Privacy Policy

Collected from Garmin: When you connect Garmin, Quantified Self can import Garmin activities, request activity, Sleep, and Health history, receive Garmin Sleep updates, and import available Daily, Stress Details, HRV, User Metrics, Body Composition, Pulse Ox, All-day Respiration, Blood Pressure, Skin Temperature, and Health Snapshot summaries when Garmin grants Health Export permission.

Stored and used in Quantified Self: Imported Garmin data is used for dashboard, event analysis, Sleep views, the authenticated Health workspace, and related summaries. Wellness measurements are stored as normalized source-attributed Health records and bounded sample chunks, separate from workout metrics and Sleep sessions; missing values remain missing and Garmin Body Battery remains provider-specific. Health displays providers and connected accounts separately, replaces opaque account keys with local account ordinals, and does not save a preferred source or calculate a cross-provider average. Short-lived Garmin pull callback URLs are retained only on retryable live queue work, removed after every terminal queue outcome, and excluded from failed-job copies. Quantified Self may retain original activity files or equivalent source-file metadata when downloads, exports, reprocessing, or syncing past activities require them.

Disconnect and deletion: Disconnecting Garmin stops future activity, Sleep, and Health imports but retains data already imported into Quantified Self. Deleting your Quantified Self account removes the Garmin connection, imported user-scoped Sleep and Health records, sample chunks, sync state, and associated operational queue work.

Shared with Garmin: You can send a saved route or explicitly select a GPX/FIT route file in Garmin Services. Quantified Self parses the selected route and creates a Garmin Connect course. Direct selected-file delivery does not create or retain a Quantified Self route or Garmin delivery metadata.

Shared with connected destinations from Garmin: If you turn on an automatic Garmin activity route or choose to sync past activities, Quantified Self uses the original activity file already saved with the event to send it to the selected supported destination: Suunto, Wahoo, or COROS. Each direction is opt-in and a date-range backfill does not enable future delivery.

Collected from Suunto: When you connect Suunto, Quantified Self can import Suunto activities and history, sync recent sleep data, import sleep history, and automatically import new or updated Suunto routes into your saved Routes list. Connected accounts can also import available 24/7 Activity, daily-statistics, and Recovery measurements such as heart rate, HRV, SpO2, altitude, steps, energy, Body Energy Balance, and StressState.

Stored and used in Quantified Self: Imported Suunto data is used for event analysis, route detail views, dashboard summaries, sleep views, the authenticated Health workspace, and saved route management. 24/7 values are stored as normalized source-attributed Health records, separate from workout FIT metrics and Sleep sessions; raw Health webhook samples are not stored. Health displays providers and connected accounts separately, replaces opaque account keys with local account ordinals, and does not save a preferred source or calculate a cross-provider average. Connection metadata and processing metadata are also stored so reconnect, dedupe, bounded refetch, and refresh workflows can work reliably.

Disconnect and deletion: Disconnecting Suunto stops future activity, Sleep, route, and Health imports but retains data already imported into Quantified Self. Deleting your Quantified Self account removes the Suunto connection, imported user-scoped Sleep and Health records, and associated top-level operational queue work.

Shared back to Suunto: When you upload FIT activities or send a saved or selected GPX/FIT route to Suunto, Quantified Self sends the file or generated GPX route needed for that upload. Suunto receives GPX routes, so selected FIT routes and saved routes are converted to a compatible GPX route in memory; saved routes use the Quantified Self route name. Direct selected-file route delivery does not create or retain a Quantified Self route.

Shared from Suunto to connected destinations: You can opt in to automatic activity delivery or select a past stored date range for Wahoo or COROS. You can separately opt in to new and updated saved Suunto route delivery, or send existing saved routes, to Garmin Connect or Wahoo. Eligible connected Pro users can also select COROS. Quantified Self sends only the retained activity file or saved-route representation required by the selected destination.

Account-scope note: Routes imported from one Suunto account are blocked from being sent back to that same account, but can still be sent to a different connected Suunto account when that workflow is available to you.

Collected from COROS: When you connect COROS, Quantified Self can import recent COROS history, sync sleep summaries, and store available daily Health metrics: steps, COROS's provider calorie value, resting and sleep heart rate, overnight HRV, and detailed HRV samples with an interval mean heart rate when COROS supplies it. Missing or unsupported values remain unavailable rather than becoming zero.

Stored and used in Quantified Self: Imported COROS activities and normalized Sleep sessions support dashboard metrics, event analysis, the authenticated Health workspace, and provider-specific history tooling. Daily measurements are also stored as source-attributed Health records for the unified Health model. Aggregate sleep duration, resting or sleep heart rate, and overnight HRV remain in the Sleep session and are referenced from Health instead of copied. Detailed HRV samples from new COROS responses are stored in bounded server-written Health sample records and are not duplicated in Sleep; recoverable legacy Sleep copies can remain until the guarded migration completes. Health displays providers and connected accounts separately, replaces opaque account keys with local account ordinals, and does not save a preferred source or calculate a cross-provider average. COROS's calorie field remains provider-native because the API does not define a safe canonical conversion. Quantified Self may retain original activity files or equivalent source-file metadata when later downloads, exports, reprocessing, or sync tools depend on them. One provider account identifier is stored as the active COROS connection so imports and deliveries do not silently switch between accounts.

Disconnect and deletion: Disconnecting COROS stops future daily Health and sleep imports but retains already imported records. Deleting your Quantified Self account recursively removes the COROS connection, Sleep sessions, Health records and sample chunks, and imported data under your user record; account-deletion cleanup also removes associated top-level operational queues.

Shared back to COROS: You can send a selected FIT activity, automatically send new Garmin/Suunto/Wahoo FIT activities, or send a selected past date range already stored in Quantified Self. Eligible connected Pro users can also send a selected GPX/FIT route, a saved route from Routes, or opt in to new/updated or existing saved Suunto route delivery. Selected route files are parsed and converted to GPX in memory and do not create a Quantified Self route; saved routes retain provider delivery metadata for deduplication and status.

Shared with Suunto or Wahoo from COROS: If you turn on a supported automatic COROS activity route or choose to sync past activities, Quantified Self uses the original activity file already saved with the imported event to send it to the selected destination. Each automatic direction is off by default.

Echo protection: Activity delivery writes short-lived, server-only exact-file and semantic FIT fingerprints before sending. If COROS later returns a matching activity, Quantified Self acknowledges the echo without storing a duplicate event or starting another provider fan-out. The fingerprint records contain hashes and routing metadata rather than the source file and expire after about 120 days.

Collected from Wahoo: When you connect Wahoo, Quantified Self can receive completed workout-summary webhooks and request Wahoo workout history. Only workouts with an available FIT file are imported, and records identified by Wahoo as originating from third-party fitness applications are skipped.

Stored and used in Quantified Self: Imported Wahoo FIT activities, source identifiers, summary revision metadata, and original activity files are used for event analysis, dashboard metrics, exports, deduplication, and reprocessing. Wahoo does not currently supply daily wellness records for Health. If an imported Wahoo workout contains Weight profile context or an activity-level VO₂ max estimate, the authenticated Health workspace can read that value on demand under the workout-context boundary above; it is not stored as a Health record. OAuth credentials are stored server-side and are not readable by the browser.

Disconnect and retention: Disconnecting Wahoo revokes future provider access and stops new imports. Activities already imported into Quantified Self are retained until you delete those activities or delete your account. Account deletion removes Wahoo tokens, queue state, and imported account data under the normal deletion workflow.

Shared with Wahoo: You can explicitly send a selected FIT activity file or GPX/FIT course/route file directly to Wahoo, turn on/send a date range for Garmin, COROS, or Suunto activities already stored in Quantified Self, or opt in to automatic/backfill delivery of Suunto routes already saved in Quantified Self. Quantified Self converts selected GPX routes to FIT in memory before sending them to Wahoo, and converts saved Suunto routes to FIT in memory for the same destination. Saved-route delivery uses an opaque stable key so an updated saved route updates the same Wahoo route. Direct Wahoo activity delivery does not create or retain a Quantified Self activity; direct course/route delivery does not create or retain a Quantified Self route.

Shared from Wahoo: You can turn on or backfill Wahoo-to-Suunto or Wahoo-to-COROS activity sync. Quantified Self sends the retained original FIT file from a Wahoo-imported event only after you enable or start that route.

Outbound boundaries: Suunto-to-Wahoo saved-route delivery is a separate opt-in route workflow in Suunto Services; direct GPX/FIT course/route delivery is a separate Wahoo-only upload. Plans, sleep, and other non-activity data are not sent between Wahoo and another provider. Existing Wahoo connections may need to be reconnected to grant workout and route access for delivery to Wahoo.

Personal HRV range: When both Health metrics and Sleep summaries are approved, an external client can request source-separated nightly HRV classifications, rolling baseline boundaries and recent averages calculated with the Health chart model. The read includes up to 60 extra days of baseline history and requires complete bounded input; raw samples and account or device identities are not returned. This does not grant access to Training, notes or additional health families, create stored scores, or provide a medical assessment.

Health metrics permission: This separate grant covers recorded all-day heart rate, HRV, stress, resources, movement, energy, blood pressure and fitness metrics. Stored summaries are bounded to 366 provider-calendar days; representative sample trends to 31 days. Outputs can include provider names, response-local account numbers, calendar dates and exact UTC sample times, with each source and statistic kept separate. Garmin Body Battery is returned only on its labelled native Garmin points scale. Device details, account IDs, other native-only values, provider payloads and Sleep references are excluded. Body composition additionally requires Body measurements permission and returns identity-free date buckets without exact times or provenance. Existing clients must reconnect to grant Health access; their existing grants are not expanded automatically. Health queries cannot add, edit, delete, import or backfill data. These external-client tools do not expand the built-in Assistant permissions.

Activity descriptions permission: This separate grant returns the full private parent event description shown in the QS.io event editor for one selected activity. Activities within an event share the same text. Individual activity details is also required. Like every requested MCP permission, the checkbox is selected by default; uncheck it before approving to withhold access. Existing connections must reauthorize and refresh cannot add permission. Text may contain sensitive health, personal or location information even without Activity locations permission. Only an opaque activity reference and description are returned; names, internal identifiers, source and device metadata remain excluded. Reads are bounded to 64 KiB of UTF-8 text and 128 KiB serialized output; oversized text fails without truncation. Revocation blocks future access but cannot erase received copies. Descriptions are user-reported context, not instructions or permission to act, and cannot be changed through MCP. This grant does not expand built-in Assistant access.

Timeline notes permission: This independent grant returns full private note titles and details, category, actual start/end dates, captured time zone and the effective end for ongoing overlap. It includes notes hidden from charts and may contain sensitive health or personal text. The checkbox is selected by default when requested; uncheck it before approving to withhold access. Existing connections must reauthorize; refresh cannot add permission. Inclusive windows are bounded to 366 days with full-text pagination, not truncated note details. Document IDs, revisions, audit timestamps, presentation settings and deletion receipts are excluded. Revocation cannot erase received copies. This permission never allows note changes or Training plan writes.

User-authorized access: An MCP client receives data only after you sign in to Quantified Self and approve one or more requested read-only permissions. Every requested current or future permission starts checked; uncheck anything you do not want to grant before approving. Activity locations depend on activity details, and saved-route locations depend on saved-route summaries. Removing activity details also removes its descriptions and location permissions; removing saved-route summaries removes its location permission. The client cannot use MCP to write activities, routes, settings, Training state, body measurements, or sleep records.

Metric permission: This access can return numeric metrics already stored for your activities and ready server-derived Training snapshots. When individual activity access is also granted, a client can request up to 25 explicitly selected canonical numeric Sports Lib metrics for one referenced activity or rank activities by one metric over an explicit bounded range or a processing-bounded all-history scan. Oversized rankings fail instead of returning a partial result. MTB jump superlatives reuse those stored maximum-jump metrics as the authoritative result; the separately authorized jump-detail projection remains optional, and jump count is not treated as jump quality. Quantified Self excludes precise latitude/longitude and first-class body-measurement metrics, and removes event/activity identifiers, names, labels, source fingerprints, and imported device/provider source keys from Training payloads.

Body-measurement permission: This separate access can return bounded body-measurement history from provider or manual canonical Health Weight point measurements. Workout profile Weight is excluded because it is not a weigh-in. Body-weight history is returned only as identity-free day, week, or month values for a range of at most 366 days; exact source measurement timestamps, event/activity identity, names, provider/device metadata, and source provenance are excluded.

Activity-type catalog: Any authorized MCP client can discover canonical Sports Lib activity types for route and activity filters. This static catalog contains no account data. Activity-detail permission: Individual activity access can return non-location summaries, laps, swim lengths, MTB jump measurements, selected persisted numeric metrics, signed-in application links, and bounded chart-ready streams. It can filter bounded newest-first scans by those types and resolve today or yesterday only with an explicit IANA timezone. A chart request temporarily reads and selectively parses an existing original FIT, GPX, TCX, Suunto JSON/SML, or gzip file, downsamples the complete activity, discards parsed objects, and does not create a reparse, backfill, cache, or additional activity record. Historical charts depend on the original source remaining available and within processing limits.

Detailed activity samples: The existing Individual activity details grant also allows bounded pages of selected numeric activity samples on an elapsed-second axis, without chart downsampling. Missing readings remain null. This adds no OAuth permission and does not expose coordinates, absolute sample times, original files or provider/device metadata. Up to four supported metrics can be selected from existing original files. Only the selected numeric arrays may be retained in bounded server memory for up to two minutes to reuse parsing across pages; no persistent sample store, activity copy, reparse or backfill is created. Access, activity ownership and the original-file revision are rechecked for every page. Revoking access blocks subsequent reads but cannot erase copies already received by the client. This detailed-sample tool is not exposed to the built-in Assistant.

Activity-location permission: This dependent permission can add exact activity start/end and MTB jump coordinates, enable nearby-activity searches, and return a bounded breadcrumb trace with an activity chart. Without it, activity summaries and jump measurements remain available with coordinates omitted, and explicit location requests are rejected before location or source work begins. Exact activity locations can reveal a home, workplace, frequent trailhead, or other sensitive place.

Sleep permission: Sleep access can return normalized session summaries, day/week/month aggregates, bounded discovery of recorded safe aggregate vital types, and a one-call sleep trend that combines coverage with duration, score, stages, HRV, heart-rate, blood-oxygen, and respiration values for a requested period. Raw samples remain excluded, and recorded values cannot diagnose illness. When Activity and Training metrics are also approved, the client can request the same live UTC-day Readiness used by Dashboard Today. That result combines current Form/ramp with the latest eligible sleep score and can return safe aggregate latest HRV and sleep-heart-rate values, same-provider baseline medians, ratios, evidence counts, and explicit missing or insufficient-baseline states. The requested IANA timezone supplies local-day context; it does not change the UTC scoring boundary. The preferred daily report returns the latest completed non-nap sleep with recorded average/overnight HRV and average/minimum sleep heart rate, a same-provider duration comparison, live Readiness, and current-versus-usual equivalent 28-day Training totals and Running/Cycling/Swimming mix. The older compact briefing remains physiology-free for compatibility. These projections exclude provider identity, provider user and session identifiers, provider-specific payloads, raw sleep-stage intervals, score components, raw HRV samples, SpO2 and respiration samples, locations, activities, body measurements, workout plans, and medical advice.

Saved-route summary permission: Saved-route access can return route names, activity types, bounded metrics, route/waypoint/point counts, import/update times, and signed-in application links. It can filter a bounded newest-first scan by canonical Sports Lib activity type or a case-insensitive part of the route name. It omits exact bounds, preview geometry, and waypoint locations.

Saved-route location permission: This dependent permission can add exact geographic bounds, simplified polyline preview geometry and segment endpoints, nearby-route search, and waypoint coordinates, altitude, and distance. Existing clients retain non-location route summaries but must reconnect and approve this permission to regain coordinate-bearing route tools. Activity and saved-route location permissions are independent.

Projection exclusions: Original files, unbounded recordings, unrequested streams, separate internal identifiers, source keys, Storage paths, parser extensions, device identities, waypoint names/comments, links, and delivery metadata are not returned. Activity charts exclude full-resolution recordings and absolute per-sample timestamps. Separately approved Health trends can include UTC sample times and provider names with response-local account numbers; they never include account keys, device details, or provider payloads.

Place-name resolution: Nearby MCP searches can use direct latitude/longitude or a place name. Direct-coordinate searches are processed within Quantified Self. For a place-name search, Quantified Self sends only the location text to Mapbox for forward geocoding; activity data, route data, account identifiers, and unrelated client prompts are not sent to Mapbox for that lookup.

Credentials and retention: MCP bearer and refresh credentials are opaque, stored server-side only as hashes, expire automatically, and are bound to your account and the MCP resource. Approving a request creates pending authorization metadata, but a new connection becomes active and appears in Connections only after the client successfully exchanges its authorization code. Reauthorizing the same exact verified client identity leaves its current grant usable until that exchange succeeds, then replaces the previous permissions and credentials rather than creating another logical connection. Failed or abandoned reauthorization does not replace the current grant, and authorization codes expire automatically. Authorization metadata and active connection metadata are retained so the connection can operate and be audited.

Control and destination: Review or revoke MCP clients under Connections -> MCP. A client can use the standard server-to-server token-revocation endpoint, but it may not notify Quantified Self when removed or uninstalled. Disconnect in Connections remains the authoritative control and immediately invalidates the current grant and any older duplicate records for that exact verified client without affecting other MCP clients. Account deletion removes MCP connection and authorization state. A client may retain data it already received according to its own privacy and retention practices, so authorize only clients you trust.

Google Cloud: Quantified Self stores application data, connected-service metadata, and processing state on Google Cloud in the EU region.

Optional Assistant note context: Timeline notes access is off by default. Enabling or disabling it starts a fresh server-owned chat and preserves the independently selected location permission. Changing location access likewise preserves the notes choice; New chat resets both. When relevant, Gemini may receive full private titles and details, including notes hidden from charts. Notes are user-reported context, not verified diagnoses, causal proof, model instructions or authorization to change plans. Raw tool responses are not stored; answers may quote relevant details, and compact evidence identifies note context and dates under the existing conversation retention policy.

Stripe: Stripe processes subscription and billing data needed to charge, renew, and manage your plan.

Google Analytics: If you consent to analytics cookies, Google Analytics receives anonymized usage analytics used to improve the service. Analytics is optional and can be withdrawn in Settings.

Mapbox: When an authorized MCP client searches by place name, Mapbox is used to resolve the supplied place text and geographic scope. Direct-coordinate MCP searches do not call Mapbox. The built-in Assistant can make the same bounded place-name lookup only after you explicitly enable Precise activity locations for that chat; Quantified Self sends Mapbox only the supplied location text, not the conversation, activity data, or account identity. Separately, when you open an Assistant map, it uses the map style saved specifically for Assistant maps and Mapbox receives the displayed geographic tile area needed to render that map, including when the underlying location came from a direct coordinate rather than place-name geocoding. Its saved-route access remains limited to coordinate-free summaries.

Google GenAI / Gemini: The built-in Assistant uses Google's Gemini models through Google GenAI. Quantified Self sends the message you submit, the browser's IANA timezone for local-day context, at most the latest six completed conversation turns, and bounded validated results from the read-only tools chosen for the question. Results are coordinate-free by default. If you explicitly start a fresh chat with Precise activity locations enabled, selected activity-tool results may also send Gemini exact activity start/end and MTB jump coordinates, bounded activity-chart breadcrumbs, and nearby activity results during that chat. Changing the setting starts a fresh chat so coordinate-bearing history does not cross into a coordinate-free conversation; New chat returns the setting to off. Gemini may select only a server-advertised visual source and safe series keys; Quantified Self deterministically constructs any chart values, map coordinates, labels, and renderer settings from the validated result. Coordinate-free saved-route summaries may be selected for route questions, and their route names can contain user- or provider-assigned place information. Direct in-app URLs are withheld from Gemini, and an answer that repeats an opaque reference or cursor is rejected. Original FIT/GPX/TCX/JSON/SML files, saved-route bounds, route geometry, waypoints, write capabilities, and dashboard settings remain unavailable to the Assistant. Text, compact evidence, and any bounded chart or map payload share the same server-owned active conversation. It becomes unavailable about seven days after its latest completed turn or reset; a response already in progress can protect an imminent expiry for at most four extra minutes. Firestore TTL then deletes it asynchronously. New chat clears it immediately; account deletion removes it directly.

No hidden provider forwarding: Connected Garmin, Suunto, COROS, and Wahoo data is only sent to destination providers when you explicitly use the related import, upload, delivery, or sync feature. Wahoo delivery is limited to the explicit FIT activity, GPX/FIT course/route, opt-in Suunto saved-route, and Garmin/COROS/Suunto-to-Wahoo activity workflows described above.