Monday. Last updated 12 September 2026.
Monday is a personal application with a single user, its author. It is not published to an app store and has no other users, no analytics, no advertising and no third-party trackers.
With the user's explicit consent, Monday reads that user's own health data from the Google Health API, under these scopes:
googlehealth.ecg.readonly, for electrocardiogram readings recorded by the user's watch.googlehealth.health_metrics_and_measurements.readonly, for the vital sign measurements shown alongside them.Both are read-only. Monday never writes to, modifies or deletes anything held in a Google account.
To compute heart rate variability from the raw electrocardiogram waveform, and to show recent vital signs on the user's watch. The measurement happens so that the numbers come from a signal that can be inspected rather than from an opaque daily summary.
Nowhere. Health data is requested by the user's own phone, analysed on that phone, and displayed on that phone and its paired watch. It is not uploaded to any server operated by the author, is not shared with any third party, is not sold, and is not used to train any model.
OAuth tokens are stored only on the user's device, in Android's encrypted preferences, protected by a key held in the device keystore. Health readings are held in memory for the duration of a request and are not written to a database or a log. No copy of the data outlives the screen that shows it.
Access can be revoked at any time at myaccount.google.com/permissions, which immediately and permanently stops Monday from reading anything further. Clearing the app's data removes the stored tokens from the device.