Privacy Policy
Hiro Nakamata · nakamata.tech · Last updated 28 September 2026
This policy covers Hiro Nakamata, the personal portfolio website at nakamata.tech and its private, owner-only tools, run by Hiro Nakamata, an individual based in Montreal, Canada ("I", "me"). It explains what information is collected, how it is used, where it is kept, who it is shared with, and how to have it removed.
What this app does
Hiro Nakamata is a personal portfolio website: it shows Hiro Nakamata's projects, blog posts, CV and training log to the public. It also has private tools that only its owner can use after signing in with Google: an editor for the site's content, and a training assistant that reads the owner's own Google Health data. It uses last night's sleep, heart rate variability and resting heart rate to suggest whether to train hard, normally or lightly that day, and the owner's smart-scale weight and body fat readings to show their bodyweight trend and strength relative to bodyweight. At the owner's choice, the public Training page also shows one figure from that data: the owner's monthly average bodyweight. No one other than the owner can sign in or connect Google data.
1. Summary
- Visitors are not asked for any personal information. Anonymous page-view statistics are collected with Google Analytics.
- Signing in and the Google Health connection are for the site owner only. No other person can sign in or connect data.
- Google user data is used only to provide the owner's own features. It is never sold, never used for advertising, and never shared except as described below.
- The only health figure made public is the owner's own monthly average bodyweight, on the Training page, by the owner's choice. Nothing finer than a monthly average is published or stored.
2. Information collected from visitors
Analytics
The site uses Google Analytics 4 to count page views. Google Analytics sets cookies and receives the page you visit, the referring page, your browser and device type, and an approximate location derived from your IP address. I use it only to see which pages are read. Google processes this data under the Google Privacy Policy. You can opt out with the Google Analytics opt-out browser add-on or your browser's tracking protection; the site works the same without it.
Storage in your browser
To load the activity calendar faster, the site keeps a short-lived copy of it in your browser's session storage. It stays on your device, is never sent to me, and is deleted when you close the tab.
Chat assistant
If you use the chat assistant, the messages you type are sent to the site's server and to an AI model (Anthropic's Claude, provided through Amazon Web Services' Bedrock service) to generate a reply about the portfolio. Messages are not stored by the site and are not used to identify you. Please do not enter personal or sensitive information in the chat.
3. Google user data (owner only)
The site requests access to Google user data only from its owner, Hiro Nakamata. Sign-in is restricted to the owner's own Google account; any other account is refused.
| Data accessed | Why | Kept? |
|---|---|---|
| Google account email address and basic profile (sign-in) | To confirm that the person signing in is the site owner, so they can edit the site's content. | The email address is kept with the site's sign-in service for as long as the owner's account exists. |
Google Health sleep data (googlehealth.sleep.readonly): sleep sessions, sleep stages and minutes asleep
|
To give the owner a daily training suggestion (whether to train hard, normally or lightly) based on last night's recovery, when the owner asks for it. | No. The data is read at the moment the owner asks, used to compute the answer, and discarded. It is never saved to a database or file. |
Google Health metrics (googlehealth.health_metrics_and_measurements.readonly): daily heart rate variability and daily resting heart rate
|
||
Google Health metrics (same permission,
googlehealth.health_metrics_and_measurements.readonly): body weight and
body fat percentage recorded by the owner's smart scale
|
To show the owner their bodyweight trend and its rate of change, and their strength relative to bodyweight, when the owner asks for it; and, by the owner's choice, to publish their monthly average bodyweight on the public Training page. | Only monthly averages. Once a day, the site computes the average of each month's morning weigh-ins and stores those averages, for months with at least 7 weigh-in days, to show on the Training page. Individual weigh-ins and body fat readings are never stored. |
Access is read-only: the site never writes, changes or deletes anything in Google Health. The only thing stored is the OAuth authorization token that allows these reads, which is kept encrypted in AWS Secrets Manager in my own AWS account and is readable only by me and by the two server functions that perform the reads (the owner's private tools, and the daily job that computes the monthly bodyweight averages). The monthly averages are the only health data the site stores.
How Google user data is shared
Google user data is not sold, rented, or shared with anyone for advertising or any other purpose. It is shown to the owner in the site's private tools, and in the owner's own AI assistant (Anthropic's Claude), which the owner connects to the site to ask for the training suggestion and the bodyweight trend. The one exception is the owner's monthly average bodyweight, which the owner has chosen to publish on the public Training page. Nothing else from Google Health is shown publicly.
Limited Use
The use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve or train generalized AI or machine-learning models, and is not used for advertising. Apart from the monthly average bodyweight the owner chose to publish, it is not read by any person other than the owner.
4. Security
All traffic to the site is encrypted with HTTPS. The site's private tools are reachable only with the owner's sign-in. The Google authorization token is stored encrypted, and the server permissions that can read it are limited to the two functions that need it. The public Training page reads only the stored monthly averages and has no access to Google.
5. Retention and deletion
- Google Health data: not retained (see section 3), except the monthly average bodyweight, kept until the owner removes it.
- The Google authorization token: kept until the owner revokes access, then deleted.
- Anyone can revoke the site's access to their Google account at any time from Google Account → Third-party connections.
- Google Analytics data is kept according to the property's retention setting (at most 14 months).
6. Children
The site is not directed at children and does not knowingly collect information from them.
7. Changes to this policy
If this policy changes, the updated version will be posted on this page with a new "last updated" date.
8. Contact
Questions about this policy or requests about your data: email Hiro Nakamata at hiro@nakamata.tech.