this post was submitted on 07 Mar 2026
300 points (97.2% liked)

Selfhosted

57262 readers
1405 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
 

My wife needed a cycle tracker. Everything out there was either Flo (which got sued twice for sharing health data) or an abandoned GitHub project. So I built Ovumcy. Single Go binary, SQLite, Docker-ready. No analytics, no third-party APIs, no cloud. Your data stays on your server. Features: period tracking, symptom logging, predictions (ovulation, fertile window), statistics, CSV/JSON export, dark mode, Russian and English. Just pushed v0.2.5. Looking for feedback from real users.

top 50 comments
sorted by: hot top controversial new old
[–] Zanathos@lemmy.world 2 points 2 hours ago

Awesome! My wife just had her IUD removed and will probably start tracking again. Will get this set up for her and see if she likes it, will provide feedback if she has any.

[–] edgyspazkid@lemmy.wtf 11 points 7 hours ago* (last edited 7 hours ago) (1 children)

What a chad. I wish I were woman to use your app.

[–] QuandaleDingle@lemmy.world 3 points 7 hours ago

MR PIZZA!?!?!??! O_O

[–] rimu@piefed.social 20 points 9 hours ago (1 children)

I recommend you set the Content-Security-Policy http header so that inline javascript (commonly used for XSS attacks) cannot be executed.

https://web.dev/articles/strict-csp

CSP being off is not exactly a security hole but it makes security holes much more likely. By using a strict CSP configuration you close off the possibility of a whole class of holes.

Also think about setting the Access-Control-Allow-Origin header and enable CORS on your REST endpoints.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin

Again, kind of a pain in the ass but gets rid of a bunch of potential problems before they start.

[–] terraincognita@lemmy.world 2 points 9 hours ago (1 children)

Thanks for the suggestions, those are good points.

CSP is something I plan to tighten over time, but enabling a strict policy right now would require refactoring some inline JS patterns used in the templates. It’s definitely on the roadmap as part of security hardening.

Regarding CORS, the application currently runs as a same-origin server-rendered app rather than a cross-origin API, so CORS headers aren’t enabled by default. If external clients or integrations are added in the future, I’d likely introduce a restricted allowlist for specific API routes.

[–] Pieisawesome@lemmy.dbzer0.com 1 points 57 minutes ago

Your releasing a health data app without doing security hardening?

So much for you saying you take security seriously

[–] terraincognita@lemmy.world 10 points 9 hours ago

I use Android, my wife - iOS. So many things that on F-Droid are simply unavailable to her (yes, I tried to convince her to go to our side). So I searched for living projects with self-hosting idea, did not find one and decided to create one. I have a CS background, though my professional work today is mostly in finance as a senior analyst where I write code to automate and optimize workflows. Ovumcy started as a personal project exploring a self-hosted approach to cycle tracking.

[–] Echolynx@lemmy.zip 3 points 7 hours ago

Unrelated, but I love your username; and boosting for visibility.

[–] qualia@lemmy.world 6 points 10 hours ago (1 children)

I use a period tracker to identify file extensions.

[–] terraincognita@lemmy.world 7 points 9 hours ago

As a non-native speaker, I had to use LLM to get that joke)

[–] julianwgs@discuss.tchncs.de 4 points 9 hours ago (1 children)

Do you know about drip? It as local non-profit cross-platform open source smartphone app and my girlfriend is a happy user for years.

[–] terraincognita@lemmy.world 8 points 9 hours ago (1 children)

It is a greap project, mine is not a replacement, but a little bit different approach. It's a self-hosted web application that you run on infrastructure you control and access from multiple devices. In Drip you can export or import data, but this step is a payment for privacy. Mine offers privacy but from a different perspective.

[–] Magnum@infosec.pub 1 points 6 hours ago (1 children)

So what you're saying is, you added private Cloud storage to it?

[–] terraincognita@lemmy.world 3 points 6 hours ago

No-no, you run your VPS and deploy it there. So you define your storage, it can be homeVPS

[–] OhVenus_Baby@lemmy.ml 24 points 15 hours ago (1 children)

Why not use drip or mensinator? Both FOSS.

[–] terraincognita@lemmy.world 31 points 15 hours ago (2 children)

Ovumcy isn’t trying to replace them. The idea here is to explore a self-hosted, web-based approach that focuses on running the app on infrastructure you control, with simple deployment and cross-device access through the browser.

Different tools optimize for different things. Native apps like Drip or Mensinator are great for fully local tracking, while Ovumcy explores a self-hosted model that can be accessed from multiple devices without relying on a third-party service.

[–] GreenKnight23@lemmy.world 9 points 12 hours ago (2 children)

this is great, especially when our government starts tracking everything we do online.

great forward thinking if that was your intention.

[–] terraincognita@lemmy.world 4 points 9 hours ago

I see that we face it all over the world now.

[–] militaryintelligence@lemmy.world 5 points 11 hours ago* (last edited 11 hours ago)

Yup. You really don't want the maga cult monitoring your cycle. If you stopped menstruating for a bit you must be pregnant. Where is the baby? Omg you murdered the baby by taking Tylenol!

[–] OhVenus_Baby@lemmy.ml 10 points 14 hours ago (1 children)

I see how they differ now. Local vs self hosted. Niche use. But I get your idea especially helpful between partners I suppose. Keep it going! Let's see where it lands in time. Personally I think the name is hard to remember and pronounce correctly which means it might not be super catchy and really take off. My opinion and in no way should deter you. Perhaps tweak the name. Overall though good job and keep going. This not a negative thing I say. Just to trying to help you refine the idea to success. Best of luck!

[–] terraincognita@lemmy.world 6 points 14 hours ago

Appreciate that!

[–] rimu@piefed.social 39 points 16 hours ago (3 children)

I was going to recommend this to someone I know but when I realised your readme.md is entirely AI-generated, I guess the whole project is probably vibe-coded. I can't in good conscience recommend someone trust their health data to a vide-coded app because they tend to have security problems.

Also all ai-generated code is public domain so your AGPL license is kinda empty. Might as well use MIT.

[–] terraincognita@lemmy.world 31 points 16 hours ago (4 children)

I do use AI tools while developing this project, but I also have a BSc in Computer Science. AI is a productivity tool.

Security is something I take seriously, especially since the project deals with health data. All code has test and you're welcome to inspect the repository yourself or point out any specific security concerns if you notice them.

Regarding licensing: the AGPL license applies to the project as a whole regardless of the tools used to write parts of the code.

If you have concrete technical feedback or security issues, I’d genuinely appreciate it.

[–] IanTwenty@piefed.social 5 points 8 hours ago (1 children)

The danger being raised with the licensing is that you can't license something if you're not considered to be the author. There are growing examples of courts and lawmakers determining AI output to be public domain:

The US Supreme Court recently refused to reconsider Thaler v. Perlmutter, in which the plaintiff sought to overturn a lower court decision that he could not copyright an AI-generated image. This is an area of ongoing concern among the defenders of copyleft because many open source projects incorporate some level of AI assistance. It's unclear how much AI involvement in coding would dilute the human contribution to the extent that a court would disallow a copyright claim.

https://www.theregister.com/2026/03/06/ai_kills_software_licensing/

This is an evolving, global situation and hard to know what to do right now. I think what you've got is fine though - you've made it clear your intention is to license with AGPL. It's just that depending on the jurisdiction it might be public domain instead.

This is another reason to be clear about the use of AI in the README so your users can make an informed decision.

[–] terraincognita@lemmy.world 3 points 8 hours ago

I agree, though there is a difference in case you rovided and mine. It is a human-directed work. Thousands of libraries, Kubernetes, Kubernetes still live and license is valid.

[–] sonofearth@lemmy.world 18 points 14 hours ago (9 children)

You should add a disclaimer stating that you have used an LLM. I have done so for a tool I built with an LLM that I needed, because I don’t know jackshit about coding and I am not gonna pretend I do.

[–] chicken@lemmy.dbzer0.com 12 points 7 hours ago* (last edited 7 hours ago)

because I don’t know jackshit about coding and I am not gonna pretend I do.

But if OP does know and applies that knowledge to what they are doing, it's not the same thing and doesn't make sense to have the same disclaimer.

[–] terraincognita@lemmy.world 4 points 14 hours ago

Partially agree, but I do know how to code and use it as a tool.

load more comments (7 replies)
[–] militaryintelligence@lemmy.world 1 points 11 hours ago (2 children)

How does AI help with productivity? I've gotten so many false answers that I quit trusting it

[–] prenatal_confusion@feddit.org 7 points 10 hours ago

Imagine you are on the ground under your car and need a different tool. You ask for it and somebody hands it to you. That person is young and inexperienced. It is up to You to check if it's the right tool, and if not pass it back (and in this example tell the person about the error and help them correct it).

And sure, You can always crawl out and get the tool yourself and sometimes that is the only option and in coding terms in my opinion best practice. But you can be faster with your helper. Use it appropriately and see how it affects your work. And that's the point, your work. Don't pass responsibility or thought off to AI.

[–] moriquende@lemmy.world 4 points 9 hours ago

Because it's able to write boilerplate faster than a human. And because it's able to perform refactorings that are not possible with IDEs or regex due to their lack of structure. Also because you can ask it to review your files and it does find bugs that would otherwise be missed at first. There's a huge difference between vibe-coded slop and using the tools available to you effectively.

load more comments (1 replies)
[–] mortalic@lemmy.world 5 points 11 hours ago (1 children)

Thanks for doing this, I was debating doing the same. It needs to exist.

[–] rimu@piefed.social 3 points 9 hours ago (1 children)

F-Droid has Drip, Bluemoon and Periodical.

[–] terraincognita@lemmy.world 2 points 9 hours ago

Yes, I’m aware of those apps. They’re great local-first mobile trackers. Ovumcy explores a slightly different approach - a self-hosted web app that can run on infrastructure you control and be accessed from multiple devices.

[–] CameronDev@programming.dev 6 points 16 hours ago (1 children)

Charitably, it could be an AI readme and hand rolled code, but it definitely is a smell.

[–] rimu@piefed.social 12 points 16 hours ago (4 children)

Yeah there are other signs too. Look at those commit messages, all vague, all perfectly capitalized. All with a nice long description with bullet points.

No one does that in a project they're building for themselves.

[–] EdTheMessenger@lemmy.world 9 points 11 hours ago* (last edited 11 hours ago)

Judging code quality by use of LLM in a documentation and commit messages is weird.

While I write all of my code myself and I'm against vibe coding etc., there is one place where I let a LLM write for me: readmes, commit messages and Javadoc comments.

I know how to write code but at the same time I'm shit at both my native language and even more so at English. So I let Language Models write natural language texts for me and just fix them when necessary. My documentation is more clear, grammatically correct and more detailed than in any of my previous projects, and I can focus on writing code.

And I wouldn't say "No one does that in a project they're building for themselves". I do that for projects that only I will ever see, and OP shared his project with others, so it's great that he included a clear documentation

[–] helix@feddit.org 2 points 10 hours ago

No one does that in a project they’re building for themselves.

Speak for yourself, I always did that and I found it easier with LLMs nowadays.

I hate most AI shite with a passion but when it helps my colleagues write commits which are more than "add stuff", "fix some things" I'm fine with it.

I rarely use AI to generate code, usually only when I need a starting point. It's much easier to unfuck AI code than to stare blankly at a screen for an hour. I'd never commit code I don't fully understand or have read to the last byte.

I hope OP is doing the same. LLMs fail at 90% of coding tasks for me but for the other 10% (mostly writing tests, readmes, boilerplate) it's really OK for productivity.

Ethics of LLMs aside, if you use them for exactly what they're built for – being a supercharged glorified autocomplete – they're cool. As soon as you try to use them for something else like "autocompletion from zero" aka "creativity", they fail spectacularly.

load more comments (1 replies)
[–] Decronym@lemmy.decronym.xyz 7 points 16 hours ago* (last edited 48 minutes ago) (2 children)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
HTTP Hypertext Transfer Protocol, the Web
IP Internet Protocol
LXC Linux Containers
SSH Secure Shell for remote terminal access
VPS Virtual Private Server (opposed to shared hosting)

6 acronyms in this thread; the most compressed thread commented on today has 18 acronyms.

[Thread #140 for this comm, first seen 7th Mar 2026, 01:40] [FAQ] [Full list] [Contact] [Source code]

load more comments (2 replies)
[–] CameronDev@programming.dev 7 points 16 hours ago (3 children)

I did the same thing for my partner. She didn't migrate in the end, and google killed my play store account.

https://bloodyhealth.gitlab.io/ - is also a good option.

Some kind of data import would be nice to have according to my partner, but it might be tricky with all the different apps.

load more comments (3 replies)
[–] Cris_Citrus@piefed.zip 5 points 17 hours ago (2 children)

This is super cool! I'm not afab so I can't help test and my question may be ignorant but I'm curious why one would want this functionality to not be something native and benefits from being hosted at all?

There are some f-droid trackers that look nice (I keep seeing one there with a super pretty ui) but I'm not sure what the tradeoffs of just using a native application for something like this might be

[–] terraincognita@lemmy.world 8 points 16 hours ago

The benefit over a purely local app is mainly cross-device access and easier syncing/backups, while still avoiding a third-party service storing your data.

load more comments (1 replies)
load more comments
view more: next ›