OdinEye Privacy Policy

1. Core Privacy Philosophy

Welcome to OdinEye ("we", "our", or "the Application"). Package Identifier: com.odineye.health.

• No Cloud Servers: We do not operate, host, or maintain centralized cloud databases or telemetry backends.
• Hardware-Backed Encryption: Telemetry caches and medication schedules are encrypted with AES-256-CBC with PBKDF2 key derivation.
• Zero Data Monetization: We never sell, rent, broker, trade, or monetize your health information under any circumstances.

2. Information We Access and How It Is Handled

2.1 Android Health Connect Permissions (Strictly Read-Only)

With your explicit, granular permission granted via Android Health Connect, OdinEye reads the following biometric and activity data types to generate your daily equilibrium scores and 4-stage sleep hypnogram:

Strict Read-Only Access: OdinEye accesses Android Health Connect strictly in read-only mode. The Application never writes, edits, alters, or deletes any records in your Health Connect store.

2.2 Third-Party Fitness Wearable APIs (Client-Side Direct)

If you choose to sync third-party wearables (Ultrahuman Ring AIR, Fitbit Web API, Hevy Strength), OdinEye connects directly from your smartphone via secure HTTPS using credentials you provide. No tokens or biometrics ever transit through any intermediary servers.

2.3 User-Inputted Health Data

Any information you record directly—such as medication names, schedules, dosages, completed breathwork sessions, and self-reported mood ratings—is stored strictly within your phone's sandboxed encrypted storage.

3. Google Play Health Connect Policy & Limited Use Disclosure

OdinEye strictly complies with the Google Play Health Connect Developer Policy and its Limited Use Requirements:

1. Specific Permitted Use Only: Health Connect data is accessed exclusively to calculate and display user-facing health, sleep, and recovery metrics directly inside the OdinEye application UI.
2. No Sale or Transfer: We NEVER sell, license, rent, or transfer Health Connect data to any third party, advertising exchange, or data aggregator.
3. No Advertising or Marketing: Health Connect data is NEVER used or disclosed for personalized advertising, retargeting, promotional campaigns, or consumer profiling.
4. No Creditworthiness Assessment: Health Connect data is NEVER used to evaluate creditworthiness, consumer credit eligibility, or insurance underwriting.
5. No Human Access: No human is permitted to read or inspect your Health Connect data under any circumstances.

4. Artificial Intelligence & Telemetry Processing Disclosures

• Android AICore / Gemini Nano: Local speech-to-text transcription and clinical reasoning execute directly on-device without internet access.
• Offline Sports Science Engine: Fallback deterministic sports science rules engine runs locally with zero network requests.
• Optional Cloud API Fallback: If you explicitly choose to provide a personal Google Gemini API key on unsupported legacy hardware, prompts are sent directly to Google AI Studio via encrypted HTTPS under Google's Terms of Service. This is disabled by default.

5. Cryptographic Vault & Storage Security

OdinEye applies defense-in-depth cryptographic security to safeguard your data:

• AES-256-CBC: Industry-standard symmetric cipher encrypting SQLite databases at rest.
• PBKDF2 Key Derivation: 10,000 rounds with HMAC-SHA256 and cryptographically random salts.
• Android Hardware Keystore: Master cryptographic keys are generated and protected by hardware security enclaves.
• Linux Mode 0700: Database files are isolated exclusively to the private application sandbox, inaccessible to other apps.

6. In-App Data Deletion & User Control

In full compliance with Google Play’s Account and Data Deletion Policy, you maintain complete and permanent authority to wipe all stored data at any moment without contacting support:

1. Open OdinEye and tap the Config (Settings) tab.
2. Scroll to Category 04: Hardware Security & Vault Audit.
3. Tap Wipe Vault & Delete Keys.

What happens immediately: All encrypted API keys, medication reminders, mood check-ins, sleep caches, and hardware Keystore entries are permanently wiped. Because we maintain no cloud databases, no residual copies remain anywhere.

7. GDPR & CCPA/CPRA Legal Compliance

Under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA), users are entitled to rights of access, erasure, restriction, and portability:

• Right of Access & Portability: All personal data is immediately accessible to you in the OdinEye UI and local database.
• Right to Erasure (Right to be Forgotten): You can erase all data instantly using the in-app "Wipe Vault" tool or by uninstalling the application.
• Do Not Sell My Personal Information: OdinEye does not sell or share personal health information. Zero commercial data brokers have access to your metrics.

8. Children’s Privacy Protection

OdinEye is not directed toward children under 13 years of age (or under 16 in the European Union). We do not knowingly collect or solicit personal information from children. If you believe a minor has installed the Application without guardian consent, please contact us or delete the application from the device.

9. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect new open-source capabilities or regulatory guidelines. When changes occur, the updated policy will be published here with a revised "Last Updated" timestamp. Continued use of OdinEye indicates acceptance of the updated terms.

10. Contact & Privacy Inquiries

For inquiries, security disclosures, or questions concerning this Privacy Policy, please contact our team:

• Email: support@odineye.health
• GitHub Security: github.com/Novartus/odin-eye/security
• Application Package: com.odineye.health