Sovereignty Tracker

What We Collect

Account Information

Email address (for login and account recovery)
Name (optional, for personalization)
Password (stored securely, hashed - we never see it)

Sovereignty Data

Daily habit entries (what you track)
Sovereignty scores (calculated from your entries)
Path preferences (which sovereignty focus you choose)
Bitcoin holdings (if you choose to track them - stored only as amounts, not wallet addresses)
Financial data for sovereignty ratio (expenses, assets - you enter these voluntarily)

Connected Device Data (Optional)

Wearable health data (currently the Oura Ring) — only if you choose to connect a device; see "Connected Devices & Health Data" below for exactly what we receive

Technical Data

IP address (for security and fraud prevention)
Browser type and device info (to make the app work properly)
Usage patterns (which features you use, to improve the product)

What We DON'T Do

✕We don't sell your data. Not to advertisers, data brokers, or anyone else.
✕We don't use invasive tracking. No Facebook pixels, Google Analytics, or surveillance ad tech.
✕We don't give your data to anyone else. Your entries, scores, and health data are processed only by the service providers listed below, solely to run the product for you.
✕We don't train AI models on your data. AI features generate responses for you in the moment; your data is never used to train or fine-tune any model.
✕We don't require unnecessary permissions. No access to contacts, location, or other device data.
✕We don't store payment details. Stripe handles all payment processing securely.

Connected Devices & Health Data (Oura)

Sovereignty Tracker lets you optionally connect a wearable device — currently the Oura Ring — so your real biometric data can verify your daily habits instead of relying on self-reporting.

What we collect

If you connect your Oura account, we receive, with your explicit authorization via Oura's consent screen: sleep summaries and scores, readiness scores, activity summaries (steps, calories), workout sessions, heart rate and heart rate variability (HRV), and blood oxygen (SpO2) averages. We only request the data scopes our features need.

How we use it

Oura data is used for exactly three things: (1) displaying your recovery and sleep metrics in your dashboard, (2) automatically verifying and scoring your daily habits, and (3) — if you use AI coaching — providing context to our AI provider (Anthropic) to generate your coaching insights. That's it.

What we will never do with it

We will never sell your health data, share it with advertisers or data brokers, use it to train AI models, combine it with other datasets to identify you, or use it for marketing. Health data is processed only to deliver the features described above.

How it's protected

Oura access credentials and health data are encrypted in transit and at rest, and are accessible only to systems that need them to run the features above.

Your control

You can disconnect Oura at any time from Settings in the app, which immediately revokes our access. When you disconnect, or when you request deletion of your data, we permanently delete all Oura-derived data from our systems — including backups — within 72 hours. Disconnecting never affects your account, subscription, or non-Oura data. You can also revoke access from Oura's side at any time in your Oura account settings.

Oura's role

Your use of the Oura Ring and Oura's services is governed by Oura's own privacy policy. Sovereignty Tracker is an independent product and is not affiliated with, endorsed by, or sponsored by Ōura Health Oy.

How We Store Your Data

→Database: Your data is stored in Supabase (PostgreSQL), a secure, enterprise-grade database platform.
→Encryption: All data is encrypted in transit (HTTPS/TLS) and at rest.
→Authentication: Passwords are hashed using industry-standard algorithms. We never store or see your actual password.
→Access Control: Row-level security ensures you can only access your own data.

Your Rights

A sovereignty-focused app should respect your sovereignty over your own data. Here's what you can do:

Export Your Data

Download all your data anytime from Settings. It's your data - take it with you.

Delete Your Account

Permanently delete your account and all associated data from Settings.

✓Access: View all data we have about you
✓Correction: Update or fix any incorrect information
✓Portability: Export your data in a standard format (JSON)
✓Deletion: Request complete removal of your data

Third-Party Services

We use a minimal set of trusted services:

→Supabase: Database and authentication (PostgreSQL, based in the US/EU)
→Stripe: Payment processing (PCI-compliant, we never see your card details)
→Vercel: Website hosting and deployment
→Anthropic: Powers AI coaching, meal planning, and workout generation. Processes your habit data and (if connected) Oura wellness data solely to generate your responses — never to train AI models.
→OpenAI: Generates the results email for the free sovereignty assessment on our marketing site. Not used for app features or health data.
→Mailgun: Delivers transactional email (daily briefings, weekly digests) if you opt in.
→Mailchimp: Newsletter and marketing email — only if you subscribe.
→Sentry: Error monitoring so we can find and fix bugs. Not used for advertising or analytics profiling.

Each service has its own privacy policy. We've chosen partners that respect user privacy and don't resell data.

Cookies

We use only essential cookies required for the app to function:

•Authentication cookies: Keep you logged in
•Session cookies: Remember your preferences during a session

We don't use tracking cookies, advertising cookies, or third-party analytics cookies.

Data Retention

→Active accounts: We keep your data as long as your account is active.
→Deleted accounts: When you delete your account, we remove your data within 30 days.
→Backups: Encrypted backups may retain data for up to 90 days before automatic deletion.
→Connected device data: Health data from connected devices (such as Oura) is kept only while your connection is active, and is deleted from all systems — including backups — within 72 hours of disconnection or a deletion request.

Changes to This Policy

If we make significant changes to how we handle your data, we'll notify you via email and update the "Last Updated" date at the top of this page. Continued use of the service after changes constitutes acceptance.

Questions?

If you have questions about this privacy policy or how we handle your data:

dylan@sovereigntytracker.com

We respond to all privacy inquiries within 48 hours.

Privacy Policy

TL;DR - The Short Version