What we keep, and what we throw away

What we ask your wearable for

We request the narrowest permission each provider offers for sleep, and nothing else. No heart rate, no workouts, no location, no email, no profile beyond the account identifier that keeps one wearable tied to one account.

• Fitbit and Pixel Watch, through the Google Health API: googlehealth.sleep.readonly and openid.
• Whoop: read:sleep, read:profile, offline.
• Oura: daily and personal.

What we store

One row per night, containing only:

• the date, and which provider measured it
• the nightly score
• minutes asleep and minutes in bed
• sleep efficiency
• when the sleep started and ended
• whether it met your target, and if not, why

Alongside that: your email address or wallet address for signing in, your payout wallet address, your nightly target, and a record of each payment.

What we read and immediately discard

Providers return far more than we ask about in the same response. None of the following is written to our database, and there is no column in which it could be stored:

• heart-rate and heart-rate-variability series
• respiratory rate, blood oxygen, skin temperature
• movement and restlessness data
• minute-by-minute sleep-stage timelines
• readiness and recovery scores

It exists in memory for the seconds it takes to decide whether a night met your target, and then it is gone.

Your tokens

The access and refresh tokens that let us read your sleep are encrypted with AES-256-GCM before they are written to the database, so they are stored as ciphertext rather than as something a database dump would reveal. They are never sent to your browser.

Who else sees it

Nobody. We do not sell, rent or share your sleep data, and there is no advertising or analytics product built on it. The data is processed by our hosting provider (Vercel) and our database provider (Supabase) purely as infrastructure.

Payments are transfers of USDG on Robinhood Chain. A blockchain is public and permanent: the amount, the time and your wallet address are visible to anyone, forever. Your sleep data is not on the chain, but the fact that a payment was made is. If that matters to you, use a wallet address not otherwise tied to your identity.

Deleting it

Disconnecting your wearable revokes our access immediately and stops any further reading. Your settled nights and payment history remain, because they are the record of money that moved.

To delete everything, email us and we will remove your account and every row attached to it. On-chain payments already made cannot be deleted by anyone, including us.

How long we keep it

Nights and payouts are kept while your account exists. Nights older than 3 days can no longer affect a payment, and are retained only so you can see your own history.

Children

SleepStreak is not intended for anyone under 18, and we do not knowingly hold their data.

Changes

If this policy changes in a way that affects what we store, the date at the top changes and the change is described here rather than applied quietly.

Contact

Questions, deletion requests, or anything you think this page gets wrong: sukiransandu@gmail.com.