Klair Privacy Policy

Klair is operated by Grzegorz Raczek, a sole proprietor based in Poland, European Union ("Klair", "we", "us"). For the purposes of the GDPR, we are the data controller for the personal data described in this policy.

Contact: greg@klair.fit

Account data. When you sign in with Google, we receive your name, email address, and Google account ID (via the standard openid, email, and profilescopes). We don't ask for or store a password: Google handles authentication.

Health data. With your explicit, separate consent, we request read-only, restricted-scope access to your Google Health data, specifically:

• Activity and fitness data (steps, workouts, active minutes)
• Sleep data
• Body and health metrics (e.g. heart rate, weight, other measurements)

We pull this data from the Google Health API in two ways: real-time webhook notifications and periodic sync. We store both the raw data points as Google sends them and daily aggregates we compute for the dashboard. Google's developer policy requires us to retain data at the same granularity we received it, so we don't throw away detail in favor of summaries.

Technical data. We set one first-party session cookie (a signed JWT) so you stay logged in. It is used only for authentication, not for tracking or advertising. Klair does not use any advertising trackers and does not embed third-party marketing pixels.

Billing data. When you subscribe to a paid plan, we receive your subscription status and the billing contact email you provide to Stripe. Klair does not receive or store your card number; Stripe handles that directly.

Analytics. We use Plausible Analytics, a privacy-friendly, cookieless analytics service, to understand how many people visit Klair and which pages they use. Plausible collects only aggregate usage statistics, such as page views, referring sites, and device type. It does not use cookies, does not collect personal data, and does not track you across other websites. This data is processed by Plausible Insights OU, based in the EU (Estonia).

This is the section Google reviewers look for, so we're stating it clearly:

Klair's use and transfer to any other app of information received from the Google Health API will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.

In practice, that means:

• We only use your Google Health data to show it back to you on your own dashboard. That's the entire product.
• We never use your health data for advertising of any kind, including contextual, personalized, or interest-based ads.
• We never sell, rent, or transfer your health data to data brokers, advertising platforms, or any other information resellers.
• We never use your health data to assess credit-worthiness, for lending decisions, or for any purpose unrelated to showing you your own dashboard.
• No human at Klair looks at your individual health data. Access is automated and limited to what's needed to run the service (for example, debugging a data-sync bug), and we don't read message-level or record-level health content as a matter of course.
• Your data is shown only to you, the account owner. Live updates are pushed to your browser over a private, authenticated websocket connection tied to your session; nobody else's session receives your data.

We do not sell your data. We do not share your health data with third parties for their own purposes. We use a small number of infrastructure providers (subprocessors) strictly to run the service:

• Amazon Web Services (AWS), us-east-1 (Northern Virginia, USA): hosts our PostgreSQL database, application servers, and message queue.
• Google: the source of your health data, and our identity provider for sign-in.
• Plausible Insights OU, Estonia, EU: our cookieless analytics provider. It only ever sees aggregate, non-personal usage statistics, never your health data or account details.
• OpenRouter, USA: routes the generation of the optional morning summary to an AI model provider, restricted to providers that neither store nor train on inputs. It receives only anonymized, already-computed findings (for example "sleep 50 minutes under your norm") plus age, sex, and rounded height and weight for context. It never receives your name, email, identifiers, or raw health records.
• Stripe, USA: processes subscription payments. Stripe receives your email address and the payment details you enter directly on Stripe's own checkout page; Klair never sees or stores your card number. See stripe.com/privacy.

That's the complete list. We don't use ad networks or marketing tools, and our analytics provider never receives personal or health data.

Klair is based in the EU, but your data is stored on AWS servers in the United States (us-east-1). Because this involves moving personal data (including health data) outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) with our hosting provider as the transfer safeguard.

Health data is a special category of personal data under Article 9 of the GDPR. We only process it on the basis of your explicit consent(Article 9(2)(a)): you affirmatively grant Klair access to specific Google Health scopes during sign-in, and you can withdraw that consent at any time (see "Your rights" below).

For account data (name, email, Google ID) and the session cookie, our legal basis is performance of a contract with you (Article 6(1)(b)): we need this data to operate the account and dashboard you asked us for.

We keep your health data for as long as your account is connected to Klair, so we can show you a continuous history. If you disconnect your account or ask us to delete your data, we delete your stored health data and account data, save for what we must keep briefly for security or legal reasons (for example, abuse-prevention logs), which we delete on a routine schedule. We retain billing records for as long as required by legal and accounting obligations.

Because Klair processes data of EU residents, you have the following rights under the GDPR:

• Access: ask us what data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your data ("right to be forgotten").
• Portability: ask us for a copy of your data in a machine-readable format.
• Withdraw consent: revoke your consent to health data processing at any time, without affecting the lawfulness of processing before the withdrawal.
• Object/restrict: object to or ask us to restrict certain processing.

To exercise any of these rights, email greg@klair.fit. We'll respond within one month, as required by the GDPR.

You also have two direct, Google-side controls that don't require contacting us at all:

• Revoke Klair's access to your Google account any time at myaccount.google.com/permissions. This immediately stops any further data access.
• Disconnect inside Klair (when available) or email us to disconnect and request deletion of your stored data.

If you believe we've mishandled your data, you can lodge a complaint with your local supervisory authority. In Poland, that's the Urząd Ochrony Danych Osobowych (UODO), uodo.gov.pl.

OAuth refresh and access tokens are encrypted at rest and are never sent to your browser, logged, or included in error messages. Our session cookie carries only a signed authentication token, not health data or raw credentials.

Klair is not directed at children. You must be at least 16 years old to use Klair (see the Terms of Service for the full eligibility rule).

If we make material changes to this policy, we'll update the "Last updated" date above and, where required, notify you in the app or by email before the changes take effect.

Questions, requests, or complaints: greg@klair.fit