Nothing is written back
There is no write path to any health store in the app — not behind a flag, not for tests. Authorisation is requested with an empty write set.
Privacy & data
Read-only, on device, no account.
Tempo asks your health platform for read access to steps and exercise, scores the day on your phone, and keeps the result there.
No health data leaves the device
No analytics on health values, and no crash report carrying a sample. Scores are computed locally and cached locally.
Reading while the app is closed
On Android, about every 15 minutes Tempo reads today's and yesterday's steps and workouts, only to keep its home screen widgets current and to decide whether a nudge is still due. Those reads stay on the phone like every other one. With Health Connect, they need a separate background permission: Tempo asks for it only when you switch on Update while Tempo is closed in Settings, and one you allowed in an earlier version stays allowed until you turn it off in Health Connect. Without it, Tempo reads nothing in the background and the widgets update when you open the app. Samsung Health has no separate background permission, so once it's connected these reads happen without the switch.
Workout plan imports
The Plan tab is off until you switch it on. When you import a plan, the photo, file, page or text you picked is sent to Google's Gemini, through Firebase, to be read into weeks and days — only then, and only that. Health data is never part of it. A plan you build by hand never leaves the phone.
No account, no sign-up
Tempo has no login, no profile and no email field. Delete the app and the cache goes with it.
Why the App Store lists a write permission
App Store validation requires a write-usage string wherever the HealthKit entitlement appears, so its presence says nothing about what the app does. The empty write set does.
Revoking access
Read access can be withdrawn at any time in Apple Health, Health Connect or Samsung Health. Tempo keeps the days it already scored and stops reading new ones.