How Dash handles your data
The other tools on kelvinct.com run entirely in your browser and send nothing anywhere. Dash cannot work that way, and it would be dishonest to imply otherwise.
Why Dash needs a server
Two reasons. Connecting WHOOP or Oura requires a secret that would be readable by anyone if it lived in your browser. And the display page has to render on devices too old to run the code that would fetch your data, so a server has to fetch it and send finished HTML.
What is stored
- Your access and refresh tokens for each provider you connect, encrypted at rest with AES-256-GCM. They are never sent to your browser.
- Your most recent value for each metric. Only the latest one. Dash keeps no history.
- Your display links, which metrics you chose, and your refresh setting.
That is the whole list. No name, no email, no password. Connecting a provider is how you sign in, so there is no account to create.
What is not stored, sent, or logged
- No health values reach analytics. Dash does not run third-party analytics at all.
- No tokens appear in URLs or in logs.
- Nothing is sold, shared, or used to train anything.
Display links
A display link contains a random 32-byte token. It is a key, not a username: anyone holding the link sees those numbers, so treat it like a password. It is not guessable and never appears in search results. You can revoke any display from your dashboard, which kills that link immediately.
Disconnecting
Disconnect a provider from your dashboard and Dash deletes its tokens and its cached metrics. You can also revoke Dash's access from inside your WHOOP or Oura account, which has the same effect from the other direction.