Current hosting and service status

Cloudflare serves this information and the ARGO image at garmin-mcp.cyanluna.com and forwards protocol requests to the existing Google Cloud Run preflight service. Cloudflare processes HTTPS requests, including network metadata, paths and headers. Garmin account linking, activity collection and AI sharing are OFF; the backend currently reports not ready. Infrastructure providers may process operational or security logs under their service settings. Sensitive-value logging, retention and supported processing arrangements must be verified before live OAuth or health-data use.

Who would operate it

Gerald Park, independent developer, plans a noncommercial pilot for approximately 30 cyclists. Contact: gerald.park@cyanluna.com.

This is not a Korea University service; no professor approval or university endorsement exists. Use of institutional participants or resources requires separate permission and any applicable review. Research reuse is outside this pilot’s scope and cannot be authorized contrary to Garmin restrictions.

Purpose & sources

With individual Garmin OAuth consent, the planned read-only Activity API integration on shared Google Cloud would provide participant-requested personal cycling training analysis, explanations and coaching through separately authorized MCP access. Data would be linked to the participant’s account and would not be anonymous. No write-back tools are planned. Account details, privacy choices and analysis requests would come from the participant; technical metadata would arise from service operation.

Garmin consent, service privacy choices, optional location consent and MCP-client authorization would be distinct. AI outputs can be wrong and would not be validated medical assessments.

Information planned for processing

• Cycling performance and physiological metrics, including power and cadence, plus necessary activity identifiers, timestamps and summaries. Exact fields, units and granularity must be confirmed.
• Optional GPS/location, including precise coordinates/routes and associated elevation where separately consented. Non-location features must remain available if GPS is declined.
• Account and authorization information: service identity, Garmin account identifiers, granted permissions, consent/linking records and OAuth tokens needed for the connection. Credentials would not be sent to AI.
• Necessary technical metadata: event identifiers/times, delivery status and security/diagnostic records. IP-address handling, session technology and exact log fields are unresolved.

Sleep, HRV and all-day health categories remain undecided and would not be enabled by default. No device model is assumed from unclear device descriptions.

The data inventory must cover actual incoming payloads, including raw webhooks, transient fields, queues and retries—not just displayed information. Excess or unconsented fields need verified minimization/discard handling before intake. Upstream field-level filtering is not assumed.

When AI would receive data

Before any AI transfer, the participant would receive clear information about the provider, data, purpose and relevant limitations and give separate explicit consent. Only necessary information would be sent to the participant’s chosen, supported assistant when they request analysis. Consent could be withdrawn at any time, stopping future sharing for that use. There would be no automatic background AI sharing on connection.

Location output would default to distance/elevation-gain summaries. Precise routes or coordinates would require both active optional-location consent and an explicit request. A request must not silently expand collection permissions.

The intended permitted purpose is requested inference, not AI model training, evaluation or improvement. The operator plans to prohibit those model-development uses of Garmin data. Selected AI providers are OpenAI ChatGPT and Anthropic Claude; supported product modes and controls have not been verified. Consumer settings and provider exceptions do not establish a universal no-training guarantee, and a participant’s consent does not override Garmin restrictions. Live AI sharing would remain disabled until supported product modes, contractual terms, controls and exceptions have been verified and any necessary Garmin clarification is resolved. Any configuration that cannot meet the applicable restrictions must remain disabled. Connecting an account or requesting analysis would not authorize model development or research reuse.

Hosting & recipients

Selected providers are Google Cloud for hosting, OpenAI (ChatGPT) and Anthropic (Claude) for downstream AI assistance, conditional on the controls above. Supported modes and controls have not been verified; selection does not mean sharing is enabled or compatibility is verified. Exact products, contractual roles, services, regions, subprocessors, account permissions, retention and transfer safeguards remain to be confirmed. Garmin would continue to operate its own service.

No advertising, sale or unrelated-research use is approved in this plan. Any further recipients or legally required disclosures must be addressed in the final notice. Existing ARGO infrastructure does not establish institutional permission for this pilot.

Retention, disconnecting & deletion

The planned activity-data limit is a rolling window of the most recent 90 days. Cutoff calculation, purge timing and raw/derived/queued/cache copies must be specified and tested. This is a retention limit, not a promise of historical backfill.

Disconnecting would stop future collection, not automatically delete existing records. The interface must explain retained data and deletion choices. Late or in-flight deliveries must not restart collection.

A deletion request would remove server-held activity/GPS data, derived records, queued/raw events and relevant account/token/cache records under a verified procedure. The completion deadline, identity checks, backups, logs and any necessary residual-record exceptions remain unresolved launch gates.

Server deletion would not automatically delete Garmin or AI-provider copies, chat history or generated answers. Their separate controls must be identified for supported recipients.

Contact, choices & research reuse

Contact gerald.park@cyanluna.com with privacy questions or requests for access, correction, export, withdrawal, restriction or deletion as applicable. Secure identity verification, response times and jurisdiction-specific rights/complaint routes must be finalized before launch. Do not email passwords, tokens or health records.

Research reuse is outside this pilot’s scope. Participant permission or institutional/research approval cannot override Garmin restrictions on model training, evaluation or improvement. Any future research proposal would require a separate terms and permission review before consideration. No GDPR compliance, medical approval or IRB approval is claimed.

Planned security requirements include user isolation, encrypted credentials/storage, least-privilege access, webhook verification and redacted logs. These remain to be implemented and tested. Material new uses would require updated information and fresh consent where applicable.