Privacy notice

Last updated: August 1, 2026

What PostHealth handles

When you connect Google Health, PostHealth receives the Fitbit-origin health data you authorize, the Google Health account identifier needed to isolate your account, and sync metadata. If you use app-native features, PostHealth also stores your training logs, API-key metadata, and meal images you choose to upload.

How it is used

Your data is used to provide your private dashboard, synchronization, exports, account-scoped REST/MCP access, and optional read-only sharing. PostHealth does not sell health data. Public profiles and share links are opt-in; meal images are private by default and are not treated as automatic nutrition analysis.

Storage and control

OAuth tokens are encrypted, API secrets are only shown once and stored as hashes, and health records are isolated by account. You can revoke share links, disconnect, or delete your account from the dashboard. Account deletion removes the account's cached health data, tokens, sessions, keys, logs, and stored media from the application storage.

Service providers

PostHealth runs on Cloudflare Worker, D1, and R2 infrastructure and uses Google Health for the connected health data. Their services may process data as needed to operate the integration.

Contact

For privacy and support questions, email hello@posthealth.dev.