Privacy Policy

01. About this policy

OmniBand is operated by C&Si Unlimited Space Innovation Technology (Shenzhen) Co., LTD (“we”, “us”, or “our”).

This policy describes how OmniBand processes information when you create an account, connect supported health providers or Google Calendar, import Apple Health files, and use your dashboard and calendars. Provider services have their own privacy policies.

02. Information we process

• Account information: your email address or phone number, account profile, and authentication information used for registration, sign-in, and account recovery.
• Connected health information: records made available by Oura, WHOOP, or Google Health (Fitbit) under the permissions you grant. Depending on your source, these may include sleep, activity, workouts, heart rate, and recovery metrics.
• Google Calendar information: your Google account identifier and email, calendar identifiers, names, time zones and access permissions, and event information returned for connected calendars. Event information can include titles, descriptions, locations, start and end times, recurrence, reminders, status, and organizer or attendee information present in provider responses.
• Imported information: the Apple Health ZIP file you upload, supported records extracted from it, and import progress information.
• Connection and service information: provider authorization credentials held by the backend, synchronization status, and operational information needed to deliver and troubleshoot the service.

03. How information is used

OmniBand uses account information to authenticate you and manage your session. Connected and imported health information powers the dashboard, provider views, readings, and trends you request. Connection and import status helps show whether data is available and whether an operation needs attention.

Google Calendar information lets you identify your connected account, choose calendars, view events, and synchronize supported event fields between OmniBand and Google. After authorization, OmniBand can create Google copies of local calendars. For connected calendars, synchronization can create, update, and delete Google events as corresponding changes occur in OmniBand, and import changes made in Google. Synchronization continues on our servers while the connection is active.

The application uses session cookies for authenticated requests. The browser does not store or refresh provider access or refresh tokens. It may store an Apple Health import job identifier and calendar connection identifiers locally to restore progress and interface state.

04. Google Health & Calendar data

Connecting Google Health (Fitbit) or Google Calendar sends you to Google’s authorization flow. Review the consent screen for the exact permissions requested. The health integration requests read-only access to activity and fitness, health metrics and measurements, and sleep. It does not write changes to Google Health. Calendar authorization separately requests account identification, calendar listing, calendar creation and properties, and event access needed for the synchronization described above.

OmniBand’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Use of information received from the Google Health API and Developer Tools also adheres to the Google Health API Developer and User Data Policy, including its Limited Use requirements. Human access and transfers are limited to the purposes and exceptions permitted by those policies.

You can review or remove Google account connections at Google Account connections. Other providers offer access controls in their account settings.

05. Sharing & security

Connecting a provider involves exchanging authorization and data requests with that provider. Google Calendar receives calendar and event information when OmniBand performs authorized synchronization. Hosting providers process stored information, files and operational logs to run the service.

For users in mainland China, OmniBand uses Volcengine cloud services and stores their data in China. For users outside mainland China, OmniBand uses Amazon Web Services (AWS) and stores their data in Singapore. Depending on where you live, this involves processing outside your country.

We process Google Health and Google Calendar data within OmniBand’s internal systems. We do not send this data to external AI services for processing.

The application loads fonts from Google Fonts. Your browser sends Google the network and browser information needed to retrieve those fonts; health and calendar records are not included in font requests. Messages you send to our support email are processed by the email services delivering that correspondence.

Our public website uses HTTPS. Backend services check authenticated requests before serving account data, and provider authorization credentials are kept on the server rather than in browser storage. Health-provider access and refresh tokens are encrypted by the Health service before database storage. These measures do not amount to a guarantee of absolute security. Keep your account credentials private and use a trusted device.

06. Retention & deletion

Account information, imported health records, and stored calendar records have no preset automatic expiration. They remain until deleted through an available feature or in response to your deletion request.

We retain original uploaded files, operational logs, and backups for no longer than 30 days; some are removed earlier. This period does not apply to records extracted from uploaded files or retained through synchronization, which follow the record retention rule above.

To request account closure or deletion of your health or calendar information, email developer@csi.space and specify the account and data your request concerns. Requests are handled manually, and we complete deletion within 30 days of receiving your request. This is an email-based process, not an automatic account deletion action in the application.

Revoking provider access prevents future access under that authorization; it does not by itself delete information already imported into OmniBand or copies in your Google Calendar. Deleting an event while two-way synchronization is active can also delete its synchronized counterpart. To request deletion of information retained by OmniBand, contact us using the email above.

07. Your choices

You choose whether to connect a provider or upload an Apple Health file. You can decline provider permissions or revoke an existing authorization in the provider’s settings; features requiring that data may then be unavailable.

Depending on where you live, you may have rights to access, correct, export, or delete personal information and to object to or restrict certain processing. Contact developer@csi.space with privacy questions or requests to exercise your rights.

08. Contact & updates

For support, privacy inquiries, account closure, or data deletion requests, email developer@csi.space.

We publish updates on this page and update the date above. Material changes to how Google data is collected, used or shared will be disclosed before the new processing begins, with consent requested where required.

Our terms of service are a separate document and remain a development draft until their terms and effective date are determined.