Privacy Policy

This page hosts only this notice. It does not receive WHOOP authorization callbacks, collect health records, or connect to a WHOOP account. Hermes is an independent personal project, not an official WHOOP product.

1. Scope and operator

This notice describes the current single-user local Python implementation. Its operator is the owner of the WHOOP developer application and the computer running the installation. It is intended for the operator's own use, not as a service for other people. Future remote hosting or additional users require an updated notice and appropriate contact and access arrangements before use.

2. Information processed

With the account holder's authorization, Hermes reads recovery, sleep, physiological cycle and workout records through WHOOP's official API. These records may include heart rate variability, resting heart rate, recovery score, sleep stages and duration, respiratory rate, activity times and training strain. Raw API responses can contain WHOOP identifiers even though Hermes does not request profile or body-measurement access.

The operator may enter dated dietary totals, supplement names and amounts, planned training, soreness and an illness-or-injury indicator. OAuth client credentials and access and refresh tokens are also processed to maintain the authorized connection.

3. Purpose

Information is used to collect recent measurements, calculate a personal baseline from the previous seven valid observations, and prepare daily training and nutrition briefing inputs. The application uses conservative, unvalidated product rules; its output is not a medical diagnosis or treatment.

4. Local storage and safeguards

The collector processes raw WHOOP responses in memory and does not intentionally persist those responses. It saves credentials, OAuth state and manually entered lifestyle records in the installation's local private/ directory. The latest minimized briefing is saved in data/latest.json and may also be returned to the local tool client or terminal.

Program-created sensitive files use owner-only file permissions. Token updates use atomic writes and a local process lock. Local files are not encrypted by this application. Device security, disk encryption, backups and any folder synchronization are controlled by the operator.

5. AI and other service providers

When the operator connects Hermes to an AI assistant, a field-filtered JSON briefing is shared with that assistant. It excludes OAuth credentials, WHOOP user and activity identifiers, names, email addresses, GPS data and arbitrary lifestyle notes. It includes selected health measurements, dates, baseline statistics and explicitly entered supplement and lifestyle context. This is data minimization, not irreversible anonymization.

The local collector itself does not call a model API. The selected AI host, such as ChatGPT, processes the briefing when used. Its applicable terms, privacy policy, account data controls and retention settings govern that processing. Hermes does not promise that all downstream copies remain on the operator's computer. WHOOP separately processes account authorization and API requests under its own terms and privacy policy.

The current implementation contains no advertising, data-sale mechanism, or Discord delivery. This policy page contains no application analytics, forms, third-party scripts or cookies set by its own code. Its hosting provider may process technical request information such as IP addresses and standard service logs.

6. Retention and deletion

The local briefing file is replaced after each successful collection. Credentials and lifestyle records remain until the operator removes them; the application has no automatic retention expiry. To stop collection, stop the local service and any scheduled task, revoke the application's access through WHOOP's available account controls, and remove the installation's private/ and data/ contents. Backups, synchronized copies and AI chat history must be managed separately through their respective services.

7. Choices and requests

The operator can decline or revoke WHOOP authorization, omit optional lifestyle inputs, inspect or delete local files, and choose whether to connect an AI assistant. As this installation is self-operated and single-user, access, correction and deletion are performed directly by that operator. No public customer-support inbox or third-party user service is offered by this personal installation.

8. Changes

This notice will need to be updated when the implementation, hosting, recipients or purposes change. The date above identifies this version.