Privacy Policy

StrapCal (“we”, “us”) is responsible for your personal data as described in this policy, under the EU and UK General Data Protection Regulation (GDPR).

For anything about your data, write to hello@strapcal.com. A real person reads every message.

StrapCal is an independent product. It is not made, affiliated with or endorsed by WHOOP, Inc.

When you create an account

• Your first name and email address, to sign you in and write to you about your account.
• One-time sign-in codes, kept for a few minutes until they are used or expire.

When you connect WHOOP

• Your WHOOP profile: your WHOOP member ID and name.
• Your WHOOP data: sleep, recovery, workouts and daily strain. This is health data, see section 4.
• Permission from WHOOP to read this data, stored securely. We never see your WHOOP password: you sign in on WHOOP's own page.

When you use StrapCal

• Your settings, such as which events to show and how they are named.
• Your private calendar link and when your calendar was last updated.
• Your WHOOP app's Client ID and Secret, which you create in your own WHOOP account during setup. The secret is stored encrypted and only used to connect your WHOOP data to StrapCal.
• Your plan and trial dates, and which account emails we have sent you.
• Basic technical data, such as your IP address, used briefly to keep the service secure and stop abuse.
• Error reports when something breaks: what failed, in which part of StrapCal, and your browser type. They never include your health data, IP address or calendar link.
• How the site is used: pages visited, approximate country, device and browser type, and the site that sent you. See section 6.

What we don't collect

No WHOOP password, no payment details (StrapCal is free right now), no contacts, no location, and no data from your other calendars. We don't use advertising, and we don't sell or rent your data to anyone.

Sleep, recovery and workout data are health data, a special category under the GDPR. We treat them that way:

• We only use them to build your calendar and show it to you in StrapCal.
• We never use them for advertising, never sell them, and never use them to train AI models.
• We only share them with the service providers in section 7, who store or deliver them for us. Your health data is never sent to our analytics tool.
• Access is read-only. StrapCal cannot change anything in your WHOOP account.

You can withdraw your consent at any time by disconnecting in your dashboard or in the WHOOP app. We then stop reading your data. Deleting your account removes everything we stored.

Your calendar is published at a private link that only you receive. Anyone who has the link can see the events in it, so treat it like a password and don't share it.

When you subscribe in a calendar app such as Google Calendar, Apple Calendar or Outlook, that app keeps its own copy of the events under its own privacy policy. When you delete your StrapCal account the link stops working, but remove the subscription in your calendar app to clear the copy it already has.

We use a privacy-friendly analytics tool, hosted in the EU, to understand how people find and use StrapCal.

• Without cookies, for everyone: we count visits and see which pages are viewed, roughly where visitors are, what device they use and which site sent them. No cookie is set and you aren't recognized on later visits.
• With your consent: if you click “Allow” in the banner, a cookie lets us connect your visits over time. You can change your choice at any time with Cookie settings at the bottom of every page.
• Once you have an account: we record key steps, such as creating your account, connecting WHOOP, finishing setup and subscribing to your calendar, together with your name and email, so we can see where people get stuck and help them.

Your WHOOP health data is never sent to our analytics tool. When you delete your account, your analytics data is deleted too.

Like most online services, we rely on a few trusted providers for hosting, data storage, sending emails, error monitoring and analytics. They only handle your data on our instructions, under data processing agreements, and may not use it for anything else.

Your WHOOP data comes from WHOOP, Inc., with your permission. We only read from it.

We may also disclose data if the law requires it, for example a valid court order.

Your data is stored in the EU. Some of our providers are based outside the EU or UK. Where data is transferred, it is protected by approved safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

A few cookies are strictly necessary: one keeps you signed in, one protects the step where you connect WHOOP, and one remembers your cookie choice. One optional analytics cookie is only set if you allow it in the banner (see section 6). We never use cookies for advertising.

• Your account and WHOOP data: for as long as you have an account.
• When you delete your account: we revoke our WHOOP access and delete your account and WHOOP data straight away. Backups are cleared within 30 days.
• Sign-in codes and security data: minutes to a day at most.
• Analytics data: up to 2 years, and deleted with your account.
• Error reports: up to 90 days.
• Emails you send us: as long as needed to help you, and no longer than 2 years.

Under the GDPR you can:

• get a copy of your data, in a machine-readable format if you like
• have wrong data corrected
• have your data deleted
• restrict or object to how we use it
• withdraw your consent at any time

The fastest way to delete everything is Disconnect WHOOP and delete my data in your dashboard. For anything else, write to hello@strapcal.com. We answer within one month.

You can also complain to the data protection authority where you live. We'd appreciate the chance to fix things first.

We use industry-standard security: encrypted connections, encryption of sensitive data such as your WHOOP access, strict access controls and limits on sign-in attempts. No system is perfect, but we work to protect your data and will tell you without delay if a breach affects you.

StrapCal is not meant for anyone under 16. If you think a child has given us data, write to hello@strapcal.com and we'll delete it.

If we change this policy, we update the date at the top. If a change matters, for example a new use of your data, we'll email you before it takes effect.