Privacy Policy

Your Fitness O.R.R.A. · Updated October 26, 2026

This policy describes how the current O.R.R.A. trainer workspace handles information, including its optional Google Calendar connection. For privacy questions or deletion requests, contact orrakelly@gmail.com.

Information in the workspace

Authorized users can enter client information, workout plans and results, session and package records, wellness information, notes, class plans, and appointment times. O.R.R.A. stores this information to provide the trainer workspace. Access is limited by the application's configured accounts and permissions.

Google information we access and use

Connecting Google Calendar is optional. O.R.R.A. checks the connected Google account's verified email address to confirm that it is the designated calendar account. The connection requests basic sign-in identity and the calendar.app.created permission: creating secondary calendars and viewing, creating, changing, and deleting events on calendars the app creates.

O.R.R.A. creates a dedicated calendar and reads its events to compare them with O.R.R.A. appointments, prevent duplicates, and detect conflicts. It can create and update appointment markers and cancel app-managed events when their source appointments are removed or excluded. It does not request permission to read or modify unrelated calendars, or import personal calendar events into the workspace.

Events sent to Google contain the generic title “Training appointment,” start-time information in America/Denver, a short transparent marker, a reminder, and private identifiers that link the event to its O.R.R.A. appointment and session. They do not contain client names, workout notes, or wellness details.

Storage and security

O.R.R.A. runs on Cloudflare Workers and stores application records in Cloudflare D1. Google access and refresh tokens are encrypted before storage; the encryption key and OAuth client credentials are stored as Worker secrets. Calendar identifiers, event mappings, synchronization status, and change history support reliable synchronization. Google and Cloudflare process information needed to deliver their respective services. Network requests also expose technical connection information to these providers.

Google tokens are used for the calendar functions described here. O.R.R.A. does not sell Google user data, use it for advertising, or use it to train generalized artificial intelligence or machine-learning models. O.R.R.A.'s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Authorized integrations

Authorized users may use connected assistant tools to read or manage workspace records according to their permissions. Those interactions can disclose requested workspace information to the assistant service the user chooses. O.R.R.A. does not provide Google OAuth credentials or stored Google tokens through those tools.

Retention, revocation, and deletion

Workspace records and calendar connection records are retained to operate the service unless removed through available controls or by an administrator. Operational backups or archives can retain prior copies. Temporary Quick Notes follow their in-app retention controls.

You can pause synchronization in O.R.R.A. and revoke its Google access at Google Account connections. Revocation stops future authorized Google access; it does not by itself erase stored workspace records or events already created in Google Calendar. You can remove the app-created calendar using Google Calendar's controls.

To request deletion of stored Google connection information, synchronization records, or workspace information, contact orrakelly@gmail.com. An administrator may need to confirm the requester's authority before changing shared training records. Do not send passwords or secret values with a request.

Changes and contact

We will update the date above when these practices change. Privacy and support contact: orrakelly@gmail.com.