WHOOP privacy

Who is responsible

Aflo is provided by ECOM KNIGHT LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Privacy contact: mail@aflotips.com.

Connecting is optional

You can use Aflo’s other available movement features without WHOOP. If you connect, you sign in with WHOOP and authorize read access. Aflo does not receive your WHOOP password and cannot edit your WHOOP measurements. Access can be renewed without another sign-in until the connection expires or is revoked.

What Aflo receives

Recovery and health: HRV, resting heart rate, Recovery score, blood oxygen, skin temperature and calibration status.

Activity and sleep: day Strain, sleep timing and stages, duration, sleep performance and respiratory rate.

Workouts: activity type, timing, duration, Strain and heart-rate information. Responses also contain record and user identifiers, timestamps, time-zone offsets and scoring status. Some fields are received temporarily without being displayed.

Connection: authorization codes, access and refresh tokens, and session identifiers. Aflo does not request separate WHOOP profile or body-measurement access, such as profile name/email, height or weight. This feature does not use Apple Health or a continuous live heart-rate stream.

Aflo’s own practice duration and the breathing, walking and wind-down check-ins you enter are separate local records.

How it is used

To show your recovery dashboard, workouts and HRV trends alongside Aflo activity. We request approximately 63 days of WHOOP records to compare complete 7-, 14- and 30-day periods with the preceding equal period.

Trends do not prove that Aflo caused an HRV change, provide a diagnosis or determine a refund.

Where it stays and for how long

WHOOP readings are fetched for each sync and processed temporarily in service memory. The service does not retain a dashboard cache or write health readings to an Aflo database. Your browser or app keeps the displayed readings in memory until they are cleared or the page is closed.

WHOOP tokens, your consent version, language and receipt time stay in service memory for the connection session. Sessions expire after seven days; expired entries are removed on a later service request or when the service stops. Restarting the service removes its sessions. Disconnecting successfully removes your current session earlier.

Necessary browser session cookies identify your connection. The native implementation stores an Aflo session identifier in secure device storage; WHOOP tokens stay on the service. Responses instruct browsers not to cache them.

Aflo practice and manual habit records remain in local app storage after disconnecting WHOOP. Clearing the app’s local data removes these records; device backup behavior depends on your operating-system settings. They are not tied to a WHOOP account.

Sharing and protection

WHOOP handles sign-in and API requests under its own privacy policy. Aflo sends information needed to authorize, retrieve and revoke access. It does not send your Aflo habit check-ins to WHOOP.

For this temporary test, Cloudflare provides the HTTPS address and relays browser requests, the sign-in callback and dashboard responses to the development Mac. Cloudflare terminates the public HTTPS connection and can process traffic, including health data, along with technical request information such as IP addresses. The tunnel to the Mac is encrypted; its final hop is loopback on the same Mac. Cloudflare operates internationally. Your WHOOP account data is handled by WHOOP; the Aflo test is processed on the operator’s Mac.

The operator administering that Mac can access its running service. Credentials are kept outside Git and the app bundle. Health readings and tokens are not written to the application’s logs. This test does not sell WHOOP data, use it for advertising, share it with AI services or use it to train models.

Disconnecting and your rights

Disconnect WHOOP requests revocation. After WHOOP confirms success, Aflo removes the service session, clears its connection identifier and removes displayed readings. If revocation fails, an error is shown and you can retry. Closing the page removes its displayed readings; stopping the test service clears its memory but is not itself revocation at WHOOP. Your original WHOOP data and separate Aflo practice/check-ins are not deleted by disconnecting.

You may withdraw your optional health-data consent by disconnecting, without affecting processing already carried out. Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction or objection, or complain to a data-protection authority. Contact mail@aflotips.com. We may need proportionate identity verification. Original wearable measurements may need correction at WHOOP.

Scope of this test

This connection is enabled for the operator’s own account test following explicit consent. It is not an invitation for customers or children to connect. Where consent is required, we rely on your consent to this optional processing and your explicit consent to health-data processing.

Before offering WHOOP integration to customers, Aflo must separately finalize hosting, provider arrangements, market and age eligibility, international-transfer safeguards, consent records, rights-request handling and production retention/security controls. This personal test does not represent completion of those launch steps.

Changes to this notice

When practices change, the notice and effective date will be updated. Where required, users will be notified and new consent obtained before data is used for a new purpose.