1. Overview
oRing is an independent wellness application that helps authorized users view and understand data from their own Oura accounts. This Privacy Policy explains the public website, OAuth connection and connected dashboard.
2. Information the public website processes
Like most internet services, the infrastructure provider may process limited technical information needed to deliver and secure the website, such as IP address, request time, requested URL, browser information and security events. Connected features also use essential, secure cookies to maintain the OAuth authorization state and signed-in session. oRing does not use this information to build advertising profiles.
3. Oura data and OAuth authorization
oRing accesses Oura data only after the user completes Oura's OAuth2 authorization flow. Users can choose the available permissions on Oura's consent screen. The current dashboard requests the personal and daily scopes needed to show recent wellness scores.
Depending on the permissions a user grants, relevant categories may include:
- Email and personal profile information
- Daily sleep, activity and readiness summaries
- Detailed sleep, heart rate, workout, session, tag and SpO2 data
- Stress, resilience, cardiovascular age, VO2 max and ring device data when available
4. Storage and live data access
OAuth access and refresh tokens are stored server-side in Cloudflare Workers KV and are associated with a random session identifier held in a secure, HttpOnly cookie. Oura health data is fetched on demand for the connected Dashboard and is not retained as a separate health record in the current direct-access mode.
5. How information is used
Authorized information will be used only to provide the wellness views, trends and features requested by the user, maintain the security and reliability of the service, and respond to support or privacy requests. Personal and health data will not be sold, rented, used for targeted advertising, or used to determine eligibility for insurance, employment, credit or lending.
6. AI-assisted features
Current analysis is generated by deterministic calculations inside oRing. No Oura data is presently sent to an AI provider, and Oura data is not used to train, evaluate or improve an AI model. Any future AI feature would require a separate compliance review, a compatible Oura-approved access method and an updated policy before activation.
7. Legal basis and consent
Where applicable law requires a legal basis, oRing will process connected account data based on the user's explicit authorization and the need to provide requested services. A user may withdraw authorization at any time by revoking the application in Oura or contacting us.
8. Data sharing
Cloudflare processes session tokens and technical requests as the hosting and security provider. Oura supplies authorized account data. Information may also be disclosed when required by law or necessary to protect users, the service or others from fraud, abuse or security threats.
9. Retention and deletion
OAuth sessions expire after no more than 30 days unless refreshed through continued use. Disconnecting from the dashboard removes the server-side session and requests token revocation from Oura. Users may also request deletion by emailing oring@thuongtin.com; any retained application data is scheduled for deletion within 72 hours of a verified request.
10. Security
oRing uses HTTPS, server-side OAuth token storage, secure HttpOnly cookies and anti-forgery state validation. OAuth credentials and tokens are not exposed in browser code. No method of transmission or storage is completely secure, so absolute security cannot be guaranteed.
11. User choices and rights
Depending on location, users may have rights to access, correct, delete, restrict or receive a copy of personal information. Users may also revoke Oura access independently. To exercise a right, email oring@thuongtin.com.
12. Children
oRing is not directed to children under 13 and does not knowingly collect their personal information. If local law sets a higher minimum age for independent consent, that higher age applies.
13. International processing
Service providers may process technical or application data in countries other than the user's country. Where required, oRing will use appropriate safeguards for international transfers.
14. Changes to this policy
This policy may be updated as oRing develops. Material changes will be reflected by a new effective date and, when appropriate, an additional notice before changed practices take effect.
15. Contact
Questions, privacy requests and data deletion requests can be sent to oring@thuongtin.com.