Privacy Policy

• I never see your health data. It is never written to a server I control.
• Your Oura data is cached in your own browser, and you can wipe it at any time.
• There are no accounts, no profiles, and no advertising. Nothing is sold.
• The only data about you that reaches my server is your encrypted Oura session cookie, plus ordinary hosting logs.

Ring Pulse is a personal project by Keegan Donley, running at ringpulse.app. It is not affiliated with, endorsed by, or operated by Oura Health Oy. Questions go to kd@keegandonley.com.

Ring Pulse stores four things. Three of them live in your browser, on your device.

• The oura_session cookie holds the access and refresh tokens Oura issues when you connect, encrypted with AES-256-GCM. The cookie is httpOnly, secure, and sameSite=lax, so JavaScript cannot read it. It travels with your requests so that the server can call Oura on your behalf. No copy of it goes into a database.
• The oura_oauth_state cookie exists only during the sign-in handshake, where it protects against cross-site request forgery. It is discarded once the handshake finishes.
• IndexedDB holds your cached Oura data: sleep, readiness, activity, SpO2, stress, resilience, cardiovascular age, VO2 max, workouts, heart rate, and tags, plus the personal info Oura returns for your account, which includes your email address, age, height, weight, and biological sex. Caching it locally is what makes the app fast and lets it work offline. None of it leaves your device.
• localStorage holds your light or dark theme choice, and the metadata for the day’s backdrop photo.

Requests to Oura are proxied through Ring Pulse’s server. Your tokens and my Oura client secret must never be exposed to the browser, so the server attaches them, calls Oura’s API, and passes the response straight back to your browser, which caches it locally.

Your health data sits in memory for the moment it takes to forward that response. It is never logged or written to disk.

• Oura is the source of your data. Your use of Oura is governed by Oura’s privacy policy. You can revoke Ring Pulse’s access from your Oura account at any time.
• Vercel hosts the app. Like any web host, Vercel processes request logs containing your IP address, user agent, and the URLs you request. Ring Pulse also uses Vercel Web Analytics, which counts page views and anonymous product usage without cookies; Vercel derives a temporary anonymous hash rather than tracking you across sites. See Vercel’s privacy policy.
• Unsplash serves the daily backdrop photo. Your browser loads it directly from images.unsplash.com, so Unsplash can see your IP address and user agent when the image loads. See Unsplash’s privacy policy.

There are no advertising networks and no third-party trackers. Your health data is never shared with any of the parties above.

Your session cookie lasts until it expires or until you disconnect, whichever comes first. Disconnecting deletes it. Your cached health data stays in your browser until you clear it, either from the Data page in the app or by clearing site data in your browser. There is no server-side copy, so deleting it locally deletes it.

• Disconnect from the Data page to drop your session and delete the cookie.
• Clear individual caches, or wipe all local data, from the Data page.
• Revoke Ring Pulse’s access entirely from your Oura account settings.

I hold no personal data about you, so a request to access, export, or delete your account has nothing to act on. The controls above cover everything the app keeps. If you have statutory data rights and something here is unclear, email me.

Ring Pulse isn’t directed at children under 13, and I don’t knowingly process their data.

If this policy changes in a way that affects what happens to your data, I’ll update the date at the top of this page. Material changes appear here before they take effect.

kd@keegandonley.com