Privacy Policy

Last updated: July 6, 2026

Introduction

FlowState ("we," "our," or "us") is a personal, educational demo application for macOS that displays health and fitness data from your own WHOOP account. This Privacy Policy explains what data FlowState accesses, how it is used, and the choices you have. FlowState is an independent project and is not affiliated with, endorsed by, or sponsored by WHOOP, Inc.

Data We Access

With your explicit permission through WHOOP's official OAuth 2.0 authorization flow, FlowState accesses the following data from the WHOOP API on your behalf:

  • Recovery data — recovery score, heart rate variability (HRV), resting heart rate, blood oxygen (SpO2), and skin temperature
  • Cycle data — daily strain, energy expenditure, and average/max heart rate
  • Sleep data — sleep duration, stages, performance, efficiency, consistency, respiratory rate, and sleep need
  • Workout data — activity type, strain, heart rate, heart rate zones, calories, distance, and altitude
  • Profile information — your name, email address, and WHOOP user ID
  • Body measurements — height, weight, and calculated max heart rate

If you enable WHOOP's Heart Rate Broadcast feature, FlowState may also receive your live heart rate directly from your WHOOP device over Bluetooth. This data is processed in real time on your Mac.

How Your Data Is Used and Stored

  • All data is fetched directly from the WHOOP API to the app running on your Mac and is displayed to you only.
  • Data is stored locally on your device. FlowState operates no servers and transmits your data to no one.
  • OAuth tokens are stored securely in the macOS Keychain. We never see or store your WHOOP password.
  • FlowState contains no analytics, no advertising, and no third-party tracking of any kind.
  • We do not sell, rent, share, or disclose your data to any third party.

Your Choices and Data Deletion

  • You may revoke FlowState's access to your WHOOP account at any time from your WHOOP app or account settings, or by signing out inside FlowState.
  • Deleting the app removes all locally cached data. Locally stored tokens can be removed from the macOS Keychain.
  • Because FlowState stores nothing off-device, there is no server-side data for us to retain or delete.

Educational Purpose

FlowState is built for educational and demonstration purposes as a personal project. It is not a medical device, and the information it displays is not medical advice. Always consult a qualified health professional for medical decisions.

Children's Privacy

FlowState is not directed at children under the age of 13 and does not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

Contact

If you have questions about this Privacy Policy, contact us at gomarcinai@gmail.com.