Privacy Policy

This is a private, single-purpose fitness tracker operated by F(SYNC) for a named individual during a 40-day body-composition programme. It is not a public product, it has no sign-up, and access is restricted to an explicit allowlist of accounts.

What we collect

• WHOOP data, only if you connect your WHOOP account: recovery score, heart rate variability, resting heart rate, sleep performance and efficiency, sleep stage durations, physiological cycle strain, workout strain and sport, and body measurements (height, weight, max heart rate).
• Data you type in: daily weight, waist, body-fat %, skeletal muscle mass, sleep hours, habit check-boxes, and free-text notes.
• Your F(SYNC) account email, used solely to decide whether you are allowed in and to key your own data.

What we do with it

We display it back to you on this dashboard and compute progress against your own goals. That is the entire purpose. We do not sell it, share it, use it for advertising, use it to train models, or disclose it to any third party. No analytics or tracking scripts run on this site.

Where it is stored

In a Cloudflare D1 database in the APAC region, keyed to your email. Your WHOOP OAuth tokens are encrypted at rest with AES-GCM; the decryption key is held separately as a runtime secret and is never stored alongside the data. The WHOOP client secret exists only server-side and is never sent to the browser.

Retention and deletion

• Disconnect WHOOP in the dashboard deletes your stored WHOOP tokens immediately. We stop calling WHOOP on your behalf at that moment.
• Clear all data in the dashboard deletes your check-ins and your stored WHOOP snapshots.
• You can also revoke this app's access from your WHOOP account at any time, independently of anything here.
• The whole dataset is deleted when the programme ends, on request, or when the app is decommissioned.

Your WHOOP data belongs to you

We request the minimum scopes needed to render the dashboard (read:recovery, read:cycles, read:sleep, read:workout, read:body_measurement, read:profile, and offline so the connection survives without repeated logins). We only ever read; this app never writes anything back to WHOOP.

Contact

Questions, or a deletion request: jimmy@fsyncs.com.