Privacy

This is a private, single-user training dashboard. It reads WHOOP workouts, recovery, sleep, cycles, profile and body measurements only after authorized WHOOP access.

Training records are stored in the application’s PostgreSQL database. Dashboard-password verifiers are salted scrypt hashes; passwords are not stored in the database. Login rate limits and opaque session hashes are stored in PostgreSQL. WHOOP tokens are encrypted with AES-256-GCM using a key derived from a deployment secret. The application sends no health records to AI or analytics services.

WHOOP authorization returns directly to this application over HTTPS. No Netlify relay is used. Disconnecting revokes access and removes stored tokens, while imported history remains. Backups and database history may retain previous training records. No third-party health data is sold or shared for advertising.

Operator contact: willsuter13@gmail.com