Privacy policy

Effective date: 12 October 2026.

Shim is a private, owner-operated integration used only by its owner to retrieve their own Oura data. It has no public accounts, registrations, advertising, analytics, or user submissions.

Data processed

When authorised by the owner, the integration reads Oura data permitted by the OAuth consent screen, which can include daily activity, sleep, readiness, heart-rate, workout, session, tag, SpO2, stress, heart-health, ring-configuration, profile, and e-mail data. Only the categories selected during Oura consent are requested.

Use and storage

Data is used solely for the owner’s personal health summaries and analyses. OAuth credentials are stored on the owner’s secured server and in the owner’s credential vault. The integration does not sell, rent, publish, or share Oura data with other people or services.

Control and deletion

The owner can revoke access at any time from Oura’s connected-app settings. Revocation stops future API access. Local credentials and any derived data can be removed by the owner from the private integration environment.

Security

The service uses HTTPS for the OAuth redirect and restricts credentials to the private server environment. No security method can guarantee absolute protection, but access is limited to the owner and to the minimum systems needed to run the integration.