Vyro shows your Fitbit and Google Health data as a dashboard in your browser. This policy explains what data Vyro accesses, how it is used, and the choices you have. In short: access is read-only, your health data is never stored on our servers, and it is never sold or used for advertising.
Data we access from Google
When you choose “Continue with Google”, you are asked to grant these permissions:
- Basic account identifier (
openid): a stable ID for your Google account, used only to save your dashboard preferences. We do not request your name, email address or profile photo. - Activity and fitness (read-only): steps, distance, floors, calories, Active Zone Minutes and exercise sessions.
- Health metrics and measurements (read-only): heart rate (including minute-by-minute readings), resting heart rate, heart rate variability, breathing rate, skin temperature during sleep, blood oxygen (SpO₂), cardio fitness (VO₂ max) and weight.
- Sleep (read-only): sleep sessions and sleep stages.
Vyro cannot change, add or delete anything in your Google account.
How we use it
Health data is used for one purpose only: to display your own dashboard to you. Each time you open the dashboard, Vyro requests the data from Google, summarizes it in memory, and sends it to your browser. Our servers do not write it to a database, file or log, and it is not used to build profiles, train models, or for advertising. Your browser keeps a copy of your daily history so streaks and insights can cover all of it (see below).
What we store
- Sign-in session: your Google access and refresh tokens are kept in an encrypted, http-only cookie in your browser for up to 90 days, so you stay signed in. Signing out deletes it.
- On your device only: your daily history (steps, sleep, heart-rate and other nightly measures, going back to when your tracker started), derived metrics such as minute-by-minute heart-rate summaries and daily scores, your journal entries and experiments, your labels for untagged workouts, and your birth year and sex if you add them are stored only in your browser. They are never sent to or stored on our servers. Clearing your browser's site data removes them.
- Preferences: your daily step target, weekly Zone Minutes target, nightly sleep need, distance unit and theme. These are saved in your browser and, when you are signed in, in Google Cloud Firestore under your account ID so they follow you across devices.
- Leaderboard (only if you join): a nickname you choose, the country and city you pick from a list, and each week's total steps and Active Zone Minutes. Vyro reads these totals from your tracker data in Google Health (not manual entries) and stores them in Google Cloud Firestore. Other members see an avatar, your nickname partly hidden, and your totals; other members in a city or country only appear once at least 20 people are on that board. Until a board has 20 members it also shows pacers: labelled reference rows that move at a set daily pace from published research and WHO guidance, not people. Nothing else is shared: no heart rate, sleep, weight, name or email. Leave the leaderboard at any time to delete your nickname, place and every weekly total.
- Badges: worked out in your browser from your history. Sharing a badge creates an image on your device; nothing is uploaded unless you post it yourself.
Sharing
We do not sell or rent your data, and we share it with nobody except as follows: if you join the leaderboard, other members see the avatar, partly hidden nickname and weekly totals described above. Data is processed only by the providers needed to run the service: Netlify (hosting) and Google Cloud / Firebase (preferences and leaderboard storage), under their own security and privacy terms. No person reads your data, except where you ask us to, where needed for security, or where the law requires it.
Google API Services User Data Policy
Vyro’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your choices
- Sign out from the dashboard to delete the session cookie.
- Delete saved preferences from the Preferences menu on the dashboard. This removes them from Firestore immediately.
- Revoke access at any time in your Google Account. Vyro then can no longer read any data.
Security
All traffic uses HTTPS. Session cookies are encrypted and inaccessible to page scripts. Firestore is reachable only from Vyro’s server; browsers and other clients are denied all access.
Children
Vyro is not directed at children under 16 and does not knowingly process their data.
Not medical advice
Vyro is not a medical device and does not provide medical advice, diagnosis or treatment.
Changes
If this policy changes, the new version will be posted here with a new “last updated” date.
Contact
Questions or requests about this page: [email protected]