This notice supplements ARVENTO’s general Privacy Policy for REVEAL and its proposed Garmin connection. Version prepared 6 November 2026. Chuan Kui Enterprise Co., Ltd. operates ARVENTO REVEAL.
Current availability
Garmin activity synchronization is OFF. The registration-only callback does not exchange authorization codes for tokens, connect a Garmin account or import rides. Real Group and Global riding aggregation and public statistics are also OFF. Developer-account approval does not establish approval of every App permission or use. The separate public demonstration uses labeled synthetic data.
Data a future Garmin Activity API connection may use
Only after a separately approved launch and your authorization, REVEAL may receive a provider account reference, activity reference and type, start/completion time, elapsed and moving time, distance, elevation gain and GPS route/altitude samples where available and permitted. We do not require your Garmin password or unrelated health, heart-rate or training-write permissions for this purpose. Garmin controls its authorization screen and the permissions you grant.
Personal — My World and GPS to H3
The intended purpose is to display your own cycling activity and calculate distance, riding time, elevation, activity count and illuminated regions. Reliable GPS segments are converted deterministically to H3 Resolution 6 cells; missing or unreliable locations must not be invented. Personal uses a rolling 7 Days / 168 Hours contribution window measured from reliable ride completion. GPS and derived cells can reveal location and are not automatically anonymous. These calculations are not medical advice.
Group and Global are separate choices
Group and Global are designed for rolling 30 Days / 720 Hours. Membership, a Personal connection or Garmin authorization is not permission to share rides. Group contribution needs separate explicit consent; public Global sharing needs a separate second confirmation and approved privacy safeguards. These real-data uses remain disabled. We do not sell Garmin data, use it for advertising, or provide it for AI model training or AI processing. Optional Personal Strava remains separate; Garmin data is not automatically sent to Strava, and Strava-derived data must not enter Group or Global.
Services that process information
Cloudflare supplies REVEAL hosting, server-side execution and D1 storage. Shopify supplies the store and verified Customer Account sign-in, not a Garmin login; the proposed flow does not intentionally send Garmin tokens or GPS routes to Shopify. Garmin supplies the authorized source and has its own Garmin Connect privacy notice. Service infrastructure may process request/security metadata and data internationally under applicable arrangements. This notice does not authorize store advertising tools to receive ride data. We will identify any additional ride-data processor before using it.
What is actually retained today
This disabled Garmin feature holds no imported Garmin activities, GPS tracks, derived Garmin H3 contributions or Garmin access/refresh tokens. A bare or invalid callback is processed in memory and its values are not stored by the callback code. The registration-only release exposes no public authorization-begin operation, so visitors cannot create authorization-context records through it. The prepared authenticated flow would encrypt its pending session/PKCE context, make it valid for at most 300 seconds and no longer than the Reveal session, and delete it on a valid single-use callback. Expired unclaimed context is unusable but may remain stored until cleanup runs; no automatic cleanup schedule is currently active. Display expiry after 7 or 30 days is not deletion of every record or backup. Before real connection/import is enabled, we must publish and implement its context-cleanup, raw-data, token, consent, security-log and backup retention/deletion periods. We do not claim those future controls exist today.
Disconnect and withdrawal
There is no active Garmin connection to disconnect in this release. You may manage any provider-side permissions in Garmin Connect. Before enabling real Garmin connections we must provide provider deregistration, permission-revocation handling, removal of affected contributions and clear deletion choices. Withdrawing Group or Global sharing must stop that target’s contribution without silently changing another mode. Reveal Sign out clears/revokes the Reveal session; it is not a claim that Garmin or Shopify provider sessions or all stored data were deleted.
Access, correction, export and deletion requests
Email ck1986@chuankui.com.tw with the subject “REVEAL privacy request” and indicate access, correction, export, deletion or consent withdrawal. Please do not send passwords, tokens, authorization codes or GPS files. We verify requests through the relevant account/contact process before disclosing or deleting information, respond under applicable law, and explain any lawful retention exception. Garmin-origin corrections may need to be made in Garmin Connect. This release has no Garmin activity dataset to export or erase; no automatic Garmin export/delete feature is advertised. Requests concerning existing Shopify or optional Strava data are handled under their applicable service processes.
Security and changes
The prepared callback uses HTTPS, PKCE S256, random state, a Secure/HttpOnly/SameSite=Lax browser cookie, encrypted temporary context and one-time server-side verification with the existing Reveal identity authority. Credentials are not placed in browser storage or returned to a public page. No security system is absolute. Access and infrastructure logging must be checked before real authorization is enabled. We will update this notice and seek any necessary new consent before expanding collection, sharing or processing.
Contact and related notices
Controller: Chuan Kui Enterprise Co., Ltd. (ARVENTO). Privacy contact: ck1986@chuankui.com.tw. Address: No. 43, Lane 186, Section 5, Shanjiao Road, Yuanlin City, Changhua County 510, Taiwan. Read the ARVENTO general Privacy Policy and the Garmin Connect privacy notice using the links below. Where this supplement describes REVEAL specifically, read it together with the general policy; it does not expand enabled features or reduce your legal rights.
