Privacy policy

Who we are

Cordaya is an Android app made by an independent developer. Questions about this policy go to hello@cordaya.app.

What the app reads

Cordaya reads the Health Connect data types you allow on Android's permission screen. You can allow or refuse each type individually, and change your choice at any time in Health Connect.

The app can ask for the types below. Its dashboard screens use activity, sleep, heart and workout data, and the All health data screen lets you browse any other type you allow. Cordaya only reads: it never writes to Health Connect, and it doesn't read in the background.

• Activity: steps, distance, active and total calories burned, exercise sessions and routes, planned exercise, activity intensity, elevation gained, floors climbed, speed, power, wheelchair pushes and VO2 max.
• Sleep: sleep sessions and stages.
• Vitals: heart rate, resting heart rate, heart rate variability, blood pressure, blood glucose, oxygen saturation, respiratory rate, and body, basal body and skin temperature.
• Body measurements: weight, height, body fat, lean body mass, bone mass, body water mass and basal metabolic rate.
• Nutrition and hydration.
• Cycle tracking: menstruation, intermenstrual bleeding, cervical mucus, ovulation tests and sexual activity.
• Mindfulness sessions.
• Health records, on phones that support them: allergies and intolerances, conditions, lab results, medications, personal details, practitioner details, pregnancy, procedures, social history, vaccines, visits and vital signs.
• Past data: records older than 30 days, if you allow history access.

Where data lives

On your device only. Cordaya keeps a local cache on the phone, encrypted, so screens load quickly. There are no Cordaya servers and no accounts. App backups are turned off, so the cache is not copied to cloud backup.

What leaves the device

Nothing, unless you connect Ultrahuman. If you paste your personal Ultrahuman token, Cordaya sends requests to Ultrahuman's official API over HTTPS asking for your daily scores and related metrics for a given date. The responses are stored on your phone, like everything else. The token is encrypted with the Android Keystore.

Without a token, the app makes no network requests at all. A version with no internet permission is planned for people who don't use Ultrahuman.

Analytics

None at present. Cordaya has no analytics, ads or tracking SDKs. If opt-in usage analytics are added later, this policy will be updated first, and they will never include health data.

Joining the beta

The closed beta runs through a Google Group and Google Play's testing program. Joining is optional and separate from using the app.

What we see: the email address of the Google account you join the group with, and the name you join with. Only we can see the member list. Google Play needs that account in the group before you can install the beta. If you email us instead, we see your email address and what you write.

Why: only to let you into the beta and to post beta news and the invite link to the group. We don't use it for anything else and don't share it.

Where: in Google Groups and Google Play Console, under Google's privacy policy. We don't copy the list anywhere else. cordaya.app itself stores nothing and sets no cookies.

How long: until you leave. We delete the group, and beta emails to hello@cordaya.app, within 30 days after the beta ends.

To leave the beta:

• Leave the group: on a computer, open the cordaya-beta group at groups.google.com and choose Leave group. Or send an empty email to cordaya-beta+unsubscribe@googlegroups.com.
• Leave the test: in the Play Store, tap your profile picture, then Manage apps & devices, then Beta, choose Cordaya and tap Leave.
• Or email hello@cordaya.app and we'll remove you.

How to remove your data

Any of these removes what Cordaya holds:

• Clear the app's cache in Cordaya's Settings.
• Revoke Cordaya's access in Health Connect.
• Remove the Ultrahuman token in Connections.
• Uninstall the app, which deletes everything it stored.

Children

Cordaya is not directed at children under 13, or the applicable age in your country.

Changes and contact

When this policy changes, the date at the top is updated. Contact: hello@cordaya.app.