Privacy & cookies
Your data.
Your call.
Garmin Wraped turns your Garmin year into story cards. This page explains exactly what we touch, what we keep (almost nothing) and what you can do about it.
Last updated 3 November 2026
The short version
Your key
Never stored on our servers. Kept in your browser only if you tick “Remember my key”.
Your recap
Built and kept in your tab’s memory. Refresh or close the tab and it’s gone.
Health data
Fetched only with your consent, passed straight through, never saved. Health cards ask again before export.
No tracking
No analytics, no ads, no third-party scripts, so no cookie banner.
1. Who we are
Garmin Wraped (garmin-wrapped.miniwatt.app) is an independent MINI WATT project, run by Nick Smet in Kalmthout, Belgium. Nick Smet is the data controller for this site. Questions or requests: info@miniwatt.app. Garmin Wraped is not affiliated with or endorsed by Garmin.
2. What we process and why
| Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Your Garmin Personal API key | Exchanged with Garmin for a short-lived access token. | Providing the recap you ask for (Art. 6(1)(b)). Saving it in your browser: your consent. | Our server: discarded right after the exchange. Your browser: only if you choose, until you forget it. |
| Garmin access token | Reads your records from Garmin during one import. | Art. 6(1)(b) | Encrypted cookie, at most 20 minutes, deleted when the import ends. |
| Activities (sport, date, duration, distance) | Building your recap. | Art. 6(1)(b) | Passes through our server without being saved. The recap lives in your tab until you close or refresh it. |
| Health data (steps, floors, sleep, heart rate, HRV) | Building your health cards. | Your explicit consent (Art. 9(2)(a)), given when you select Build my recap. | Same as activities: never saved on our servers. |
| Connection data (IP address, browser details) | Delivering the site and limiting abuse. The rate limiter only sees a scrambled (hashed) form of your IP address. | Legitimate interest in a secure, working site (Art. 6(1)(f)) | Rate-limit counters reset every minute. Hosting logs follow Cloudflare’s short retention. |
| Error logs | Fixing problems. Only a request ID, route, error code and timing. No keys, no Garmin data. | Art. 6(1)(f) | Cloudflare’s short log retention. |
3. Cookies and browser storage
We use two things on your device and nothing else. No analytics, advertising or tracking cookies. No third-party scripts. Fonts are served by this site.
| Name | Type | Purpose | Duration | Consent |
|---|---|---|---|---|
__Host-mini-session | Cookie, encrypted, HttpOnly | Keeps your Garmin connection open while one import runs. | At most 20 minutes. Deleted when the import ends. | Not needed: strictly necessary for the import you asked for. |
garmin-wraped:key | Browser local storage | Remembers your key so you don’t have to look it up again. | Until you select Forget key or Clear my data, untick “Remember my key”, or Garmin rejects the key. | Yes. Saved only when you tick “Remember my key”. Off by default. |
Anyone who can use this browser profile can read a remembered key. Don’t tick “Remember my key” on a shared or public computer.
4. Who else sees your data
Garmin. When you build a recap, we ask Garmin for your records on your behalf, using your key. Garmin’s own privacy policy covers what Garmin holds.
Cloudflare hosts this site and processes connection data for us under a data processing agreement. Cloudflare may process it outside the EU; those transfers are covered by the EU-US Data Privacy Framework and standard contractual clauses.
We don’t sell or share your data with anyone else. Links to miniwatt.app carry a campaign tag, so MINI WATT can see you came from here if you click them.
5. Your rights
You can ask to access, correct, delete or move your data, restrict or object to processing, and withdraw consent at any time. Because we keep nothing on our servers, Clear my data removes everything this site holds: your recap, the connection cookie and any remembered key. Revoke the key itself on Garmin’s key page.
Not happy with how we handle your data? Contact us first at info@miniwatt.app. You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be.
6. Security
Everything travels over HTTPS. The connection cookie is encrypted and can’t be read by scripts. The app loads no outside scripts and blocks them with a strict content security policy. Shared cards contain only the shown metric: no names, Garmin IDs or precise locations.
7. Children and changes
Garmin Wraped is not meant for children under 13. If this policy changes, we update the date at the top of this page.