What we collect,
and what we never do with it.
Effective September 9, 2026
The Cipher Project is a private, single-user health dashboard. It is operated by Jay Spall for his own use. It is not a consumer product, it has no public sign-up, and it does not sell, share, or monetize personal data.
01Who operates this service
The Cipher Project (thecipherproject.com) and its connected dashboard are operated by Jay Spall, Austin, Texas, United States. Questions about this policy go to jay@jayspall.com.
02What data is collected
The dashboard combines personal health information that the account owner chooses to bring into it. That can include:
- Wearable data from Oura. When the account owner authorizes the Oura integration, the dashboard retrieves data through the Oura API within the scopes granted at authorization: personal profile and email, daily summaries (sleep, readiness, activity), heart rate, workouts, sessions, tags, SpO2, stress, heart-health metrics, and ring configuration.
- Other health records the owner adds himself. Laboratory results, genomic data, body-composition scans, glucose-monitor exports, and protocol notes.
- Technical data. Standard server logs (IP address, browser type, timestamps) generated by the hosting platform.
03How data is used
Data is used for one purpose: to display and analyze the account owner's own health information inside his private dashboard. Oura data is shown alongside other personal health data so trends can be read in one place. It is not used for advertising, profiling of other people, model training, or resale.
04How data is stored and protected
- The dashboard is served over HTTPS and is protected by a password gate. Only the account owner can view it.
- Oura access and refresh tokens are encrypted at rest before they are stored.
- Data lives in a private database hosted by Neon (Postgres) and an application hosted by Vercel. Both act as infrastructure providers only and do not use the data for their own purposes.
05Sharing
Personal data is not sold, rented, or shared with third parties. The only parties that process it are the infrastructure providers named above and Oura itself as the source of wearable data, each under their own terms. Data may be disclosed if required by law.
06Retention and deletion
Oura data is kept for as long as the Oura integration stays connected. Disconnecting the integration inside the dashboard, or revoking access from the Oura account settings, stops further retrieval. Stored Oura data and tokens are deleted on request to jay@jayspall.com. Other health records are retained at the account owner's discretion.
07Your rights
Because this is a single-user service, the account owner controls all of the data. Anyone who believes their information has been stored here in error can request access, correction, or deletion by email and will receive a response within 30 days.
08Children
This service is not directed to anyone under 18 and does not knowingly collect data from minors.
09Oura
Oura and the Oura Ring are trademarks of Oura Health Oy. The Cipher Project is not affiliated with, endorsed by, or sponsored by Oura. Use of the Oura API is governed by the Oura API Agreement. Oura's own handling of your data is described in Oura's privacy policy.
10Changes
Updates to this policy are posted on this page with a new effective date.