Privacy Policy

What the app accesses

• Your exported file (free import): You manually select a .zip archive exported from Google Health / Fitbit via Google Takeout. The app reads and unzips this file locally on your device to parse its contents.
• Google Health API (Pro Sync, optional):If you connect your Google account, the app fetches your health data (steps, heart rate, sleep, weight, workouts, and similar) directly from Google's servers to your device over an encrypted connection. That data is parsed on-device and written to Apple Health. It is never sent to us.
• Apple Health (HealthKit): With your explicit permission, the app writes parsed records into Apple Health. The app requests write-only access and does not read your existing Apple Health data.

The Pro Sync sign-in service

Connecting a Google account uses a small service we operate (hosted on Vercel, with data stored by Upstash). It exists only to keep your Google sign-in secure. It stores:

• An encrypted Google sign-in token(a "refresh token"), used to obtain short-lived access tokens so your device can fetch your data from Google.
• A random, hashed session identifier that links your app installation to that token.

This service never receives, processes, or stores health data. Your device talks to Google directly for all health data. Disconnecting your Google account in the app revokes the token with Google and deletes it from our service. Signing in is governed by Google's Privacy Policy as well.

Purchases

Pro Sync is unlocked through Apple's In-App Purchase system. Payment, subscription management, and receipts are handled entirely by Apple; we never see your payment details.

What the app does NOT do

• It does not upload your files or any health data to any server, cloud service, or third party.
• It does not use analytics, advertising, or tracking SDKs.
• It does not share, sell, or transmit your health information to anyone.
• It does not read data already stored in Apple Health.

Data storage on your device

• The app stores a small amount of information locally to function: your import history (dates, sources, and counts of records added/skipped), per–data-type sync cursors used to avoid duplicates, your reminder preference, and — if you use Pro Sync — your session identifier in the iOS Keychain.
• This information is removed when you delete the app (Keychain entries are removed when you disconnect or delete the app).

HealthKit data

Data written to Apple Health is governed by Apple's own privacy protections. Health Bridge does not access HealthKit data for any purpose other than writing the records you choose to import. Health data is never used for advertising or marketing, and is never disclosed to third parties.

Local notifications

If you enable import reminders, the app schedules local notifications on your device. These are generated entirely on-device.

Children's privacy

The app is not directed at children and does not knowingly collect personal information from children.

Changes to this policy

If this policy changes, the updated version will be posted at this URL with a revised "Last updated" date.

Contact

For questions about this privacy policy, contact zyfcjtc@gmail.com.