Privacy Policy

1. Data We Collect Through Google Health

When you connect your Google account to our platform, we request access to the following Google Fit / Google Health data scope:

• Fitness activity data — including activity type, duration, distance, start time, and end time of recorded workouts and exercise sessions.
• Basic Google account information — your Google account ID and email address, used to link the connection to your HRC account.

We do not request or collect the following data through this integration:

• Location data or GPS routes
• Health metrics such as heart rate, sleep, body weight, or nutrition
• Medical records or insurance information
• Contacts, calendars, drive files, or any other Google service data

2. How We Use Your Data

We use the data collected through Google Health for the following purposes:

• Activity auto-sync — Automatically importing your fitness activities into the active Monthly Challenge so they count toward your points, streaks, and leaderboard standing.
• Deduplication — Storing the Google activity identifier to prevent the same activity from being imported more than once.
• Account linking — Associating the imported activities with your HRC user account so they appear in your profile and challenge summaries.

We do not use your Google Health data to build advertising profiles, sell data to third parties, or train machine learning models. Your activity data is never passed into AI models.

3. Data We Store

To maintain the connection and import activities, we store the following on our secure servers:

• OAuth tokens — An encrypted access token and refresh token that allow us to periodically fetch new activities on your behalf. The refresh token is only issued on your first consent and is stored securely.
• Google account ID and email — Used to identify which Google account is linked to your HRC account.
• Imported activity records — The activity type, distance/duration, date, and calculated points for each imported workout. These are stored as Monthly Activity records associated with your account.

4. Data Sharing and Disclosure

We do not sell, rent, or share your Google Health data with any third party. Your imported activities are visible to other challenge participants only in the aggregate form already displayed on the challenge leaderboard and activity feed (name, activity type, and points) — the same visibility as manually logged activities. We may disclose data only when required by law, court order, or government regulation.

5. Data Retention

We retain your Google Health connection data for as long as your account is connected. If you disconnect Google Health from your profile, we immediately revoke and delete the stored OAuth tokens. Previously imported activity records remain on your account as challenge history (identical to manually logged activities) unless you separately request their deletion.

6. Your Rights

You have the following rights regarding your Google Health data:

• Right to disconnect — You may disconnect Google Health at any time from your profile page. This revokes our access and deletes stored tokens immediately.
• Right to access — You may request a copy of the Google Health data we have stored about you.
• Right to deletion — You may request that we delete your imported activity records and connection data.
• Right to revoke Google permissions — You may also revoke access directly from your Google Account security settings at any time.

To exercise any of these rights, contact us at contact@heartlandracingco.com.

7. Data Security

We protect your OAuth tokens and personal data using industry-standard security measures, including encrypted storage, access controls, and secure communication protocols (HTTPS/TLS). Access to token data is restricted to authorized platform services and administrators. We do not store tokens in client-accessible code or expose them in the browser.

8. Google's Role and Your Google Account

This integration uses Google APIs in accordance with Google's API Services User Data Policy, including the Limited Use requirements. We only transfer data to Google as necessary to maintain the connection (e.g., refreshing tokens). We do not use Google Health data for advertising or pass it to any other Google service. You can review and revoke this app's access to your Google account at any time by visiting myaccount.google.com/permissions.

9. Single-Service Constraint

Our platform allows only one activity-tracking integration at a time. If you connect Google Health while STRAVA is already connected, we will automatically disconnect STRAVA and notify you. This prevents duplicate activity imports and keeps your challenge data accurate.

10. Children's Privacy

This integration is not directed at children under the age of 13, and we do not knowingly collect Google Health data from children under 13. If you believe a child has connected their Google account, please contact us so we can remove the data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our handling of your Google Health data, please contact us: