Your data.
Your perspective.

Data-use notice · Updated 4 November 2026

This experimental web application helps you organize your own wearable measurements, nutrition entries and health records. It is not a medical diagnostic service. The operator and contact is Tobia Donadon: tobia@donadon.com.

What you choose to store

Your account email and profile name; meals and nutrition facts you save; blood-test values, dates, units, laboratory ranges and notes you enter; and reports or reference photos you upload. Your onboarding choices include your age, gender, display preference and optional participation in peer comparisons. Your display can use an approved AI portrait based on a private uploaded photo, a digital Vitruvian figure or statistics alone. Neither a photo nor an illustration measures body composition.

Connecting WHOOP

Live WHOOP sync is part of Xeyo Pro and is limited to a small number of members while WHOOP reviews Xeyo’s app. Everyone can bring WHOOP data in for free by uploading WHOOP’s data export (see below). With Pro, you can authorize the application through WHOOP’s own sign-in screen. With your permission, the application imports available recovery, sleep and cycle (daily strain) measurements, including heart rate, HRV, oxygen saturation, sleep duration, respiratory rate and recovery score. Availability depends on your device and WHOOP account. We do not receive your WHOOP password. Authorization tokens are encrypted on the server. Choose Disconnect in Integrations to revoke access. Imported measurements remain in your records unless you request their removal. If your Pro subscription ends, Xeyo revokes its WHOOP access and deletes the stored tokens; your readings stay.

Uploading your WHOOP data export

You can request your data export from WHOOP; WHOOP emails you a download link. When you upload the zip or its CSV files (physiological_cycles, sleeps, workouts and journal_entries), the files are read in your browser and you see a preview of the dates and row counts before anything is saved. Only the supported measurements (recovery, heart rate, HRV, oxygen saturation, skin temperature, sleep and its stages, strain, calories and workouts) and your journal answers (the question, your yes/no answer and any note you wrote in WHOOP) are uploaded and stored in your account. The original files are not uploaded and are never sent to AI. Uploading the same export again updates the existing entries instead of duplicating them. Xeyo keeps the date of each upload to remind you when a fresh export would bring in newer days.

Connecting Garmin

You can authorize the application through Garmin’s own sign-in screen. With your permission, Garmin sends Xeyo your daily summaries, sleep, heart rate variability, oxygen saturation, respiration, body composition and activities as they sync from your device. We do not receive your Garmin password. Authorization tokens are encrypted on the server. Choose Disconnect in Integrations to stop the connection; Xeyo then asks Garmin to deregister it. Imported measurements remain in your records unless you request their removal.

How Garmin data is used. Garmin data is used only to show you your own readings, trends and comparisons with your own earlier days, inside your own account. It is not sold, not shared for advertising and not shared with any other member. Garmin data is stored by Supabase (database and server, hosted in the United States, US East); the app itself is delivered by Vercel. No other third party receives Garmin data.

Garmin data and AI. Garmin data is never sent to an AI system: it is left out of Ask Xeyo, journal reflections and the Weekly Health Report, whichever AI provider you use, and it is never used to train, evaluate or improve any AI model.

Your control. You can see every Garmin reading in the app and download all of your data from Profile. To correct or delete readings, or delete your whole account, write to the address at the end of this page and we will do it. You can withdraw your permission at any time by choosing Disconnect in Integrations or removing Xeyo in Garmin Connect; Xeyo then stops receiving Garmin data.

Connecting Fitbit (Google Health)

Fitbit data now lives in your Google account. You can authorize the application through Google’s own sign-in screen to read your Google Health data: sleep and sleep stages, resting heart rate, heart rate variability, oxygen saturation, breathing rate, steps, active calories, weight and body fat. We do not receive your Google password. Authorization tokens are encrypted on the server. Your Google Health data is used only to show you your own readings in Xeyo; it is not sold, used for advertising, or used to train any AI model. Xeyo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Health API Developer and User Data Policy, including the Limited Use requirements. Choose Disconnect in Integrations to revoke access, or remove Xeyo under Third-party connections in your Google Account.

Xeyo AI

Xeyo AI is included with your plan. If you have not connected your own AI provider, the messages you send in Ask Xeyo, the meals you describe or photograph for analysis, and journal notes you choose to reflect on are processed by Anthropic (Claude) on Xeyo’s account. Your readings are included only when you tick the option to share them. Anthropic does not use this data to train its models. Wearable data is never used to train any AI model. If you connect your own provider, that provider is used instead.

Plans and payments

Xeyo has a Free plan and Xeyo Pro (€5 a month). Pro subscriptions are processed by Stripe. When you start checkout from the app, Stripe receives your account email and an account reference so the payment can be linked to your account. Xeyo stores your subscription status, its Stripe customer and subscription identifiers and the end of the paid period; it does not receive or store your card details. Stripe’s privacy policy applies to payment information. On the Free plan, the app shows the last 30 days of wearable readings; older readings are kept in your account, appear again with Pro, and are always included in your data export.

Weekly Health Report

With Pro, Xeyo prepares a weekly summary of your recovery, sleep and strain trends with three suggested actions. To write it, a summary of your own weekly figures is sent to Anthropic’s Claude through Xeyo’s account (see Xeyo AI); if that is unavailable, the report is written from your figures without AI. If you turn on the weekly email, the report is sent to your account email through our email provider, Resend. You can turn the email off at any time.

Storage and access

Account services, data and private files are hosted by Supabase in the United States (US East). Database ownership rules restrict access to your account. File downloads use expiring links. The website and web app are hosted by Vercel. The operator and hosting providers may access data where needed to operate, maintain or support the service; private does not mean end-to-end encrypted.

Optional food analysis

Manual meal entry does not require AI. You can connect your own OpenAI API key in Profile. It is encrypted on our server, never returned to the browser, and can be replaced or removed. Removing it from this app does not revoke it at OpenAI. Provider usage is billed to your own OpenAI account. When you request analysis, your meal descriptions, dish or label images and corrections are sent to OpenAI for nutrition estimation, or, if you have not stored an OpenAI nutrition key, to the AI provider you connected in Profile. Voice recordings are sent to OpenAI for transcription. Photo-based portions and nutrition values are estimates. Submitted meal photos and recordings are processed transiently and are not stored in your journal; estimated food entries are saved automatically after analysis. We request that OpenAI not store the model response, but the provider may retain service or abuse-monitoring logs under its own policies. Review saved estimates and use Edit or Undo to correct them. These features do not infer blood glucose, inflammation or body fat. Health reports are not sent for AI analysis. Reference photos are sent only when you request portrait generation, as described below.

Optional chatbot

In Chatbot you can connect OpenAI, Anthropic (Claude), Google Gemini, OpenRouter, Mistral, Groq, xAI (Grok) or DeepSeek with your own API key and model. OpenRouter forwards requests to the model vendor you select; that vendor's policies also apply. Keys are encrypted on our server and are not returned to the browser. Messages and recent conversation history for the selected provider and model are sent to that provider when you press Send. If you enable “Share my 30-day reading averages”, the request also includes averages grouped by measurement, source and unit; it excludes your name, age, gender, photos and lab reports. Conversations are saved privately in Xeyo, included in your data export, and can be cleared in Chatbot. Clearing Xeyo history does not erase data retained by the provider. Disconnecting removes the stored key; revoke the key at your provider to invalidate it there. Providers apply their own retention and billing terms. An AI response is not medical advice or a diagnosis.

Your private health journal

Check-ins are stored privately with the date you choose. You can edit or delete notes and export them from Profile. When you choose Reflect with my AI, the selected note is sent to your Chatbot provider, or to OpenAI if you have only connected your nutrition/portrait key. If you tick Include my recent wearable trends, the request also includes latest readings and seven- and thirty-day averages grouped by metric, unit and source, with dates and recorded-day counts. It excludes photos, lab reports, your identity and other journal entries. The AI reflection is stored alongside the note and clearly labelled as AI text. Editing a note removes its previous reflection; deleting a note removes both. AI output can be wrong and is not a diagnosis. Provider retention and billing terms apply.

Optional peer comparisons

With your explicit opt-in, your last 30 days of readings contribute to aggregate comparisons among participating Xeyo members in your age band. Each participant needs at least 7 recorded UTC days, and results are shown only with at least 20 other qualifying people using the same measurement, unit and source. Names, photos and individual peer readings are not disclosed. The comparison is not representative of the general population and does not assign a health score. Age bands are 18–29, 30–39, 40–49, 50–59, 60–69, 70–79 and 80+. Gender is not used for ranking. You can withdraw in Profile; future queries then exclude your readings. Existing viewed results cannot be recalled. Confirm your age yearly to stay eligible.

Health export imports

Apple Health, Fitbit/Google Health and WHOOP export files are read locally in your browser. Only supported measurements are uploaded after you confirm the import. Original archives are not uploaded or sent to AI. Imported data is labeled as a file import and retains its source. Vital signs use daily averages; weight and body composition use the latest value for each source and day. File imports do not enable automatic synchronization.

Retention, export and removal

Saved entries are retained in your account until removed. You can delete individual meals, blood results and uploaded records, and export your structured data from Profile. For complete account erasure or removal of imported wearable data, contact tobia@donadon.com using your registered email. Account deletion is currently handled by the operator. Infrastructure backups, where enabled, follow the hosting provider’s retention cycles.

Sessions and service logs

The application stores sign-in session information in your browser and temporary authentication-flow state in session storage. Hosting and authentication services keep operational logs used to troubleshoot and protect the service. This build does not include advertising trackers or sell health data. To understand where onboarding is unclear, Xeyo records simple product events in its own database (for example, that a setup step was viewed, completed or left, or that an upgrade screen was shown), linked to your account. These events contain no health readings or free text and are not shared with third parties.

Availability and choices

Live WHOOP sync requires Xeyo Pro, a free seat, a compatible WHOOP account and your consent. Garmin and Fitbit can sync automatically through your Garmin or Google account. Apple Health, Fitbit and WHOOP file imports are available to everyone as snapshots. Automatic Apple Watch synchronization is not active in this release. You can use nutrition and records without connecting a wearable. Contact the operator for questions, corrections, export or deletion requests. This experiment is intended for adults.

Return to your workspace ↗

Personal portrait generation

When you select Generate in the portrait studio, your chosen reference photo and the Xeyo style image are sent to OpenAI using your personal API key. Image generation is billed by OpenAI to your API account. The original photo and generated portraits are stored privately; you review and approve a render before it appears on your dashboard. This is an illustrative image, not a 3D scan or a measurement of body composition. Deleting the original reference record also removes its generated portraits.