Slinga Personal Running Atlas · Policy Version 2026-10-10
Privacy Notice & Health Data Disclosure
Zero Third-Party Tracking or Ad Sharing: Slinga does not use analytics trackers, advertising pixels, or third-party AI APIs. Your GPS tracks and workout metrics stay on this self-hosted server and are strictly scoped to your account.
1. What Data Slinga Collects
- Identity & Session Data: When you sign in via Auth0 (Google OAuth), Slinga stores your verified email address, display name, profile avatar URL, and unique Auth0 subject identifier (`sub`) to maintain your isolated session.
- Imported GPX / TCX / Strava Archive Data: When you upload a `.gpx`, `.tcx`, or Strava `.zip` export, Slinga extracts workout timestamps, activity type, activity title, distance, duration, elevation, and GPS route coordinates (`lat`, `lon`, `ele`, `time`).
- Optional Apple Health / PulsHealth Sync Data (Explicit Opt-In Only): If you explicitly opt in to Health Data Sync and pair the PulsHealth iOS companion app, Slinga ingests only running-relevant workout records, workout GPS routes, heart rate / running dynamics series, and running quantity metrics (heart rate, resting HR, HRV, VO2max, steps, distance, active energy, running power/stride).
- Journal & Preferences: Private notes, tags, favorite flags, unit preferences (`mi`/`km`, `°F`/`°C`), and default endpoint privacy redaction radius (default `200m`).
2. Strict HealthKit Data Minimization
Slinga enforces a server-side HealthKit intake filter on `/api/puls-ingest/v1/batches`. Even if enabled on your phone, Slinga automatically drops and rejects non-running sensitive categories—including sleep stages, medications, reproductive/menstrual health, state-of-mind logs, clinical records, audiograms, ECG waveforms, and personal demographic profile fields (`dateOfBirth`, `biologicalSex`, `bloodType`).
3. How Your Data Is Used & Protected
- Account Isolation: Every database query for workouts, GPS routes, heatmaps, Strava import jobs, and journal entries is filtered by your authenticated principal (`user_sub` and mapped PulsHealth UUID). Other beta testers cannot view or query your data.
- Endpoint Redaction by Default: Heatmaps and share cards trim the first and last `200m` (configurable up to `5000m`) of every GPS track so home/work start/end locations are hidden by default.
- Optional External Lookups: Historical weather lookups query Open-Meteo using coordinates rounded to a `0.01°` (~1.1 km) grid and are logged in your Activity Receipts. Optional AI coaching runs on a local loopback Ollama model (`127.0.0.1`) with coordinates excluded unless you explicitly toggle them on.
4. Withdrawing Consent, Revoking Devices & Deleting Your Data
You are in complete control of your data lifecycle:
- Withdraw Health Sync Consent: You can withdraw Apple Health sync consent at any time in Settings → Privacy & Data Lifecycle (`POST /api/consent`), which immediately revokes all paired iPhone device tokens.
- Export Your Archive: Export your complete workout and GPS route collection as standard GeoJSON or GPX at any time.
- Self-Service Account & Data Deletion: Triggering Delete My Account & All Workout Data (`POST /api/account/delete`) permanently erases your imported workouts, journal entries, cached raster heatmap tiles, preferences, consent records, device tokens, and active sessions from SQLite.