Privacy Policy

Last updated: August 3, 2026

OpnFit ("OpnFit", "we", "the app") is an open-source dashboard that displays the health and fitness data already stored in your Google account and lets you chat with an AI coach about it. This Privacy Policy explains what data OpnFit accesses, how it is used, and what it does not do.

OpnFit is designed to be stateless: it has no database, and your health data is never saved on our servers.

1. The short version

• We only ever read your Google Health data. OpnFit requests read-only scopes and cannot add, change, or delete anything in your Google account.
• Your health data flows directly from Google to your browser. It is displayed to you and, when you use the AI coach, the relevant numbers are sent to a third-party AI provider to generate an answer.
• Nothing is stored on our servers. There is no database.
• Your sign-in lives in an encrypted cookie in your browser. Your chat history lives in your own browser's local storage.
• You can revoke access at any time from your Google account settings.

2. What data we access

When you sign in with Google, you grant OpnFit read-only access to the following categories of Google Health data, via Google's official API:

• Activity and fitness (steps, workouts, calories, distance)
• Health metrics and measurements (heart rate, HRV, SpO₂, weight, glucose, ECG)
• Sleep data
• Nutrition data
• Your Google Health profile and connected-device settings
• Your basic Google account info (name, email, profile picture) used only to show who is signed in

You can see the exact permissions on Google's consent screen before you approve them, and revoke them at any time.

3. How we use it

We use this data for one purpose only: to show it back to you and to let the in-app AI coach discuss your actual numbers. Specifically:

• Dashboard — your metrics are fetched live from Google and rendered in your browser each time you open or refresh the app.
• AI coach — when you ask the coach a question, the relevant metrics are sent as part of the request so the answer can reference your real data.

We do not use your data to:

• build a profile of you,
• show you advertising or perform retargeting,
• determine creditworthiness or similar,
• train a machine-learning model, or
• sell, rent, or share it with data brokers or anyone else for their own use.

4. Where your data is stored (and where it isn't)

• Our servers store nothing. OpnFit has no database and writes no logs of your health data.
• Your sign-in session (the Google access/refresh tokens needed to fetch your data) is kept in an encrypted session cookie that lives only in your browser. This cookie is strictly necessary for the app to function.
• Your chat history with the AI coach is stored only in your own browser's local storage — it never leaves your device unless you send a message (at which point that message and the relevant metrics go to the AI provider to produce a reply).

Because nothing is persisted server-side, clearing your cookies and browser storage removes your OpnFit session and chat history entirely.

5. Third-party services your data touches

OpnFit is a conduit between you and two third-party services:

When you use the AI coach, the numbers it needs to answer (for example your recent sleep or heart-rate figures) are transmitted to the AI provider. Please only use the coach if you are comfortable with that. Google's own services are governed by the Google Privacy Policy; the AI provider's handling of requests is governed by its own terms.

OpnFit's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: data is used only to provide the user-facing features you see, is not transferred to third parties for advertising or any unrelated purpose, and is not read by humans.

6. Your rights and choices

• Revoke access anytime — from your Google account permissions page. Once revoked, OpnFit can no longer read your data.
• Delete your local data — sign out, then clear your browser's cookies and site storage for this site.
• Stop using the AI coach — the dashboard works without it; only the coach feature sends metrics to the AI provider.

Depending on where you live, you may have additional rights (access, correction, deletion, portability) under laws such as the GDPR or CCPA. Because OpnFit stores nothing about you on its servers, the most direct way to exercise these rights is through your own Google account and your browser.

7. Security

Communication between your browser, Google, and the AI provider happens over encrypted (HTTPS) connections. Your session token is stored in an encrypted, http-only cookie. Since no copy of your health data is kept server-side, there is no server database of health records to breach.

8. Children

OpnFit relies on Google sign-in and is intended for users who meet Google's own age requirements. It is not directed at children under 13, and we do not knowingly collect their data.

9. Changes to this policy

If we change how OpnFit accesses, uses, or shares your data, we will update this page and, where required, ask for your consent again before the change takes effect.

10. Contact

OpnFit is open source. For privacy questions, requests, or concerns, open an issue on the project's GitHub repository: github.com/jermorin/opnfit.com