How do I store Apple Health on my own server for AI tools?
Use the canonical own-server recipe for one shared JavaScript server with Worker/SQLite Durable Object and Docker/Node SQLite alternatives. This direct-server route receives plaintext over HTTPS in your hosting account. It needs no agent pairing; Syncky is outside the data/auth path. All guides · Servers · Cookbook.
How do I connect it?
- Choose a source tag containing the template and follow the recipe's Worker or Docker setup in your own hosting account. Choose one admin password; the first authenticated
/admin/logingenerates separate upload, HMAC and OAuth material locally and shows the private setup link once. - Open/import that link on the iPhone and confirm the server. It fixes native format. Select Health types, run Check connection without Health data, then Sync now for a real upload. HAE, CSV and Influx are unsupported by this recipe.
- In the server admin page, check the exact callback allowlist and register your client's remote
/mcpconnection through discovery/dynamic registration or a manual client. The server enforces S256 PKCE, short tokens and explicit OAuth consent before any AI disclosure, naming the client, exact types and personal health/fitness purpose. Start with bounded reads, not write permission. - Review your AI provider's privacy, retention and training settings before consent. Use Granted clients to review and revoke access. Revocation stops future access and unfinished command delivery; it cannot erase AI-provider copies or recall an already emitted reply.
What do the requests mean?
See the direct-server contract for exact request and response examples and signature rules.
| Request example | Result |
|---|---|
X-Syncky-Format: native with samples, deleted, optional summaries |
Store atomically; raw samples and summaries stay separate. |
Native probe with delivery.test: true (Check connection) |
Empty 200, no Health data stored, no commands. |
X-Syncky-Kind: results, without a format header |
Empty 200, record applied/rejected outcomes, no commands. |
Reads need a consented type and bounded interval: default 7 days, maximum 31 days, up to 200 rows per page. Data stays until a phone deletion or operator erasure; there is no hidden history expiry. Export local pages and remove storage/backups using the recipe's operator steps.
How do optional writes arrive?
Writes are disabled by default. To enable the server's optional write tool, turn on Allow newly consented writes in /admin and obtain fresh explicit per-client write consent for the intended types. The tool only queues commands for the next ordinary data reply. In the app, this direct server's Accept writes to Health setting must be on. The app applies writes only for supported types in its per-type write allowance, with iOS Health write permission and the Sync entitlement. There is no prompt per write. These controls grant permission only; each command should reflect the owner's intended entry.
The template itself is freely available without a subscription gate. Hosting/AI accounts and their costs are separate; free hosting depends on measured limits. See app plans.
A command waits for the next ordinary data reply; probes/results cannot fetch it. If the phone has no new data to send, it makes no ordinary upload. iOS chooses background timing and Health reads require an unlocked iPhone. There is no push or delivery-time guarantee. Queued/sent is not applied: check the latest phone result. Disable writes to pause retries, or revoke the grant to cancel them. Follow the recipe for versioned retry/deletion and permission recovery.
Who operates it, and which clients work?
You operate it under your own hosting and AI-provider contracts, outside the Syncky service. Default EU jurisdiction covers Durable Object execution/storage; the edge Worker, object metadata/logs and AI providers may process data elsewhere, including the United States. It does not guarantee EU-only processing. The template has no telemetry or update channel; updates are manual redeploys from reviewed source tags. Rotate upload/HMAC credentials and re-import after a lost link or suspected exposure. Protect exports and backups; erasing server data cannot remove provider copies. Other people's data needs your own legal basis. Best-effort help: support@syncky.app, no SLA.
Claude.ai and ChatGPT callback defaults are included, but deployed client compatibility is unverified; local standards tests do not prove a real-client connection. Gemini web custom remote MCP support is unconfirmed. The Deploy link remains a tag-substitution example until publication verifies a real tag and provisioning. Follow Privacy and the public security reporting policy.