[Enhancment LP 1.0] Secure sync between devices

Title: [Enhancment] Secure Cross-Device Data Synchronization

Context & Objective
We need to implement a secure, seamless data synchronization mechanism across devices (Android ↔ iOS, and eventually Web). Since our app provides emotional support and deals with highly sensitive mental health data, ensuring strict privacy, preventing data loss, and maintaining a secure user session are top priorities. The goal is to allow users to switch devices or work in parallel without losing their customized tools and progress.

Scope of Synchronization
The implementation will focus on fully synchronizing the following data points:

User Settings & Personal Info: Data collected from the registration/login form (name, age, gender, emotional interests, preferred language, location, Display settings day/night mode, text size.

Personal Program: All content within the personal program, including emergency contacts and any custom categories created.

"Virtues" List & Gratitude Journal: Both manual entries and selected items.

Alert & Notification Preferences: Preferred times and types of alerts.

Images & Media: Up to 100 images from the "Feel Good" section (requires cloud storage/sync), as well as future additions like favorite reinforcement quotes and YouTube video links.

Technical Requirements

Authentication: Sync must only occur over an authenticated and secure session (e.g., OTP, Email, OAuth, or temporary token).

Sync Mechanism: We prefer an "On-Demand/Access" approach (sync triggers automatically upon app launch) or "Real-time" (e.g., Firebase Realtime DB / WebSockets). We want to avoid a manual "Sync Now" button.

Offline Support: The app must fully function offline and automatically queue changes to sync upon reconnection.

Conflict Resolution: A robust mechanism is required for version conflicts (e.g., resolving by the latest timestamp, or prompting the user to choose the preferred version).

Storage: Cloud storage for files (images, media) must be highly secure and encrypted.

Security & Privacy (Critical)

The architecture must fully comply with GDPR and the Israeli Privacy Protection Law.

End-to-End (E2E) Encryption is highly recommended due to the extremely sensitive nature of the user-generated content.

Action Items & Open Questions

[ ] Tech Team: Propose the best architecture/database for real-time vs. on-access sync and offline support (including cloud storage for media).

[ ] Legal/Steering Committee: Verify data privacy compliance with the NGO's lawyer and define the exact data layers and encryption standards required.