Privacy Policy

Liftly (“Liftly,” “we,” “us”) is a social fitness app that turns your Oura Ring data into a daily competition with friends. This Privacy Policy explains what we collect, how we use it, who we share it with, and the choices you have. By using Liftly you agree to this policy.

Information we collect

We collect only what we need to run the daily duels:

• Account information. When you sign up we receive your email address and, if you use Google or Apple sign-in, your name. Authentication is handled by Google Firebase Authentication.
• Oura health data. With your explicit authorization through Oura’s OAuth flow, we access your daily sleep, activity (steps and active calories), readiness, stress, resting heart rate, and related summaries. We also read your Oura personal information (age, height, weight, and biological sex) solely to calculate your basal metabolic rate so that calorie-based competitions are fair across body types.
• Oura access tokens. To keep your data in sync we store the OAuth access and refresh tokens Oura issues. These are encrypted at rest (see Security below).
• Social data. The circles (groups) you create or join, their invite codes, and your standings, trophies, and win history within them.
• Notification tokens. If you enable notifications, the push token for your browser or device so we can send duel reminders and results.

We do not collect precise location, contacts, advertising identifiers, or payment information.

How we use your information

• To calculate daily duel results, leaderboards, and trophies.
• To share your daily metric for the day’s competition with the other members of your circle (for example, your step count on a “steps” day). Members of a circle can see each other’s scores for the active metric and historical results.
• To send you notifications you have opted into.
• To keep your Oura data synchronized and recover missing data.
• To operate, secure, and improve the service.

We do not sell your data, and we do not use your health data for advertising.

How we share information

We share data only with service providers that help us run Liftly, and only as needed:

• Google Firebase & Google Cloud — authentication, database (Cloud Firestore), hosting, and encryption key management.
• Oura — the source of your health data, accessed under your authorization.
• Expo — delivery of push notifications to your device, if enabled.
• Other members of your circle — your competition scores and trophies, as described above.

We may also disclose information if required by law or to protect the rights, safety, or property of Liftly or its users.

Security

Your Oura access and refresh tokens are encrypted at rest using Google Cloud Key Management Service before being stored. Data is transmitted over encrypted connections (HTTPS). Access to production data is restricted. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

Data retention

We retain your account and competition data for as long as your account is active. You can disconnect Oura at any time, which stops further data collection. You can request deletion of your account and associated data by emailing us at the address below; we will delete your stored health data, tokens, and profile within a reasonable period.

Your choices

• Disconnect Oura at any time; you can also revoke Liftly’s access from your Oura account settings.
• Turn off notifications from your settings or your device.
• Leave a circle to stop sharing your scores with that group.
• Delete your account by contacting us.

Children

Liftly is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect data from them.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Effective” date above and, for material changes, take reasonable steps to notify you.

Contact

Questions or requests about your data? Email us at johnbfinberg@gmail.com.