Privacy Policy

Operator and purpose

This private, non-commercial application is operated by the account owner for collection of their own WHOOP records. It is not a public service for other users and is not affiliated with or endorsed by WHOOP.

Privacy, access, deletion and support contact: jores@nsim.fund.

Information collected

After the account owner authorizes access through WHOOP OAuth, the application requests only these permissions:

• read:cycles
• read:recovery
• read:sleep
• read:workout

It receives the records made available under those permissions, including record and account identifiers, timestamps and available physiological, sleep, recovery and workout measurements. A history request may include older records available through the API. The application does not request profile or body-measurement permissions and does not ask for or store the owner's WHOOP account password.

Use of information

The current collection-only pilot downloads records, creates encrypted personal exports, and reports collection counts and completeness locally. It does not provide medical advice, connect Apple Health, send records to AI services, train or improve AI models, or add records to any shared knowledge base or memory. Future analysis or integration requires a separate decision and an updated notice before that processing begins.

Authorization and security

The application connects to WHOOP using HTTPS. The Client Secret, access token and archive passphrase are used in process memory and are not intentionally written to application files or logs. The pilot requests no offline scope and stores no persistent refresh token. Each manual collection requires fresh authorization.

Exports are encrypted using AES-GCM with a key derived from the owner's passphrase. The application does not save that key. These measures do not guarantee protection from privileged server administrators inspecting an unlocked process, or from every operating-system memory trace.

Storage and disclosure

Encrypted exports are stored on the owner's server and may be included in its system backups. The application does not sell the records, use them for advertising, deliberately publish them, or send them to third-party analytics or AI services. File permissions are not isolation from server administrators with root access.

WHOOP operates its own service under its separate policies. The provider serving this public notice may process standard website request metadata, such as IP address, browser information and access logs, for delivery and security. This notice contains no tracking scripts, analytics or forms. WHOOP exports, credentials and OAuth callbacks are not hosted here.

Retention and deletion

Encrypted exports remain until the account owner deletes them or requests deletion through the contact above. Deletion of an active export does not immediately remove existing backup copies. As of October 19, 2026, system backup retention schedules snapshots for removal once they are at least 15 days old, during a subsequent successful cleanup run; failures may delay that removal. This is not a guarantee of erasure on an exact day.

The owner may request access to their exports or deletion through the contact above. Losing the passphrase prevents ordinary decryption but does not mean every copy has been erased. Revoking API access does not itself delete earlier exports or backups.

Withdrawal and changes

The owner can stop collection and revoke the application's connection through their WHOOP account. Material changes to collection, sharing or purpose will be described here before the new processing is enabled.