سياسة الخصوصية

Privacy Policy

Effective date: 2026-10-21.

1. Who we are

Wateen (وتين) is a personal, open-source health app used by one person, its owner and developer. It is not a public service and accepts no other users. Contact for anything about this policy: falkhudiry@hotmail.com.

2. Data we read from Google

When the owner connects their Google account, Wateen requests three Google Health API scopes, all read-only. Wateen never writes, edits or deletes anything in the Google account.

Activity and fitness

https://www.googleapis.com/auth/googlehealth.activity_and_fitness.readonly

Steps, distance, active minutes, Active Zone Minutes, calories, sedentary periods, exercise sessions and VO2 Max.

Health metrics and measurements

https://www.googleapis.com/auth/googlehealth.health_metrics_and_measurements.readonly

Heart rate, heart rate variability, resting heart rate, blood oxygen saturation (SpO2), respiratory rate and skin temperature variation during sleep.

Sleep

https://www.googleapis.com/auth/googlehealth.sleep.readonly

Sleep sessions and sleep stages.

We also receive the user identifier the API returns, to link the connection to the right account. We do not request email, contacts or location.

3. Other data

• Health Connect: the Android app reads Galaxy Watch data on the phone, with an Android permission the owner grants.
• What the owner enters: journal entries, tags and lab results.

4. How we use the data

Only to show the owner their own data inside Wateen: charts, personal baselines, a recovery score, alerts and reports. All of it is informational, not a medical diagnosis.

We do not use the data for advertising, for credit-worthiness or lending decisions, or for any purpose that is not visible to the owner in the app.

5. Where it is stored and how it is protected

• In the owner's own Supabase project (Seoul region, ap-northeast-2), with a local cache on the owner's phone.
• Encrypted in transit (HTTPS/TLS) and encrypted at rest by Supabase.
• Every table has row-level security, so only the owner's account can reach it.
• The Google refresh token is kept encrypted in the Supabase project's secrets only. It never reaches the app or the published source code.

6. Sharing

We do not sell, rent or share user data with advertising platforms or data brokers. Data is transferred only in these cases:

• Hosting: Supabase hosts the database and functions on the owner's behalf. Cloudflare hosts only this website; no health data passes through it.
• AI coach (optional): when the owner opens the coach and asks a question, the phone sends the short summaries needed for the answer directly to OpenAI under the owner's own ChatGPT account, with storage turned off. The owner sees what was sent under every answer and can exclude data categories. This happens only at the owner's request.
• Law: when required by law.

No human other than the owner reads the data.

7. Deletion and revoking access

1. Revoke Google access: open myaccount.google.com/connections, choose Wateen and delete the connection. Wateen stops reading new data at once. The owner can also disconnect Google from the app's Devices & sync screen, which deletes the stored token.
2. Revoke Health Connect access: Android Settings → Health Connect → App permissions → Wateen → Remove all permissions.
3. Delete data: removing a device in the app deletes everything imported from it. Deleting the Wateen account deletes all of its rows from the database. To request deletion, email falkhudiry@hotmail.com; we complete it within 30 days.

Data is kept until the owner deletes it. Revoking access stops new reads; deleting removes what was already imported.

8. Limited Use

The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements. Wateen's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Children and changes

Wateen is not directed at children. If this policy changes we update the effective date above, and we do not use data in a new way before the owner agrees.