Privacy & Security
Your data belongs to you. Here is exactly how we protect it.
Your health data, calendar events, and screen time are among the most personal information that exists. Lifestack is built on a simple principle: this data belongs to you, not us.
Where your data lives
All data is processed and stored on Cloudflare's global edge network:
- Isolated: stored in your personal database partition, separate from every other user
- Edge-processed: runs on Cloudflare Workers close to you geographically, not on a central server
- No third parties: never sent to external AI services, analytics platforms, or advertisers
Encryption
In transit
All connections use TLS encryption: between your browser and Lifestack, and between Lifestack and integration providers (Google, Oura).
Tokens at rest
OAuth tokens for Google Calendar and Oura Ring are encrypted using AES-256-GCM via the Web Crypto API. Even if the database were compromised, tokens would be unreadable without the encryption key.
Passwords
Hashed using PBKDF2-SHA256 with the Web Crypto API. Lifestack never stores your password in plain text.
What we access
What we do not do
- Sell, share, or rent your data to anyone
- Send your data to third-party AI models
- Track you across other websites
- Use your data for advertising
- Access data beyond the scopes you authorize
Insight processing
All insight computation (collision detection, meeting hangover analysis, recovery debt, biological capacity) runs on Lifestack's servers on Cloudflare's edge. No external AI services. The insight engine is deterministic and rule-based, not a machine learning model. Every insight can be traced back to specific data points.
Your controls
Disconnect integrations
Go to Settings > Integrations to disconnect any data source. Disconnecting immediately revokes access and stops syncing.
Delete your data
Delete all synced data for a specific integration from Settings. This permanently removes it from Lifestack's database.
Delete your account
Contact support at /contact to request complete account deletion. All data, preferences, and connections are permanently removed.
Export your data
The Data Explorer on the Health page lets you export your Oura data as CSV or JSON at any time.
Compliance
Lifestack processes data in accordance with GDPR principles:
- Data minimization: we access only what the features you use require
- Purpose limitation: data is used only for the features described in this documentation
- Storage limitation: delete your data at any time
- Right to access: the Data Explorer provides full visibility into stored data
See our Privacy Policy and Terms of Service for the complete legal framework.