Privacy policy

Effective 22 October 2026 · Applies to the website wristvitals.com, the WristVitals Android app and WristVitals Cloud (cloud.wristvitals.com)

1. Who is responsible

WristVitals is a personal open-source project. The controller for the website and for WristVitals Cloud is Igor Kuz, an individual located in California, USA, not a company. You can reach me at info@wristvitals.com for anything in this policy, including privacy requests.

"We", "us" and "our" below mean the operator. "You" means a person using the website, the app or WristVitals Cloud.

2. What this policy covers

• The website at wristvitals.com, including the download folder and the contact form.
• The WristVitals Android app, which runs on your phone and talks to your Withings watch.
• WristVitals Cloud at cloud.wristvitals.com, the hosted edition of the WristVitals server with its web dashboard.

Self-hosted servers are not covered. The server software is free and anyone can run it. If you use a WristVitals server run by a family member, a friend or an organisation, that person or organisation is responsible for it. The software behaves as described in sections 5 and 6, but what the operator logs, backs up or keeps is their decision. Ask them.

3. The website

wristvitals.com is a static site. It sets no cookies, loads nothing from third parties (the typefaces are served from the site itself), runs no analytics and contains no tracking pixels. The one thing the front page fetches is a small file on this site, /download/latest.json, to show the current app version.

Web server logs. Like any web server, ours may keep a standard access log (your IP address, the time, the page or file requested and the browser's identification string) to diagnose problems and spot abuse. These logs are not used for anything else and are deleted after no more than 30 days.

Contact form. When you use the form on the contact page, your browser sends your name, email address, chosen topic and message to WristVitals Cloud, which turns it into an email to us and does not store the message. Your IP address is used only to limit how many messages one address can send per hour and is kept in memory, not written anywhere. The email then lives in our mailbox for as long as needed to answer you and keep a record of the exchange. You can always write to info@wristvitals.com directly instead.

Downloads. Downloading the app is an ordinary file download; the only record is the access log above.

4. The Android app

The app is designed to work without any network connection. Everything it records from your watch and everything you enter is stored in an encrypted database on your phone, protected by the Android Keystore. No account is needed, and the app never contacts Withings.

The app makes a network connection only in the situations below. Each one is off until you turn it on, except the connection to a server you have deliberately linked.

Notification access. If you turn on notifications on the watch, the app reads the phone's notifications (calls, messages, the apps you pick) to forward them to the watch over Bluetooth. They are not stored and never leave the phone except to the watch. You can also forward titles only, without content.

Location. GPS is used for walks you start, and Android requires the location permission to scan for Bluetooth devices on some versions. Routes are stored on the phone and, if you link a server, uploaded encrypted like everything else.

Crash logs. If the app crashes, the stack trace is kept in a file on your phone so that the Diagnostics screen can show it. It is not sent anywhere unless you choose to share it with us.

Backups. Backups you create are encrypted files that you keep and move yourself. CSV, PDF and GPX exports are plain files you create on purpose.

5. WristVitals Cloud

WristVitals Cloud is the hosted edition of the WristVitals server, for people who cannot run their own. It is zero-knowledge by design: health data is encrypted on your phone (and in your browser) with keys derived from a master key that we never receive, and the server stores and relays ciphertext. The encryption is documented in docs/crypto.md in the source code, and the service runs the published source.

What we store for an account

What we do not store

• Your health readings, in any form we can read.
• Your master key, recovery key or category keys. The dashboard holds the key in your browser's memory (and, if you tick "keep unlocked", in this tab's session storage until you close it). It is never sent to the server.
• Your email address. Accounts have no email address; the contact form and doctor visit emails use an address once and do not keep it.
• IP addresses in the database or in logs. The server writes no access log; it logs errors without identifiers. IP addresses are used only for rate limiting and live in the server's memory until it restarts.
• Analytics, usage statistics, device fingerprints or advertising identifiers.

6. What we can and cannot see, honestly

Encryption hides the content of your data, not its shape. Here is what the metadata could tell someone with access to our database:

• That you use the service, under the username you chose (so choose one that does not identify you if that matters).
• Which days you wore the watch and synced: a blob exists for "heart" on a given day, updated at a given time. The size of a day's blob roughly reflects how much was recorded that day.
• When you took single measurements: an ECG or SpO2 spot check is one blob whose bucket is its time, so we can see when you recorded an ECG, not what it showed.
• That you created a report or visit link and when it was opened, and which categories a visit covers.
• Whom you share with and which categories.
• When alerts were sent to a caregiver, not what they said.

We do not analyse this metadata, build profiles from it, or share it. It exists because the server needs it to route and serve your ciphertext. We wanted you to know it exists.

7. Email we send

Accounts have no email address and we send no newsletters. We send email in exactly two cases:

• Doctor visit links, when you ask the app to email a link to a doctor through our server. The email contains the link and instructions, never the code that unlocks it. The doctor's address is used for that one email and is not stored; we keep only the fact that an email went out. You can instead send the link from your own email app. At most ten such emails per account per day.
• Contact form messages to ourselves, as described in section 3.

These emails go through an email delivery provider (section 10), which sees the recipient address and the message, as any email provider does.

8. Legal bases (GDPR)

If you are in the European Economic Area, the United Kingdom or another place with similar law, we process data on these bases:

• Performance of a contract (Art. 6(1)(b) GDPR): keeping your account, storing and serving your encrypted blobs, sharing, report and visit links, push wake-ups. The contract is the terms of service.
• Explicit consent for health data (Art. 9(2)(a) GDPR): the blobs you upload are data concerning health, a special category, even though we cannot read them. By linking the app to WristVitals Cloud you explicitly consent to our storing them in encrypted form. You withdraw that consent by deleting your account, which removes the data immediately.
• Legitimate interests (Art. 6(1)(f) GDPR): rate limiting, abuse prevention, keeping the service secure and available, short-lived web server logs, and answering your messages. We have weighed these against your interests; they involve no profiling and minimal data.
• Legal obligations (Art. 6(1)(c) GDPR), where a law requires us to keep or hand over something. We have no such obligation we know of today, and we can hand over only what we hold: ciphertext and the metadata above.

9. How long we keep things

• Encrypted blobs: until you delete them, replace them or delete your account.
• Your account and everything attached to it: deleted immediately when you delete the account from the dashboard's Account page. There is no grace period and no copy kept, other than in backups that age out (below).
• Sessions, link codes, invites and report links: removed within 10 minutes of expiring (sessions last 30 days; report links 1 hour to 30 days as you chose; invites 7 days; link codes minutes).
• Doctor visit links: deleted 30 days after the visit ended or expired.
• Commands: 30 days after they expire. Account events: one year.
• Backups: encrypted backups of the database are kept for 14 days, plus one monthly backup for 12 months. They contain the same ciphertext and metadata as the database; without your recovery key they cannot be read, by us or anyone else. Deleted accounts therefore disappear from backups as those age out.
• Web server logs: at most 30 days. Contact emails: as long as needed to deal with your request.

10. Who else handles data

We do not sell, rent, share or trade any data. The following parties handle data on our behalf or as a consequence of how the internet works:

• Hosting. WristVitals Cloud runs on servers operated by the operator, in a data centre in Utah, USA. The data centre provides power, space and connectivity; it does not have access to the service's data.
• Backup storage. Encrypted backups are stored on storage in the United States (Utah or California), possibly with an S3-compatible, SFTP or FTPS storage provider. Backups are encrypted (with age) before they leave our server, so a storage provider holds only encrypted files.
• Email delivery. Doctor visit emails and contact form messages are sent through an email delivery provider, which sees the recipient address and the message content as part of delivering it.
• Third parties you choose. Open-Meteo, OpenStreetMap, Google Maps, your webhook endpoints, Health Connect and the recipients of your shares and links receive only what section 4 describes, only when you choose, under their own terms. They are not our processors.

11. International transfers

Our servers are in the United States. If you are outside the US, your data (ciphertext and the metadata described above) is stored and processed there. For people in the EEA, the UK and Switzerland, the United States does not have a general adequacy decision that covers an individual operator, and we cannot offer corporate transfer mechanisms. We rely on your explicit consent to the transfer (Art. 49(1)(a) GDPR), given when you create an account after reading this policy, together with the strongest safeguard we know: the data that is transferred is end-to-end encrypted with keys we never have. If that is not acceptable to you, use the app in phone-only mode or run your own server where you are.

12. Security

• End-to-end encryption: AES-256-GCM per day and per category, with keys derived (HKDF) from a master key generated on your phone or in your browser; sharing and alerts use X25519 sealed boxes; the design is published and has test vectors.
• Passwords are hashed with argon2id; session and device tokens are stored only as SHA-256 hashes; one-time codes are hashed too.
• Report PINs and visit codes are checked by the server without it ever holding the key; five wrong attempts burn the link.
• HTTPS only, with HSTS, a strict Content Security Policy, no third-party scripts, and per-IP rate limits on sign-in, sign-up, links and public endpoints.
• The server runs as a read-only, non-root, minimal container; it keeps no access log.
• Backups are encrypted before they leave the server.
• The source is open, so the security of all of this can be checked by anyone. Security reports: contact page, topic "Security report".

No system is perfectly secure. If we learn of a breach that affects you, we will tell you by the means we have (the dashboard and this site; we have no email address for you) and notify authorities where the law requires it.

13. Your rights

Wherever you are, you can:

• Access and export everything stored for you: Account → Download export in the dashboard gives you a JSON file with every blob (still encrypted, readable with your recovery key) and the metadata. The app exports readable CSV and PDF.
• Delete your account and all its data: Account → Delete account. It is immediate.
• Correct data: readings are corrected or removed in the app, which re-uploads the affected day. Your username and password can be changed on the Account page.
• Take your data elsewhere (portability): the export above, and the app's own export, are in documented formats; another WristVitals server accepts the same blobs.
• Restrict or object to processing, and withdraw consent: stop syncing in the app, or delete the account.
• Complain to a supervisory authority. In the EEA that is the data protection authority of the country where you live; in the UK, the Information Commissioner's Office.

To exercise a right we cannot serve through the dashboard, write to info@wristvitals.com. Because accounts have no email address or name, we will ask you to prove you control the account (for example, by signing in and triggering an account event we can see) before acting on a request about it. We answer within a month.

14. California privacy rights

If you live in California, the California Consumer Privacy Act as amended by the CPRA gives you rights that largely overlap with the ones above. For clarity:

• Right to know. The categories of personal information we collect are listed in sections 3 to 6: identifiers (a username, and an email address only when you write to us), account and device records, encrypted health data we cannot read, and the metadata described in section 6. We collect it from you and your devices, to provide the service, and we disclose it only to the service providers in section 10.
• Right to delete and right to correct: see section 13.
• Right to opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. There is nothing to opt out of.
• Sensitive personal information. Your encrypted health data is sensitive personal information. We use it only to provide the service you asked for (storing and serving it to you and the people you choose) and for nothing else, so no "limit use" right needs exercising.
• Non-discrimination. We will not treat you differently for exercising any of these rights.
• Authorised agents may make requests for you; we will still ask for proof of control of the account. Requests: info@wristvitals.com.

15. Children

WristVitals Cloud is not for people under 16 (under 13 in the United States), and we do not knowingly hold accounts for them. A parent or guardian may wear-manage a child's watch through their own account and the app's family features; the account is the adult's. If you believe a child has created an account, tell us and we will delete it.

16. Changes to this policy

When this policy changes, the new version is published here with a new effective date, and the dashboard's sign-up form links to it. For changes that matter (new data we keep, new recipients, a new legal basis) we will also announce it on the dashboard's sign-in page for at least 30 days before it takes effect. The history of this page is in the source repository.

17. Contact

Igor Kuz · California, USA · info@wristvitals.com · contact form