Privacy Policy

Vitra is a desktop application that reads your Oura Ring data and analyses it locally on your computer. This policy explains what data Vitra touches, where it lives, and what we — the makers of Vitra — can and cannot see.

The short version

• Your health data never leaves your machine.
• We do not run servers that store your Oura readings or the insights derived from them.
• We do hold a small amount of account data — your email and licence — when you buy Vitra or start the trial. That is covered in section 7.
• We do not use analytics, telemetry, advertising IDs, or third-party trackers.

1. Who we are

Vitra is built and maintained by an independent developer. Contact: pt@amplifiedcreations.com.

Vitra is not affiliated with, endorsed by, or sponsored by Ōura Health Oy. "Oura" and the Oura Ring are trademarks of their respective owners.

2. What data Vitra processes

When you connect your Oura account, Vitra reads the following from the official Oura API, on your behalf:

• Daily readiness, sleep, and activity scores.
• Heart-rate and HRV time series.
• Sleep stages and timing.
• Body temperature deviations.
• Profile metadata (name, email, age, height, weight) — only as exposed by Oura's /v2/usercollection/personal_info endpoint.

In addition, Vitra stores any tags or journal notes you create inside the app (e.g. "alcohol", "hard workout", "poor sleep"). These are typed by you, locally, and stay on your device.

3. Where the data is stored

All Oura data and all derived insights are stored in a local database file on your computer (under the operating system's standard application-data directory). Nothing is uploaded to a Vitra-controlled server because there is no Vitra-controlled server for user data.

The on-device AI model that produces personalised insights also runs entirely on your machine. Its weights ship with the app; your readings are not used to train any shared model.

4. Network connections Vitra makes

• Oura API (api.ouraring.com) — to authenticate via OAuth and to fetch your own ring data. Governed by Oura's privacy policy.
• Licence server (api.vitrahealth.app) — when you start the free trial or activate a paid licence, the app contacts our licensing server to issue and validate your licence. Section 7 lists exactly what this stores.
• App update check — Vitra periodically checks for new versions. The request includes the current version string and your operating system; it does not include personal data.
• Crash reports — if the app crashes, Vitra may show a dialog offering to send the stack trace to us. Sending is opt-in. No health data is included.

Vitra does not contact any server beyond those listed here.

5. What we (the developer) can see

Nothing about your health. Specifically, we do not have access to:

• Your Oura readings.
• Your insights, tags, journal entries, or correlations.
• Your Oura profile — the name, email, age, height and weight Oura exposes.
• Usage analytics — when you open the app, which screens you visit, how long you stay.

The exception is the email address you give us when you buy a licence or start the trial, which we do store on our licensing server — see section 7. And if you email us directly, we obviously see that email and its contents; we reply, then delete it when no longer needed.

6. Authentication tokens

When you sign in with Oura, the OAuth access token and refresh token are stored in your operating system's secure credential store (macOS Keychain / Windows Credential Manager). They never leave your device. You can revoke them at any time from Oura's connected-applications page.

7. Purchasing and licensing

Buying a licence or starting the free trial is the one place where we do hold data about you, on a small server we control (api.vitrahealth.app). This is entirely separate from your health data, which never reaches us.

What we store:

• When you buy: your email address, the licence key we issue, the tier you bought (Solo or Pro), and the Stripe checkout reference. Payment itself is handled by Stripe — we never see or store your card details.
• When you activate the app: an anonymous per-machine identifier, your operating system, the app version, and when we last saw that machine — used to enforce the seat limit of your licence.
• When you start the free trial: the per-machine identifier, your email (if you provide one), your IP address, and the trial start and expiry dates — used to grant one trial per machine and to prevent abuse.

Legal basis: delivering and enforcing the licence you bought (performance of a contract), and preventing trial abuse (legitimate interest).

Payment processor: payments run through Stripe, acting as our payment processor. Card data goes to Stripe directly, never to us.

Retention: licence records are kept while the licence exists. Expired trial records are purged after a short retention window.

Your rights over this data: to access or delete your licensing and trial data, email pt@amplifiedcreations.com. On an erasure request we hard-delete your licence, activation and trial records and retain only a minimal, email-redacted note that an erasure took place.

8. Your rights

For your health data — which lives only on your machine — most data-subject rights (access, deletion, portability) are exercised directly on your device:

• Access / portability: the app can export your full local database as JSON.
• Deletion: uninstalling Vitra removes the app; deleting the local database directory removes all stored readings.
• Revoke Oura access: via Oura's connected-applications page, linked above.

For the licensing and trial data described in section 7 — and for questions about this policy or copies of any email correspondence we hold — write to pt@amplifiedcreations.com. We action access and deletion requests for that data directly.

9. Children

Vitra is not intended for use by anyone under the age of 16.

10. Changes to this policy

If we change this policy materially, the new version will be published at this URL with an updated date at the top. The app will surface a notice on next launch when meaningful changes happen.

11. Governing law

This policy is governed by the laws of Portugal. Disputes that cannot be resolved by email will be heard in the courts of Lisbon.

— The Vitra team