Privacy Policy

When you connect WHOOP, this app requests access to your WHOOP profile, body measurement, recovery, cycle, sleep, and workout data using OAuth authorization. The requested categories are shown on the WHOOP consent screen.

When you connect Garmin, this app requests the Garmin permissions configured for the developer app and authorized by you during Garmin consent.

When you connect Spotify, the music experience reads your liked songs and playback state and can control playback with your permission. Spotify tokens are encrypted in HTTP-only cookies. Live WHOOP Bluetooth heart-rate samples are held in the listening tab's memory.

The app stores WHOOP access and refresh tokens in encrypted server-side records and encrypted HTTP-only session cookies. The connection setup test stores only WHOOP user and webhook event identifiers, timestamps, and test status.

If daily messaging is enabled, the app stores your recipient's phone number in encrypted server-side storage and sends the generated sleep report through Linq. Do not enter another person's number without permission.

The hosting provider may process basic technical logs, such as request times, IP address, user agent, and requested URLs, to operate and secure the service.

WHOOP data is used to show your personal performance dashboard, test API access, refresh your OAuth session, and provide the JSON export route available in the app.

Garmin data is used to verify the connected Garmin user ID, list granted permissions, refresh your OAuth session, and support Garmin API routes added to this app.

The Spotify DJ uses recent Bluetooth heart rate to choose a liked song with a similar BPM approximately 15 seconds before the current song ends.

If you enable daily messaging, selected sleep timing and sleep-quality measurements are formatted into a message for the recipient you configure. The app does not sell your provider data, use it for advertising, or use it to make automated decisions about you.

WHOOP health and activity records are fetched from the WHOOP API when needed. Garmin API diagnostics are fetched from Garmin when requested. Dashboard records may be synchronized to Convex for the dashboard and public view.

OAuth session tokens and daily-message records remain until you disconnect/revoke the provider, disable the feature, delete the deployment data, or an operational retention process removes them. The connection test keeps its latest test state until it is replaced or deleted.

Linq and hosting/database providers may retain message or operational records under their own policies. Hosting logs are retained according to the hosting provider's operational settings.

The music experience caches compact liked-song metadata and BPM values per Spotify account in browser storage. Entries expire after seven days and are removed when the cache is next opened or when you disconnect Spotify here. You can also erase them by clearing this site's browser storage. Heart-rate samples are discarded when the listening tab closes.

The app sends requests to WHOOP and Garmin only as needed to retrieve data you authorized and to refresh or revoke OAuth access.

Spotify track IDs are sent through our server to ReccoBeats to look up BPM. Your Spotify tokens, account identity, and heart-rate samples are not sent to ReccoBeats. Spotify receives playback requests when you use the DJ.

The app runs on Vercel and may store application data in Convex. If daily messaging is enabled, the generated report and recipient address are sent to Linq for delivery. These providers process data under their own terms and privacy policies.

The app does not share provider data with advertisers, data brokers, or unrelated third parties.

You can sign out to clear the local session cookie from this app.

Disconnect Spotify on the music page to clear its local cache and session cookie. To revoke the authorization grant itself, remove the app in your Spotify account settings.

You can use Revoke access in the dashboard or manage connected applications in your WHOOP or Garmin account to stop future API access.

You can delete your stored WHOOP records and daily messaging setup using Delete my WHOOP data on the connection page. This does not delete data held by WHOOP or messages already delivered. Contact the operator for other deletion requests.

The app uses OAuth state validation, signed WHOOP webhook verification, encrypted server-side secrets, encrypted HTTP-only cookies, and HTTPS in production to reduce the risk of unauthorized access.

No internet service can guarantee absolute security, so you should only connect this app from deployments you trust.

This app is not intended for children under 13 and should only be used by people who are allowed to maintain WHOOP or Garmin accounts.

This policy may be updated when the app changes how it handles data.

For privacy questions, access, or deletion requests, contact the operator or administrator who provided access to this deployment using the contact information in the WHOOP developer app.