Privacy policy

Updated November 6, 2026. This dashboard is a private application operated by its individual owner for personal tracking. It does not offer public account registration.

Information stored

The application stores records the owner enters or imports, including measurements, nutrition, activity, sleep, recovery, clinical tracking, notes and private photos. If the owner authorizes Oura, it can import the categories the owner permits, including profile and email, daily metrics, heart rate, workouts, tags, sessions, oxygen saturation, heart health and ring information. Availability depends on Oura permissions, device support and account access.

Oura responses and changes are retained with source IDs, original values, units when supplied, timestamps and missing values. Raw responses may contain additional fields provided by Oura. Imported originals and revisions are retained separately from manual records. The dashboard does not sell these records or use advertising analytics.

Access and sharing

Records are protected by the owner's login. An explicitly authorized MCP client, including ChatGPT, can read records within its granted scope. Sending data to that client subjects the received copy to the client's own policies. Photo content requires an explicit request. Oura authorization permits this application to read Oura data; this integration does not write changes to Oura. No health data is sent through business agent mailboxes.

Hosting administrators and infrastructure providers may have technical access to the host and storage. Application logs are suppressed and access logs are disabled in the prepared application process; hosting infrastructure has separate configuration. Sharing a server does not provide physical isolation from other services. No regulatory certification is claimed.

Credentials and cookies

The application uses essential login, CSRF and authorization cookies. Oura access and refresh tokens are encrypted in the database, with a separate key file. Token encryption does not mean the entire live health database is encrypted. The provided backup tooling encrypts backups when configured and run. No recurring backup or synchronization schedule is enabled by default.

Retention and control

Imported Oura history and revisions remain until the owner deliberately removes them through storage administration. The interface currently provides export and local disconnection, not deletion of Oura history. Disconnecting removes local tokens and pending authorization state but preserves imported records. Revoke the application in Oura to remove the provider grant too. Previously exported files, client copies and backups require separate handling.

Measurement and summary deletion retains audit history and tombstones. Photo deletion removes local image files; older backups may retain them. Exports contain sensitive data and are not encrypted. They should be stored privately.

Questions and changes

The individual owner administers this private instance, including access, data removal and backup retention. There is no public support or third party account service. This policy must be reviewed before offering access to other people or changing how data is used.