Fitness data privacy: Oura, Whoop, Garmin — and the no-cloud option

Journal · 2026-09-15 · R. Klug · All notes

Read in: Deutsch · Français · Español · Italiano

A night of sleep recording is health data in the fullest sense: heart rhythm, hour by hour, across years. European law treats this as a special category of personal data for a reason. Yet the default architecture of the wearable industry sends exactly this signal to a company server first — and hands you back a score. It is worth being precise about what that architecture means, without conspiracy and without marketing.

Where the data lives — and how you find out

Oura, Whoop and Garmin all follow the same pattern: the device measures, the vendor’s cloud receives, processes and stores, the app displays what comes back. What happens on the server is governed by a privacy policy — a document, written by the company, that the company can update. That is not an accusation; it is the mechanism. Policies at major wearable vendors have changed repeatedly over the years, each change followed by users trying to reconstruct what it means for data already uploaded. With a policy, your protection is a promise. With architecture, it is a property. A server that does not hold your nights cannot lose them, sell them, or reinterpret its obligations toward them.

The second, quieter issue: resolution

Privacy debates focus on who sees your data. The more everyday frustration is that you don’t. Cloud platforms return processed metrics — a nightly average, a readiness number, a sleep score — while the underlying signal, the beat-to-beat intervals behind your night, generally stays inside the pipeline. The pattern shows up at the edges: export functions that produce summaries rather than signals, one vendor’s web CSV export discontinued, another’s public API retired, third-party access tightened. Each decision is defensible in isolation. The sum is a market where you can wear a sensor every night for five years and never once see what it measured — only what the current algorithm concluded.

What the no-cloud option looks like

ampulse runs the pipeline in the opposite direction. The sensors — Polar Loop for nights, an RR-capable chest strap for training — sync over Bluetooth to your iPhone, and recordings are stored there as readable files: every interval, with quality information attached. There is no ampulse account and no ampulse server holding health data; the app computes its statistics from the files on the phone, and the files export at any time as FIT, CSV or Kubios-compatible RR. The hardware itself comes from Polar — a Finnish company building heart rate instruments since 1977 — and the data processing happens nowhere but in your hand.

Honesty requires naming the network paths that do exist, because “no cloud” as an absolute would be false: a Strava upload you trigger sends that session to Strava; a Loop firmware update contacts Polar’s firmware service; an iCloud Drive folder, if you enable it, mirrors files under your Apple ID; and anything you share with a cloud assistant reaches that provider. Every one of these is an action you take, with a counterpart you can name — not a background condition of using the app.

“Forever yours” has a technical meaning

Subscription platforms hold your history in an account; lapse the subscription or lose the account, and access to years of your own physiology is at the vendor’s discretion. A file has no such dependency. Nights recorded with ampulse remain on your phone and in your exports if you cancel, if the app is discontinued, or if you simply move on — readable by Kubios, intervals.icu, a spreadsheet, or software that hasn’t been written yet. Ownership of health data is not a sentence in a policy. It is the answer to one question: if every company involved disappeared tomorrow, would you still have the record?