG, EEG, and breathing instead of noise.
Exports. Apps that do export (Apple Health, Fitbit) are imported directly.

Accomplishments that we're proud of

It runs on real data, not mock-ups. We pulled a real RISE account and imported a real 177 MB Apple Health export, unified them, and rendered them together with ZERO synthetic data anywhere.
The physiology-guided decoder fully works. Lockpick recovers header length, type, endianness, and channel count from the bytes alone on freshly randomized formats it has never seen, with ground truth it never reads.
We reached an app that has no export at all and got the user's own data out through the app's own backend, the thing off-the-shelf aggregators can't do.
One open format, one coherent product three very different extraction methods collapse into the same CSV and the same view.

What's next for Skeleton Key

Make it a real app, end to end: connect a source and watch it import / pull / unlock live, from an empty state, not just a results dashboard.
Grow the key registry: more keyed apps (Sleep Number, and others with no export), so keying an app once helps everyone who uses it.
Harden Lockpick toward real vendor formats: per-record framing, timestamps, checksums, channel-type labeling, and emitting a reusable format spec instead of a one-off decode.
More importers for the cooperating apps (Oura, Whoop, Garmin) so the open folder is genuinely all-of-your-data.
Keep it yours: everything local by default, personal-use data access only, with each session and key deletable.