Privacy Policy

What the App Does With Your Data

OuraSync reads health metrics (resting heart rate, heart rate variability, blood oxygen, body temperature, and VO₂ Max) from your Oura account using Oura's official API, and writes them to Apple Health on your device. All processing happens on your iPhone.

• Health data flows directly: Oura's servers → your iPhone → Apple Health. It is never sent to Steelheart Labs or any third party.
• A local sync history (which values were written, when) is stored on your device only, and is excluded from device backups.
• The app never stores your health information in iCloud.
• Your health data is never used for advertising or marketing, and is never sold or shared. We don't have it to sell.

Sign-In and Tokens

You sign in with your Oura account using OAuth. Your Oura password is never seen by the app. To complete sign-in, a minimal token service operated by Steelheart Labs exchanges and refreshes OAuth tokens with Oura. Only authentication tokens transit this service — never health data. The service is stateless: it stores nothing and does not log token contents. Tokens are kept in your device's Keychain.

Diagnostics We Collect

So we can find and fix crashes and sync failures across devices, the app sends anonymous crash and performance diagnostics to Sentry (Functional Software, Inc.), our diagnostics processor. These reports contain stack traces, device model, OS version, and app version — they are engineered to never contain your health values, your Oura tokens, or your identity, and are not linked to you. You can turn crash reporting off anytime in Settings → Privacy.

What We Never Collect

• Your health data — it is never transmitted to us or any analytics service, ever
• No advertising identifiers or cross-app tracking
• No user accounts — there is nothing to register
• No contacts, location, photos, or any other device data

Purchases

Subscriptions are billed entirely by Apple — we never receive your payment details. We use RevenueCat (RevenueCat, Inc.) to manage subscription status and understand aggregate metrics like trial conversion and renewals. RevenueCat receives an anonymous app-generated identifier and transaction records — never your name, email, or any health data.

Support and Problem Reports

If you choose to contact support, you can attach a problem report generated by the app. It contains your local sync history and device diagnostic logs. It is created and shared only when you explicitly export it, and you can review its contents before sending.

Your Controls

• Permissions: you control the app's Apple Health access in Settings → Health, and Oura access at cloud.ouraring.com.
• Delete written data: the app includes a purge tool that removes everything it ever wrote to Apple Health — per metric or all of it.
• Sign out: removes all tokens from your device.
• Delete the app: removes all local data. Data already written to Apple Health remains yours, under your control in the Health app.

Children

OuraSync is not directed at children under 13, and we do not knowingly collect personal information from anyone — including children.

Changes

If this policy changes, the updated version will be posted here with a new effective date. Any material change to what we collect would be prominently disclosed in the app before taking effect. The health-data commitment is not subject to change: it is how the product is built.

Contact

Questions: [email protected]