Last updated: July 4, 2026
This Privacy Policy describes how Case Larsen (“the operator,” “I,” “me”) handles data in connection with a personal application that connects to the Oura Ring API. The application is operated by, and used solely by, the operator for personal purposes.
Who this covers
The application is a single-operator, personal-use tool. The operator is both the developer of the application and the sole user whose data it processes. No data belonging to any other person is collected or processed.
What data is collected
Through the Oura API, and only with the operator’s authorization, the application retrieves a limited set of personal biometric metrics: bedtime and wake time, sleep duration, heart rate variability (HRV), and resting heart rate. Only the specific data needed to populate the operator’s personal weekly-review records is requested (data minimization). No other categories of Oura data are collected.
How data is used
Retrieved metrics are used exclusively to populate the operator’s own personal weekly-review records. The data is not sold, rented, redistributed, or shared with any third party. It is not used for advertising, marketing, or commercial targeting. It is not used to train, fine-tune, develop, improve, or enhance any algorithm, artificial-intelligence model, or machine-learning model.
How data is stored and secured
Data is transmitted from Oura over encrypted HTTPS connections. Access credentials (OAuth tokens) are stored locally on the operator’s own machine and are not committed to source control or shared. Retrieved metrics are stored in the operator’s private, access-controlled personal records. Because this is a personal tool run by one individual, security measures are proportionate to that scale rather than those of a commercial service.
Data retention and deletion
Data is retained only as long as needed for the operator’s personal review, and data no longer needed is deleted. The operator may revoke the application’s access to Oura at any time via Oura’s account settings, and may delete the retrieved metrics from their personal records at any time. Upon a request to opt out, all processing of the affected data ceases immediately; upon a request to delete, all affected data is deleted within seventy-two (72) hours, and no such data is retained after a deletion request.
Your rights
As the sole data subject, the operator has the right to access the collected data, to opt out of data collection, and to delete the data at any time. Because the operator is also the sole user, these rights are self-served; questions may be directed to the contact below.
Contact
Case Larsen — clarsen@gmail.com