Last updated November 4, 2026
Privacy policy
This policy explains how this private, single-owner application handles Google user data and fitness-sync files.
Data the application accesses
The application requests the Google openid and profile scopes
for an account identifier and basic profile information, and the
https://www.googleapis.com/auth/drive.file scope for files created by or
explicitly opened with this application. It does not request general read access to all
files in Google Drive.
How the data is used
Google identity information binds the Drive authorization to the application owner. Drive access is used to create, update, and verify app-managed backup files containing the owner’s current KeyLifts and Garmin-derived sync artifacts. Google user data is not sold or used for advertising or audience measurement.
OAuth callback gateway
This public website receives the temporary authorization response sent by Google. Its server-side callback validates the response shape and immediately redirects only the authorization code and anti-forgery state value—or an authorization error and state value—to the owner’s private application. The gateway has no application database, analytics, advertising scripts, or application-level request logging.
Storage and security
The private application stores Google authorization credentials encrypted in its private cloud environment. App-managed backup files are stored in the owner’s Google Drive. The public gateway’s application code does not persist authorization codes, access tokens, refresh tokens, workout records, health records, or Drive file contents.
Sharing and disclosure
Google user data is not sold or shared for advertising. Data is transmitted only to Google services and the infrastructure providers needed to operate the private sync and backup workflow, or when disclosure is required by law. The application’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention and control
The owner can revoke the application’s Google access at any time from Google Account permissions. Revocation prevents future API access. Files already created in Google Drive remain under the owner’s control and can be deleted there by the owner.
Contact and changes
This is a private, single-owner application. Support is provided directly by its operator using the support contact shown on the Google OAuth consent screen. Material changes to these practices will be reflected on this page before the updated practices are used.