Privacy

The Freeband app keeps your data on your phone. Nothing comes here unless you turn on Web access in the app. When you do, the app creates an account and sends your band's data here after every sync. Turning Web access off stops new uploads; to delete what is already here, delete the account.

• Account: a random account ID, the SHA-256 hash of your access key (not the key itself), your time zone, the device name given when the account was created, and when it was created.
• Bands: a random ID the app makes for each band (not its MAC address or serial number), the band's name and model, the app version, and when the band was first and last seen.
• Samples: time, steps, calories, heart rate, standing hours and battery percentage.
• Minute data: steps, heart rate, blood oxygen (SpO2), stress, active calories and distance for each minute.
• Sleep: bed and wake times, stages and their durations, number of wake-ups, efficiency, the night's lowest heart rate, SpO2 and heart rate variability (HRV).
• Scores: the daily sleep, recovery and strain scores the app calculates on the phone, resting heart rate, confidence levels, contributors and the algorithm version.
• Webhooks: the addresses you add, their encrypted secrets and the result of the last delivery.
• Web sessions: a hash of your browser's cookie and when it expires (30 days at most).
• Short-lived counters to limit abuse: a keyed hash of your IP address, not the raw IP. They are deleted within two days.

Your name, email address, location, Xiaomi account and your band's encryption key are not stored here.

Only you can see your data, with your key or your session; accounts can't see each other's data. The person running the hub can technically access the database. Your data is never sold or shared; there are no ads, analytics or tracking tools. Pages load nothing from other sites, the font included. The only cookie is the session cookie used for signing in.

The hub runs on Cloudflare Workers and Cloudflare D1. Cloudflare provides the infrastructure as a data processor: it handles requests and hosts the database. While handling requests it keeps technical logs such as the IP address and the requested URL, and deletes them within a few days. The hub never writes keys, cookies or health data to those logs.

If you add a webhook, your data is also sent to the address you chose after every sync. Once it reaches that address, its owner is responsible for it.

Tap Delete account in the panel or call DELETE /v1/account. Your account, samples, minute data, sleep and score records, band records, webhooks and sessions are deleted immediately and permanently; this can't be undone. Deleted data may stay in Cloudflare D1's restore log for up to 30 more days; during that time it can't be reached from the panel or the API, and it disappears on its own when the time is up.

The data on your phone isn't affected; remove it from the app, or by deleting the app.

If something's wrong or you're curious about anything, write to whoever invited you, or to Mert Çobanov, who runs the hub.