# Privacy

This private single-owner service stores WHOOP health data persistently in PostgreSQL: raw API responses, normalized workout metadata, recovery/sleep/cycle records, imported exercise sets, body measurements, template labels, source provenance and sync state. It is not stateless and does not delete health history automatically. Imported source rows and analytical reports can contain sensitive personal information.

A separate local SQLite auth store holds AES-256-GCM-encrypted WHOOP access/refresh tokens, registered MCP clients, hashed downstream authorization codes/tokens, expiry and replay-protection state. The encryption secret and database/admin credentials remain outside Git. Host/Docker/backup administrators are trusted and may access private data; token encryption does not encrypt all health data. Use encrypted host/backup storage and restricted filesystem/database access.

WHOOP requests go to its official API/OAuth endpoints. MCP tool responses go to the AI client/account you authorize, whose data controls and retention settings also apply. Do not share access with another person. No WHOOP account password is collected by this service. Basic profile is requested to bind a WHOOP user ID; the binding code does not persist names or email.

Default operation has no external alert destination and disables upstream release checking with `UPDATE_CHECK=false` in the provided environment. If enabled, release checks contact GitHub without health payloads. An operator-configured HTTPS alert webhook receives collection names/status only. Optional weekly JSON reports are stored privately on the application volume. Application error logs exclude raw API bodies/tokens/health records. Configure reverse proxies to omit URL queries and request/response bodies to prevent OAuth-code or health-data leakage.

Revoking WHOOP access stops future retrieval; it does not erase stored health data. To erase an instance, stop it, delete the dedicated PostgreSQL/auth volumes and private report/import/backup files according to your retention requirements. Keep backups only as long as you intend. Never delete shared/production volumes. Remove the MCP connection from each AI client to remove its access, and review that client's separate retention controls.

No health data, personal targets or active credentials may be committed to the repository. Synthetic fixtures are labeled as such. Contact the private repository owner for privacy/security questions.