Privacy Policy

This policy covers lucaguiga.com, the private API at admin-api.lucaguiga.com, and Mimir, a personal time management and stress planning application that connects to the Oura API. All are run by Luca Guiga.

Oura data

Mimir connects to the Oura API to read health data from an Oura account. Access is granted by the account holder, with their own Oura token or authorization, and Mimir only reads data.

What we access. Daily sleep score, readiness score, average heart rate variability, resting heart rate, and total sleep time.

How we use it. Only to work out a daily stress and workload estimate and to show that estimate and the recent sleep figures on a personal dashboard. We do not use Oura data for advertising, marketing, profiling, credit or insurance decisions, or to train machine learning models, and we do not sell it.

Where it is stored. Oura data is stored in a private database on the account holder's own computer. A small summary (the last 14 days of the figures above) is copied to a private server on Amazon Web Services so the dashboard can display it. Only the latest copy is kept and it is replaced on every update. Access needs a secret key.

Who sees it. Only the account holder and people they choose to give dashboard access. We do not share Oura data with any other company, except Amazon Web Services as our hosting provider, and we do not send it to any artificial intelligence service. We may disclose it if the law requires.

Security. Oura tokens stay in a configuration file on the account holder's computer and are never sent to the server. Transfers use HTTPS and every request needs a secret key. No system is perfectly secure.

Retention, deletion, and withdrawing access. Data on the server is overwritten every update, and deleting the server file removes it completely. Local data stays until the account holder deletes it. Access can be withdrawn at any time by revoking the token or app authorization in your Oura account settings, which stops all new data. To have your data deleted, email lguiga@ucsc.edu and we will do so promptly.

Oura data is health information. We treat it as sensitive, collect only what is listed above, and use it only for the purpose above. Mimir is not a medical device and does not diagnose or treat anything.

The public site

The portfolio is static. It has no accounts, forms, comments, advertising, or analytics, and it sets no cookies of its own. We do not collect personal information from visitors.

The site is hosted on GitHub Pages, which keeps standard server logs such as IP address, browser, and time of request. Fonts load from Google Fonts, so your browser sends a request, including your IP address, to Google. Both have their own privacy policies.

If you email lguiga@ucsc.edu, we see your address and message and use them only to reply.

The admin API

The API at admin-api.lucaguiga.com powers a private personal task board. It is not open to the public and needs a secret key. It stores task titles, categories, statuses, and notes entered by the owner, in a single table on Amazon Web Services. AWS request logs may record IP addresses and times of calls for security and troubleshooting. We do not use them for tracking or profiling.

Links to other sites

Pages link to GitHub, LinkedIn, Oura, and other sites. Their privacy practices are their own.

Children

Nothing here is directed at children under 13, and we do not knowingly collect their information.

Changes and contact

We may update this policy and will change the date above when we do. Questions or deletion requests: lguiga@ucsc.edu.