Privacy Policy

Eir — Personal Health Sync · Effective 26 July 2026

Summary. This application has exactly one user: its owner. It reads the owner's own Oura Ring data into the owner's own private records on the owner's own computer. No other person's data is ever processed. Nothing is shared with anyone, sold, or used to train any model.

1. Who this covers

This application is a private, single-user integration operated by Manuel Zamora (Downshift LLC, Lima, Peru). It is not offered to the public and has no other users. It cannot be signed up for, purchased, or connected to by any third party.

2. What data is accessed

Only data belonging to the account owner, retrieved from the Oura API with the owner's explicit authorization, limited to the scopes the owner grants:

Sleep summaries and detail (duration, efficiency, stages)
Heart-rate variability and resting heart rate
Daily readiness, including body-temperature deviation
Daily activity, including step counts
Stress, SpO2, and cardiovascular metrics where enabled
Tags authored by the owner
Basic account information (name, email) as returned by the personal-info endpoint

3. Why

The owner is tracking a metabolic condition with an endocrinologist. Laboratory panels occur a few times a year; ring data is nightly. The application records ring data alongside the owner's clinical results so trends between blood draws are visible to the owner and, at the owner's discretion, to the owner's physicians.

4. Where the data goes

Stored locally on the owner's personal computer, in the owner's private records. Not on any public or internet-reachable server.
Credentials are encrypted at rest (GPG, AES-256) and are never transmitted anywhere except to Oura for authentication.
No third parties. No analytics, no advertising, no trackers, no data brokers, no cloud sync, no aggregators.
No sale, rental, licensing, or redistribution of the data, ever.

5. Machine learning

Data obtained through the Oura API is never used to train, fine-tune, develop, improve, or evaluate any artificial-intelligence or machine-learning model, and is never incorporated into any training, evaluation, or benchmark dataset. This holds regardless of technique and regardless of who operates the model.

6. Retention and deletion

Data is retained locally for as long as the owner finds it clinically useful, and is deleted at the owner's discretion. Because the owner is the only data subject, any deletion or access request is self-executing and immediate. Revoking the application's authorization in Oura account settings ends all further access at once.

7. Security

OAuth 2.0; no password is ever handled by this application.
Access and refresh tokens encrypted at rest with a passphrase-protected key.
All API traffic over HTTPS.
Full-disk encryption and access control on the host machine.

No system is perfectly secure. Because the data never leaves one personal machine and is never exposed to any network service, the attack surface is limited to that machine.

8. Children

Not directed to anyone under 18. The sole user is an adult.

9. Changes

Any change is published on this page with a revised effective date. As the sole user is also the operator, changes take effect on publication.

10. Contact

[email protected]
Downshift LLC · Lima, Peru