Privacy policy

This gateway is a small, invite-only, self-hosted service operated privately by its administrator. It lets you (and only you) give an AI assistant such as Claude access to your own Garmin Connect and WHOOP data. Access is read-only by default; you can additionally allow writing to Garmin Connect (creating workouts, calendar notes, editing activities, weigh-ins) per connection and switch it off at any time. WHOOP is always read-only. It is not a commercial product and has no third-party users.

What is accessed

From WHOOP: recovery, cycles (strain), sleep, workouts, profile and body measurements, using the scopes you approve on WHOOP's consent screen. From Garmin Connect: daily summaries, activities, body metrics and training status. Nothing is written to WHOOP, and nothing is written to Garmin unless you enabled write access.

What is stored

• Your gateway account (email, password hash). Passwords are hashed with Argon2.
• WHOOP and Garmin access/refresh tokens, encrypted at rest. Your Garmin password is never stored.
• A short-lived cache of fetched data (15 minutes to 24 hours) so repeated questions do not re-query the services.
• An audit log of sign-ins and connections (timestamp, IP address, action) for security.

Who can see it

Only you, through clients you explicitly authorize (OAuth grants or personal tokens you create). Each account's data is isolated. The server administrator can see account emails and operational logs, but not your service passwords. Data is not sold, shared or used for anything beyond serving your own requests.

Deleting your data

Disconnect WHOOP or Garmin from the dashboard at any time to delete the stored tokens and cached data. You can also revoke the app from WHOOP's own settings. Ask the administrator to delete your account entirely.

Contact

Use the contact details the administrator gave you with your invite.