Privacy Policy

What Ovyso reads

Ovyso reads the following categories from Apple Health, only with your permission, and only to display them in the app and in your widgets:

Ovyso never requests write access to Apple Health. It cannot add, change, or delete anything in your health record — the one exception is a Debug-only developer tool used solely on development devices to seed a sample week of data for testing, never available in the App Store build.

Where your data goes: nowhere, by default

Everything Ovyso reads from Apple Health is processed on your iPhone and stored in a local, app-only container. Today, the Studio, Trends, the records on your profile and every widget work with no account at all — there is nothing to sign up for and nothing to log in to. The only features that leave the device are Circles and Friends, and only if you use them. Notifications about your records and streaks, and your weekly and monthly recaps, are made the same way: Ovyso builds them on your iPhone from what it has already read, and iOS delivers them from there — nothing about them is sent anywhere.

Circles: the one thing that is shared

Nothing about your Health data or your device is shared through Circles beyond what is described on this page — not your sleep, not your heart rate, not your vitals, not your precise location, and nothing about your device beyond the time-zone offset above and, for a Circle you founded, the time zone your phone was set to when you made it — both of which that Circle's members' phones receive, because they need them to tell when a day ends — and the notification token described below, which no other member can ever see. The members of a Circle also see your event results, when you joined it, and your lifetime laurel total, which adds up the laurels you won across every Circle you are in. A Circle's data is visible only to the people who joined that Circle using its invite code, and to nobody else; the database enforces that with row-level security, not just the app.

Invite links

An invite you send is a message that carries your Circle's name, the headline of its running or next event, its code, and a link like ovyso.app/join/?code=ABC234. That link opens a page served by GitHub Pages, the same static host behind this website, not by Ovyso's own backend. On a phone that already has Ovyso installed, tapping it opens the app directly and no request reaches GitHub Pages; opened in a browser instead — as on a phone without Ovyso — it is a request GitHub Pages logs the way any web server does, such as the page asked for, with the code in it, the device's IP address, and the time — a log kept by GitHub, never seen by Ovyso and never reaching Circles' own database. Its preview in Messages is text only, with no image or card; and a Join sheet opened from it shows only the code it was sent, never the Circle's name, until you join.

The account Circles needs

Because an event has to know whose steps are whose, Circles needs an account. You can create one in two ways, and both are equal:

• Sign in with Apple. Apple sends Ovyso an email address — the real one, or the private relay address Apple generates for you if you choose to hide it — your name, on the very first sign-in only, and a stable identifier for your Apple ID on Ovyso, which the authentication service keeps to recognize your account on later sign-ins.
• Email and password. For anyone who would rather not use an Apple ID. Your password is never seen or stored by Ovyso: it is handled by the authentication service below, which stores only a hash of it. The name you type when you sign up this way stays on that service's own account record too, even if you rename yourself in Settings afterwards — both records are removed together when you delete your account.

So, in full, what an Ovyso account holds. Read from Apple Health: per day per Circle, your step count and the distance you covered, with anything typed into Health by hand left out as described above. From you and your phone: that day's step and distance goals, which you set in Ovyso's own Settings; your time-zone offset, so an event knows when your day ended; the time zone of any Circle you founded, set from yours the moment you made it, which decides when that Circle's events start and end and when its alerts may arrive; the display name you chose — one name, which every Circle you are in and every friend shows; the @username your first Circle gives your account, made from that name, or from your email address when your name holds nothing a username can spell, and yours to change at any time; and the email address (or Apple's relay address) you signed in with. Picked in the app: your avatar, if you choose one — a mark and a color from the ones Ovyso ships, never a photo — which the members of your Circles, your friends, anyone you have sent a friend request to or received one from, anyone who has blocked you, and anyone on Ovyso who looks up your exact @username see beside your name. Registered by your device: one notification token, from the moment you sign in — for the silent pushes that keep a board fresh and an event's own alerts. A silent push is what lets Ovyso's server wake the app quietly when somebody in your Circle posts steps, so the board and your widgets are already up to date when you look. An event's alerts reach you the same way: its results, a Team Goal or a Journey's destination reached, each stop a Journey reaches on the way, and its last day — and, the morning after an event ends, a reminder if its results are still waiting for your phone. So does news from your Circles: a new event, a new member, a Circle mate passing you in a race and you passing a Circle mate, at most once a day each per race. From the moment you sign in these arrive quietly, listed in Notification Center without a banner or a sound — you are not asked first, because iOS lets an app deliver quietly without asking. Turning on notifications is what lets them interrupt you; iOS's own Settings → Notifications → Ovyso is where you turn them down again, or off entirely, and Settings → Notifications inside Ovyso is where you choose which kinds you get. Each of those carries the Circle's name, a line such as who won, who joined or where you finished, and your account's id, and travels through Apple's push notification service. No other member can see the token itself, it says nothing about where you are or what you do, and it is deleted when you sign out — if that one call ever fails, the app says so and asks before signing you out anyway — and when Apple tells the server the app is no longer installed on that device. Produced by playing, not read from Health: the Circles you made or joined, each with its name, its mark and its invite code — all visible to every member, and the name is also the title on that Circle's event notifications; each of their events — what it counts, what it is worth, and the days it runs — and, for a Journey you build yourself, its name and its two places — each stored as the city you picked and Apple Maps' own identifier for the landmark, station or square inside it where the route actually starts or ends — never your device's real location; each finished event's results, which keep the name you had then, your place, your total, your score, the days you hit, the days you were active, whether you took part, the awards it gave you, the laurels it paid and the lifetime laurel total it left you on; your lifetime laurel total; and any season title you won, which keeps the Circle's name as it was at the time — unless that Circle is later deleted, when its name is cleared and the app shows it as "A deleted circle" — while the title itself stays with your account regardless. Beyond those there is only bookkeeping: when each row was last written; when your account was last sent a notification for each Circle; the Circles notifications that name a person, and whom each was for — who joined, who started an event, whose last day is still missing, who passed you in a race or whom you passed, and by how much — each deleted 30 days after it went out (or after it was made, if it never went out), and at once for you when you leave that Circle; while a race is running, the order its members stood in when it was last checked, so a pass can be noticed, which leaving also takes you out of; a count, per Circle, of the joins and new events announced each day, holding no names and kept two days, only to hold those announcements to three a day; and which kinds of Circles and Friends notifications you turned off. A notification about an event as a whole — its results, a goal or a destination reached, its last day, a Journey's stop — names nobody and is kept with the event. Nothing else Ovyso reads from Apple Health — your sleep, your heart, your vitals, your workouts, energy, floors — is ever uploaded.

Who stores it

Circles runs on Supabase, which hosts the database and the authentication service on Ovyso's behalf as a data processor. The project is hosted in the region chosen when it was created (the European Union by default for Ovyso). Supabase does not use this data for its own purposes. Board and event notifications reach your phone through Apple's push notification service, which Apple operates. A board notification carries nothing but a signal to wake the app; an event's alert carries the Circle's name, one line about the event, and your account's id — never your Health data. Supabase's own sign-in records may separately note technical details such as the IP address and device used for each sign-in, the way most authentication services do; nothing in Ovyso reads or acts on them.

Deleting it

You can delete your account, and everything in it, from inside the app (a Circle you started, and any event you set up in one, stays with its other members; your own steps leave with you) — Settings → Account → Delete account. It happens immediately: the account, your display name, your memberships, every total and goal you shared, your event results, your laurels, any season title you won and every device's notification token registered to it are removed; a Circle you started, and any event you set up in a Circle, stays with its other members, and a Circle left with no members at all is removed. Nothing else is kept afterwards, and no email to us is required. Leaving a single Circle, rather than deleting the account, takes your steps and your membership out of that one Circle — your results and any season titles from it stay — and leaves the rest of your account untouched.

Friends: what they see, what is shared

Setting up Friends claims a username — three to twenty characters, checked for uniqueness — which is stored on your account so people can find you and so a friend's board can show it beside your name. Ovyso also stores your friends list: who you are friends with, the requests you have sent or received, and anyone you have blocked. While Share my steps with friends is on, each day's step count and the distance you covered is stored with your phone's time-zone offset, which counts your day in your own calendar — the same two numbers a Circle counts, read the same way, with anything Health marks as entered by hand left out. The app shows a friend today and the current calendar week; the server gives a friend at most seven days at a time, and never a day older than the nine it keeps: each day's total is still kept in storage for nine days in all, then deleted automatically by a nightly clean-up, whether or not sharing is still on. Turning sharing off deletes every day total you have stored immediately, all at once, rather than waiting the nine days out; your friends list, requests and blocks are not affected, and your friends then see "Not sharing" in place of your numbers.

A friend request arrives as a push notification — so does the notice that somebody accepted yours — through the same notification token described under Circles above, and Ovyso keeps a note of when it last sent that alert between the two of you, so it sends at most about one an hour. Nothing is sent when a request is declined, cancelled, or when somebody removes or blocks you, and nothing is ever sent about a friend's steps. Adding a friend by link, QR code or username never sends a request by itself: the other person still has to look at your profile and choose to send one, or accept yours.

A friend link like ovyso.app/add/?u=username works the way an invite link does: opened in a browser instead of in Ovyso — as on a phone without Ovyso — it is a request GitHub Pages logs the way any web server does, such as the page asked for, with the username in it, the device's IP address, and the time — a log kept by GitHub, never seen by Ovyso and never reaching Friends' own database.

Deleting your account (Settings → Account → Delete account) removes your username, your friends list, every request you sent or received, everyone you blocked, and every day total you shared with friends — the same immediate deletion described under Circles above.

No analytics, no tracking, no advertising

Ovyso does not use analytics SDKs, does not use advertising SDKs, and does not track you across apps or websites in any way. There are no tracking domains contacted by the app, and nothing in Ovyso is designed to build an advertising profile of you. This is also declared formally in the app's privacy manifest, submitted to Apple with every build.

In-app purchases

Ovyso Pro (a one-time purchase, no subscription) is processed entirely by Apple through StoreKit. Ovyso itself never sees or stores your payment details — Apple handles billing, receipts, and renewal directly.

Children's privacy

Ovyso is not directed at children. The app can be used in full without an account; the only personal information it can hold is what Circles or Friends needs — everything listed under "So, in full, what an Ovyso account holds" and under "Friends: what they see, what is shared" above — and all of it can be deleted from inside the app at any time.

Your choices

• Revoke Apple Health access at any time in Settings → Privacy & Security → Health → Data Access & Devices → Ovyso.
• Leave a Circle at any time from the Circles tab: your steps and your membership leave with you, but your past results and any season titles you won stay, credited to the name you had then — unless you founded that Circle, whose only way out is Delete circle, which ends it, and its history, for every member. A host who took over because the founder deleted their account keeps the ordinary Leave.
• Choose which notifications Ovyso sends in Settings → Notifications, or turn them all off in iOS Settings → Notifications → Ovyso.
• Delete your account, and everything stored with it, from Settings → Account → Delete account.
• Use the app without an account at all — only Circles needs one.
• Delete the app to remove everything Ovyso stored locally, including your designs and cached data.
• Turn on Demo data in Settings to use every part of the app, including widgets, without granting Health access at all.

Changes to this policy

If this policy changes, the effective date above will change with it. Material changes — anything that would change what is collected or how Circle data is shared — will also be noted in the app's release notes.

Contact

Questions about this policy: support@ovyso.app. You do not need to write to us to delete your data: Settings → Account → Delete account does it immediately.