Security
Last updated: May 13, 2026
We take the security of your data seriously. This page describes how we protect your information at every stage of the pipeline.
1. Password Handling
Your Garmin password is never stored. It is used exactly once during the initial authorization to perform a token exchange with Garmin Connect. The password exists only in memory for the duration of this exchange and is immediately discarded afterward. It is never written to disk, never logged, and never transmitted to any system other than Garmin's authentication servers.
2. Token Encryption
After the one-time authorization, the resulting Garmin session token is encrypted at rest using Fernet symmetric encryption (part of the Python cryptography library). Fernet provides:
- AES-128-CBC encryption for confidentiality
- HMAC-SHA256 for authentication and tamper detection
- Timestamped tokens to prevent replay attacks
The encryption key is stored separately from the encrypted tokens.
3. Data in Transit
- All communication with Garmin Connect uses HTTPS (TLS 1.2+).
- All communication with our backend API uses HTTPS.
- Email delivery through Resend uses TLS encryption.
- The landing page and all web assets are served over HTTPS via Vercel.
4. Infrastructure
- Frontend: Static site hosted on Vercel with automatic HTTPS, DDoS protection, and edge caching.
- Backend: Runs in an isolated Docker container with limited network access.
- Database: SQLite database stored on the backend server, not exposed to the internet. Contains only health metric summaries, not raw Garmin API responses.
5. Email Security
Reports are delivered via Resend using TLS-encrypted connections. We use SPF, DKIM, and DMARC records to help prevent email spoofing and ensure report emails are authenticated.
6. AI Processing
When health metrics are sent to the LLM API for analysis, they are transmitted as anonymized numerical data only. No personal identifiers (name, email, Garmin username, or account ID) are included in AI requests. The LLM provider does not receive any information that could identify you as an individual.
7. What We DO Protect
- Garmin authorization tokens (encrypted at rest)
- Your email address (stored securely, used only for delivery)
- Health metric summaries (stored in a non-public database)
- All data in transit (HTTPS/TLS everywhere)
8. What We Do NOT Store
- Your Garmin password (used once, immediately discarded)
- Raw Garmin API responses beyond extracted metrics
- Personal health records or medical information
- GPS or location data
- Personal identifiers in AI processing requests
9. Responsible Disclosure
If you discover a security vulnerability in our Service, we ask that you disclose it responsibly. Please email us with details of the vulnerability, steps to reproduce, and any relevant supporting information. We will acknowledge receipt promptly and work to address the issue.
安全说明
最后更新：2026 年 5 月 13 日
我们非常重视您的数据安全。本页面介绍我们在整个数据流程中如何保护您的信息。
1. 密码处理
您的 Garmin 密码绝不会被存储。它仅在初始授权过程中使用一次，用于与 Garmin Connect 进行令牌交换。密码仅在内存中存在于交换过程的持续时间内，之后立即销毁。密码绝不会写入磁盘、绝不会被记录在日志中，也绝不会传输给除 Garmin 认证服务器之外的任何系统。
2. 令牌加密
一次性授权完成后，生成的 Garmin 会话令牌使用 Fernet 对称加密（Python cryptography 库的一部分）进行静态加密。Fernet 提供：
- AES-128-CBC 加密确保机密性
- HMAC-SHA256 确保认证和防篡改
- 带时间戳的令牌防止重放攻击
加密密钥与加密令牌分开存储。
3. 传输中的数据
- 与 Garmin Connect 的所有通信均使用 HTTPS（TLS 1.2+）。
- 与我们后端 API 的所有通信均使用 HTTPS。
- 通过 Resend 的邮件投递使用 TLS 加密。
- 落地页和所有网页资源通过 Vercel 的 HTTPS 提供。
4. 基础设施
- 前端：静态站点托管于 Vercel，具备自动 HTTPS、DDoS 防护和边缘缓存。
- 后端：运行在隔离的 Docker 容器中，网络访问受限。
- 数据库：SQLite 数据库存储在后端服务器上，不暴露于互联网。仅包含健康指标摘要，不包含原始 Garmin API 响应。
5. 邮件安全
报告通过 Resend 使用 TLS 加密连接投递。我们配置了 SPF、DKIM 和 DMARC 记录，以防止邮件欺诈并确保报告邮件经过认证。
6. AI 处理
当健康指标被发送到 LLM API 进行分析时，它们以仅包含匿名化数值数据的形式传输。AI 请求中不包含任何个人标识信息（姓名、邮箱、Garmin 用户名或账户 ID）。LLM 提供商不会收到任何可以识别您个人身份的信息。
7. 我们保护的内容
- Garmin 授权令牌（静态加密存储）
- 您的邮箱地址（安全存储，仅用于投递）
- 健康指标摘要（存储在非公开数据库中）
- 所有传输中的数据（全程 HTTPS/TLS）
8. 我们不存储的内容
- 您的 Garmin 密码（使用一次后立即销毁）
- 超出提取指标范围的原始 Garmin API 响应
- 个人健康记录或医疗信息
- GPS 或位置数据
- AI 处理请求中的个人标识信息
9. 负责任的安全披露
如果您发现本服务中的安全漏洞，请以负责任的方式披露。请通过邮件发送漏洞详情、复现步骤和任何相关的支持信息。我们将及时确认收到并着手解决问题。
Garmin Daily Report is not affiliated with Garmin Ltd. or its subsidiaries. Garmin and Garmin Connect are trademarks of Garmin Ltd.