Privacy, in plain sight.

Analysis in your browser. A clear explanation of how your data gets there.

The short version

Your Oura data passes through our server on its way to your browser. Your browser stores your history and runs the analysis.
Daytlas has no server-side health database. An optional account holds your email address, your subscription status and a copy of your Daytlas setup, never your ring data. We do not store or log your Oura data on our servers.
If you buy Premium, Polar, our reseller, takes the payment. We never see your card details.
Your Oura connection key is encrypted and kept in a secure cookie that no script can read. Only if you choose “Remember my ring on my account”, it is kept encrypted with your account instead, so that on another computer you just sign in.
We do not sell your data, show ads, build marketing profiles or send your Oura data to any AI or large language model.
Readings from your connection stay in this browser for at most 30 minutes. You can disconnect, remove your local data and revoke Daytlas’s access in your Oura account at any time.

Who is responsible

The controller of your personal data is eazy.studio s.r.o., Kraľovany 146, 027 51 Kraľovany, Slovakia, company ID (IČO) 53315057, registered in the Commercial Register of the District Court Žilina, section Sro, insert no. 75764/L. Contact: hadjkb@gmail.com, +421 911 893 137. There is no data protection officer. Daytlas is independent and is not affiliated with or endorsed by Oura.

When you connect Oura

You sign in on Oura’s own website. Oura asks you to approve each data type, and you can share less than we ask for. We request these Oura scopes: daily, heartrate, tag, spo2 and heart_health. We do not ask for your email or personal information.

With your approval, Daytlas reads: daily sleep, readiness and activity summaries and scores; sleep periods (timing, stages, durations, and heart rate and HRV during sleep); heart rate samples; daily blood oxygen (SpO2); cardiovascular age; and tags you add in Oura, including any custom names or comments. Oura also gives us an access token and a refresh token for your connection.

Purpose: to show your own history in your dashboard and to let you export it. Nothing else.

Legal basis: these readings are health data. We process them only with your explicit consent (GDPR Article 9(2)(a) and Article 6(1)(a)), which you give when you select Connect with Oura and approve access at Oura. You can withdraw consent at any time, see “Disconnect, revoke and delete” below.

How it travels: Daytlas’s server is a small relay on Cloudflare Workers. It exchanges Oura’s authorization code for tokens, protected by PKCE, and encrypts them into a cookie for your browser. Your browser sends that cookie back with each request. The relay decrypts it, refreshes the tokens when needed, and forwards read-only requests to eight fixed Oura API endpoints. Readings exist on the server only in memory while a request is handled. They are never written to a database, cache or log. Responses are marked no-store. Tokens are handled the same way, unless you choose to remember your ring on your account; then they are stored encrypted, as described in Your ring on every computer.

What stays in your browser

Your browser keeps your copy. Readings loaded from your connection are kept in IndexedDB for up to 30 minutes so pages load quickly. After that they are deleted, or, if your browser was closed, the next time a Daytlas page opens. When you disconnect or access is revoked, they are deleted straight away. If your connection expires, you can download what is still in this browser before it is deleted, at most 30 minutes later. Imported files stay until you replace or remove them. What you create in Daytlas, such as goals and settings, stays until you remove it or clear this site’s data. Another browser or device needs its own connection, unless you choose to remember your ring on your account.

Your Oura access and refresh tokens are kept in a cookie, encrypted with AES-256-GCM. The cookie is HttpOnly: scripts on the page, including Daytlas’s own, cannot read it. The key to decrypt it stays on Daytlas’s server relay and never reaches your browser. Your browser sends the cookie only to Daytlas’s server.

The cached readings are not additionally encrypted by Daytlas. Anyone with access to this browser profile, a browser extension or malicious code running on the page could read them, or use your connection through Daytlas while this browser holds it. Use Daytlas on a device and browser profile you trust, and disconnect on shared computers.

Your account

You need an account only to use Premium. You sign in with a one-time code sent to your email or, where offered, with Apple or Google; there is no password. Your account is separate from your Oura connection and never holds your ring data. Only if you choose, it also remembers your ring connection (see Your ring on every computer).

What we keep: your email address, an account ID and your subscription status: your plan, trial and renewal dates, whether it is active, canceled, withdrawn or refunded, the version of the terms you accepted, and the reference numbers our payment reseller gives us. If you choose a display name, we keep that too. Our sign-in provider also keeps security logs with the time, IP address and browser of each sign-in.

Why: to sign you in, turn on Premium in your browsers, run your subscription, send the emails it needs, and protect accounts from misuse.

Legal basis: our contract with you (GDPR Article 6(1)(b)); for security logs, our legitimate interest in keeping accounts safe (Article 6(1)(f)); for records of payments, withdrawals and refunds, our legal obligations (Article 6(1)(c)).

Signing in with Apple or Google (optional): you sign in on their page, and they send us your email address and that it is verified. With Apple’s Hide My Email that is a private relay address; Apple also sends your name only if you choose to share it. Google also sends your name and a link to your profile picture. Our sign-in provider keeps this with your account, with an ID for your Apple or Google account; we use only your email address. A sign-in with the email address of an existing account opens that account; a Hide My Email address opens a separate one. The legal basis is our contract with you (GDPR Article 6(1)(b)). Apple and Google handle their sign-in as independent controllers under their own privacy policies.

An account right after connecting (optional): where offered, after you connect Oura in a browser where you aren’t signed in, Daytlas suggests making an account with Apple or Google in one step. Your account stays separate from your Oura connection: we don’t send anything from Oura to Apple, Google or our sign-in provider, and we don’t ask Oura for your email address. If you choose “Not now”, this browser remembers it and doesn’t ask again.

Who helps us: Supabase stores accounts in the EU (Ireland) as our processor. Your subscription status is stored in a Cloudflare D1 database in the EU. Resend sends our emails, including sign-in codes, as our processor. Supabase and Resend are based in the United States; for any access from outside the EEA we rely on the European Commission’s Standard Contractual Clauses in their data processing agreements.

How long: until you delete your account. Records of payments, withdrawals, cancellations and refunds: 3 years after your subscription ends, to deal with claims, and longer only where accounting law requires it. Sign-in security logs: up to 90 days.

You can delete your account yourself on the Account page or by email. Deleting it in your account takes effect straight away; by email we delete it within 72 hours, except the records above. Deleting your account also ends Premium and refunds the unused time, and forgets a ring remembered on it. Signing out or deleting your account never touches a ring connected only in this browser, or what you created here.

Sync between your computers

When you sign in, Daytlas saves a copy of your setup to your account, so it follows you to every computer where you sign in: your display settings and website language, and with Premium your saved chart sets (their names, the metrics and dates you chose), your goal targets and your review settings.

Never included: readings, review results or anything else calculated from your ring data, imported files and connection tokens. Our server refuses anything that isn’t on this list.

Where and why: with your account at Supabase in the EU (Ireland), as our processor, to provide the sync you use by signing in. Legal basis: our contract with you (GDPR Article 6(1)(b)).

Encrypted when stored: our server encrypts your setup with AES-256-GCM before it is stored, with a key that only our server holds. Supabase keeps only the encrypted copy, so neither its staff, its backups nor a copy of the database can read your setup. Our server opens it only to show it on your computers and, if you turn on the weekly reminder, to name the parts of it described below. This is not end-to-end encryption: there is no extra password to remember, and a new computer gets your setup as soon as you sign in.

How long: until you delete your account. Ending Premium doesn’t delete it. Removing data in this browser or signing out doesn’t delete the copy in your account.

Your ring on every computer (optional)

If you are signed in, you can tick “Remember my ring on my account” when you connect Oura, or later on the Account page or in Settings. On another computer you then only sign in to Daytlas; you don’t sign in at Oura again.

What we keep: only the connection itself: the access and refresh tokens Oura issued to Daytlas, the scopes you chose, when the connection was saved, last renewed and last used, and which wording of the choice you saw and when you made it. The tokens are encrypted with AES-256-GCM under a key that stays a secret of our server, and they are tied to your account ID. We never keep your readings, scores or anything calculated from them: as with any connection, readings pass through our server straight to the browser that asked and stay there for at most 30 minutes. Nothing is sent to anyone else.

Where and why: in a Cloudflare D1 database in the EU (Cloudflare D1), next to your subscription status, so that your computers can use your connection while you are signed in. Legal basis: our contract with you, for the feature you switch on (GDPR Article 6(1)(b)). Reading your Oura data still rests on the explicit consent you gave when you connected (Article 9(2)(a)).

How long: until you forget it (Account page or Settings), disconnect, or delete your account; until Oura reports that access was revoked or can no longer be renewed; and at most 90 days after it was last used. In each case we delete it straight away and ask Oura to revoke it. Browsers that used it stop loading data and delete what they loaded. Signing out stops it on that computer only.

Emails we send

Service emails: if you have Premium, we email you what the law or your subscription requires: your confirmation and the terms, reminders before your trial ends and before a yearly renewal, confirmations of withdrawals and cancellations, refunds, and notices of important changes. You can’t switch these off while you have Premium.

Weekly reminder (optional, Premium): if you turn it on, we keep your email address, the day, time and time zone you chose, the email’s language and which parts you want in it: a link to your weekly review, a link to the month in review in the first week of a month, a goal check-in link, a finding from the research we cite and a tip about Daytlas. The email may also name parts of your own setup from your account: your first name if you gave one, the day your week starts, your sleep goal target if the goal check-in is on, and the names of up to three saved chart sets and the metrics in your review if the weekly review is on. We keep a copy of just these with your reminder settings so it can be sent, encrypted with AES-256-GCM like your synced setup and opened only to send the email. The email never contains readings, scores, notes or anything calculated from your ring data; the numbers appear only in Daytlas after you click. We don’t track whether you open it or click links. Pause it, change it or turn it off in your account or with the links in any reminder. We delete these settings and the copy when you turn the reminder off or Premium ends.

Legal basis: our contract with you (GDPR Article 6(1)(b)). Resend delivers our emails as our processor. Each email is plain text with a formatted (HTML) version of the same content, without tracking pixels or redirected links. The only image is our logo, loaded from daytlas.com; we don’t use it to tell whether you opened an email.

When you import a file

A CSV or ZIP export from Oura is read in your browser. Supported sleep, readiness and activity values are shown in a preview and saved to IndexedDB only after you confirm. The file and its contents are not uploaded to our server. Unsupported columns are not kept. Imported records stay in this browser when you disconnect. Remove them under Your data or with Remove all. Keep your original export as a backup.

Backup files

A backup is created in your browser and saved where you choose. We don’t receive it. It contains what you created in Daytlas, such as goals, saved chart sets and settings. These can say something about your health, so keep the file somewhere safe, and choose a passphrase to encrypt it. Readings from your connection and imported files aren’t included; after a restore, Daytlas loads readings again from your connection, and you can import your original file again. Restoring reads the file in your browser. Creating a backup is part of Premium; restoring one is always free.

The demo

The demo uses fictional sample data generated in your browser. It makes no requests to Oura.

How insights are calculated

Trends, comparisons and correlations are calculated in your browser with ordinary statistics. There is no AI or large language model processing of your Oura data, no model training, no automated decision-making and no profiling. Exports to CSV or JSON are created in your browser.

Who else is involved

Oura is the source of your data. Oura’s own privacy policy applies to your Oura account.
Cloudflare, Inc. hosts Daytlas and runs the relay as our service provider. It processes network data such as your IP address to deliver and protect the site, and may keep infrastructure logs under its own policies. It stores your subscription status in a Cloudflare D1 database in the EU (Cloudflare D1) and, only if you choose to remember your ring on your account, your encrypted ring connection in the same database. For the optional Premium interest list it also stores contacts in a database located in the EU and runs the Turnstile spam check.
Supabase, Inc. stores accounts in the EU (Ireland) as our processor.
Apple and Google, only if you choose to sign in with them, confirm your email address as independent controllers under their own privacy policies.
Resend sends our emails (sign-in codes, confirmations, reminders and notices) as our processor.
Google provides our email mailbox. If you email us, Google processes that message under its own terms.
Polar (polar.sh, Polar Software, Inc.) sells Premium as our reseller and merchant of record and processes payment data as an independent controller. Polar works with payment processors such as Stripe.
PostHog (EU) processes optional website and app analytics, and masked public website recordings, with separate permission for analytics and recordings. Both are switched off on this site today.

We do not sell, rent or share your data with anyone else, and we do not use it for advertising. Cloudflare is based in the United States and its network is global. Cloudflare states that it is certified under the EU–US Data Privacy Framework, and its data processing addendum includes the European Commission’s Standard Contractual Clauses for transfers outside the EEA. See the Cloudflare privacy policy.

Optional analytics and website recordings

Website and app analytics and website recordings are switched off on this site today. If enabled, analytics will need your permission, and masked public website recordings will need a separate choice. Both start off. Your choice does not affect access to Daytlas and is separate from email updates. The legal basis is your consent (GDPR Article 6(1)(a)).

With analytics permission, PostHog’s EU service receives visits and selected actions from the homepage, About and Premium in every language, the Oura on the Web guide, the connection and account screens, and the app and demo. This includes onboarding, overview, day, trends, year, tags, review, profile, settings and what’s new screens. Privacy, terms, archived pages and the Premium interest form are excluded. Connecting Oura or importing a file does not change your analytics choice.

App analytics sends predefined screen, section and action names: for example, opening Trends, changing a view or starting an export. Changing a setting sends only that a setting changed, never which one or its value. Starting a sign-in with Apple or Google sends only which of the two you chose. Remembering or forgetting your ring on your account sends only that it happened (“ring_linked”, “ring_unlinked”). It estimates active time while the page is visible and focused, stopping after 60 seconds without interaction. Scroll events record milestones of 25%, 50%, 75% and 100%. These indicate interface use, not what you read or how closely you pay attention. We also distinguish demo, connected and imported use. The app has no click heatmaps, automatic capture of page contents or session recordings. Website actions are fixed names too: opening the story, opening How it works, opening the demo and changing the language. A language change is sent without the language you chose; the address of the next page shows it.

A random identifier in session storage links steps within the same browser tab, including returning from Oura’s connection page. It is renewed after 30 minutes of inactivity, cleared when you withdraw analytics permission and lost when the tab closes. It is not your account identifier and does not link your activity across devices. Public website heatmaps and recordings use a separate random identifier held in page memory. Event addresses contain only predefined page paths, without query strings or fragments. This measurement is pseudonymous, not anonymous.

We do not send health readings, graph contents, tag names, goals, selected dates, imported filenames, typed text, emails, account IDs, Oura tokens or referrers to PostHog. Form contents are excluded, including on connection and account screens. The connection flow is measured only on Daytlas; we do not measure your activity on Oura’s website.

Heatmaps and masked recordings are limited to eligible public pages: the homepage, About and Premium in every language, and the Oura on the Web guide. They exclude app, demo, connection and account screens, and Oura-connected, imported-data and signed-in visits, even on public pages. Recordings reconstruct interactions with a public page. Text and inputs are masked; forms and images are blocked. Static styling is retained so the page remains understandable. Console logs, network request contents and canvas capture are disabled. Recording is set to sample about 10% of eligible visits with recording permission.

Your choices are saved in this browser for up to 180 days. The earlier website-only choice does not permit app analytics; we ask you to choose again for this expanded scope. PostHog receives your network address when a request arrives; the project is configured to discard it instead of storing it with events, and location enrichment is disabled by our client. Recording retention is set to 30 days. Our current PostHog Free plan provides one year of queryable event history; that is not a guarantee that every underlying copy is deleted on that date. See PostHog’s privacy notice and data storage information.

Change or withdraw either choice below at any time. Withdrawal stops future capture but cannot recall data already delivered. For a privacy request, contact hadjkb@gmail.com.

Optional measurement is off on this site.

No website or app analytics or recordings are collected. You can turn off any previously saved choices below.

The Premium interest list

Joining the optional Premium interest list stores your email address, where you joined, the wording and time of your permission and your email preferences. It holds no Oura data. The legal basis is your consent (GDPR Article 6(1)(a)). We keep it for up to 12 months from your latest sign-up, unless you unsubscribe or ask us to delete it sooner. See the interest list privacy notice.

The form is protected by Cloudflare Turnstile. Only when you open the form, your browser loads Turnstile from challenges.cloudflare.com, and Cloudflare processes technical data such as your IP address and browser characteristics to check that the request is not automated. The legal basis for this check is our legitimate interest in keeping the list free of automated sign-ups (GDPR Article 6(1)(f)).

Payments

Polar sells Premium to you as our reseller and merchant of record. When you subscribe, you give your name, email address, billing address, country and payment details directly to Polar (Polar Software, Inc.). Polar processes them as an independent controller under its own privacy policy, for example to take payments, calculate and pay taxes, issue receipts, handle refunds and prevent fraud. Polar works with payment processors such as Stripe. See Polar’s privacy policy.

From Polar, we receive your email address, country, the plan you chose, subscription status and dates, amounts paid and refunded, and Polar’s reference numbers. We never receive your full card details.

To start your checkout, we send Polar your email address and an account reference. Polar handles them under the data processing agreement in its merchant terms with us. Polar is based in the United States; we rely on the European Commission’s Standard Contractual Clauses.

Legal basis: our contract with you (Article 6(1)(b)) and our legal obligations under consumer and accounting law (Article 6(1)(c)).

Withdrawals, cancellations and complaints

When you use “Withdraw from contract here”, cancel your subscription or send a complaint, we keep your name, email address, the contract details you gave, your message and the date and time we received it. We use them to carry out your request and to show later that we did. Legal basis: our legal obligations under consumer law (Article 6(1)(c)). We keep these records for 3 years after your subscription ends.

When you email us

“Send us feedback” opens a draft in your own email app. Nothing is sent automatically. If you send it, we receive your email address and message and use them only to reply and improve Daytlas, based on our legitimate interest in answering you (GDPR Article 6(1)(f)). We keep messages only as long as needed to handle your request. Please do not include health data, tokens or passwords.

Storage on your device

Daytlas uses essential browser storage for the service you ask for, plus the optional measurement storage described below:

Local storage entries starting with “daytlas.”: whether this browser is connected, the connection mode, your goals and app state. No tokens and no readings. Connection entries are removed when you disconnect.
IndexedDB database “daytlas-live”: readings loaded from your connection, deleted after 30 minutes or sooner as described above. IndexedDB database “daytlas”: imported files and what you create in Daytlas. Kept until you remove them or clear site data.
Cookie “daytlas_oura”: your Oura access and refresh tokens, encrypted with AES-256-GCM. HttpOnly, Secure and SameSite=Lax, sent only to Daytlas’s server. Deleted when you disconnect or remember your ring on your account, and expires 90 days after your connection was last renewed.
Cookie “daytlas_ring_link”: only when you tick “Remember my ring on my account” while connecting. The version of that choice, when you made it and the random value of this connection flow. HttpOnly, expires after 10 minutes and is deleted when you return from Oura.
Local storage “daytlas.accountRing”: only while this browser uses the ring remembered on your account. A random ID of that saved connection, so a replaced or forgotten one is noticed. No tokens, no account ID and no readings.
Cookie “daytlas_oauth_state”: a random value and a one-time PKCE code verifier that protect the connection flow. HttpOnly, expires after 10 minutes and is deleted when you return from Oura.
Cookie “mbd-account”: your account session, only if you sign in. HttpOnly, Secure and SameSite=Lax, kept for 30 days. Needed for signing in. Deleted when you sign out or delete your account.
Cookie “mbd-account-oauth”: a random value, a one-time PKCE code verifier and the page to return to, protecting a sign-in with Apple or Google. HttpOnly and SameSite=Lax, sent only to the sign-in addresses, expires after 10 minutes and is deleted when you return.
Local storage “daytlas.account.change”: a random value that tells your other tabs you signed in or out. No email, account ID or health data.
Local storage “daytlas.premium”: whether Premium is active in this browser, as a signed note from our server that works offline for up to three days. No health data. Deleted when you sign out.
Local storage “daytlas.workspace”: a random ID for this browser, so that the Premium note works only here. It never leaves your browser; our server sees only a one-way hash of it.
Local storage “daytlas.locale” and “daytlas.locale-hint”: the website language you chose, and that the language suggestion was shown so it appears only once. Saved only when you choose a language or see the suggestion. No health data.
Local storage “daytlas.account-offer.v1”: that you chose “Not now” on the suggestion to make an account after connecting, so it isn’t shown again. No email, account ID or health data.
Local storage “daytlas.account-sync.v1”: only if you sign in. The copy of your setup this browser last agreed with your account, so only changes are sent. No readings; your account appears only as a one-way tag.
Optional: your analytics and recording choices, saved only when you make them, for up to 180 days.
Optional, with analytics permission: a random measurement identifier in session storage. It joins steps in the same tab, is renewed after 30 minutes of inactivity and is cleared when you withdraw permission or close the tab. It contains no account ID or health data. A connection completion timestamp in the same storage lets us confirm an Oura connection started in this tab. It contains no tokens or health data and is cleared after confirmation, withdrawal or closing the tab.

No advertising or third-party tracking cookies are used.

Security

All connections use HTTPS. The dashboard loads no third-party scripts, except Cloudflare Turnstile when you open the optional Premium interest form, and uses a strict Content Security Policy. Our Oura client secret stays on the server. The relay only accepts same-site requests, forwards them only to Oura’s API and only to eight read-only endpoints, and does not log tokens or readings. The connection flow is protected with a one-time state value and PKCE. Your Oura tokens are encrypted with AES-256-GCM in an HttpOnly cookie readable only by the relay, or, if you choose to remember your ring on your account, encrypted with a separate key in our EU database. The setup you sync with your account is encrypted with AES-256-GCM before it is stored. As explained above, the readings cached in your browser are not additionally encrypted by Daytlas. If we learn of a security incident affecting your data, we will act promptly and inform you and the authorities where the law requires.

Disconnect, revoke and delete

In Daytlas: Disconnect deletes the connection cookie with your tokens and every reading loaded from your connection in this browser, and asks Oura to revoke this connection’s access token. Imported files and what you created stay. Remove all deletes everything Daytlas stores in this browser. You can also clear this site’s data in your browser settings. If your ring is remembered on your account, Disconnect also forgets it there.
Your ring on your account: “Forget my ring on my account” on the Account page or in Settings deletes the saved connection straight away and asks Oura to revoke it.
At Oura: disconnecting in Daytlas also asks Oura to revoke this connection’s access token. To make sure Daytlas no longer has access, open the Oura app, go to Settings and then App integrations, and revoke Daytlas if it is listed there, or contact Oura Member Care. Revoking stops all further access immediately. If you revoke access at Oura, Daytlas stops loading data at once and deletes any readings left in this browser the next time it opens.
Your account: delete it on the Account page. This deletes your email address, sign-in, the copy of your setup and a ring remembered on it straight away.
Deletion request: email hadjkb@gmail.com. We hold no Oura data on our servers, and we delete anything else we hold about you within 72 hours of your request.
Your copy: you can download your readings as CSV or JSON from your profile at any time.

Disconnecting never deletes your records at Oura. Files you exported stay wherever you saved them.

Your rights

You have the right to access, correct, delete, restrict and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing. To use these rights, email hadjkb@gmail.com. We answer within one month. You can also complain to the data protection authority in the EU or EEA country where you live or work, or where you think your rights were infringed. Our authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, ÚOOÚ SR), Hraničná 12, 820 07 Bratislava.

You can download everything you created in Daytlas, free of charge, with “Export my Daytlas data” (JSON) in your profile, and the readings Daytlas shows as CSV or JSON. You can ask Oura for a full copy of the data Oura holds about you.

How long we keep things

Ring data loaded from your connection: in your browser for up to 30 minutes at a time, and deleted straight away when you disconnect or your connection ends. Never on our servers.
Imported files: in your browser until you replace or remove them.
What you create in Daytlas: in your browser until you remove it. If you sign in, the copy in your account until you delete your account.
Account: until you delete it.
A ring remembered on your account (encrypted connection tokens only): until you forget it, disconnect, delete your account or access ends, and at most 90 days after it was last used.
Subscription, payment, withdrawal, cancellation and refund records: 3 years after your subscription ends.
Sign-in security logs: up to 90 days.
Weekly reminder settings: until you turn the reminder off or Premium ends.
Premium interest list: up to 12 months from your latest sign-up, unless you unsubscribe sooner.
Emails you send us: as long as needed to handle your request.

Children

Daytlas is not intended for anyone under 16. Do not connect an Oura account if you are under 16.

Changes and questions

If this notice changes, we update it here with a new date and explain important changes on the site. Questions about privacy or security: hadjkb@gmail.com. See the project story and the terms.

Updated 9 October 2026.