WHOOP integration

Who we are

football.io is a football operations product (lineups, organisations, player identity, and related tools). Contact: football.io.buissness@gmail.com.

What you authorise

When you tap Connect WHOOP, WHOOP shows a consent screen. If you approve, WHOOP gives football.io limited access using OAuth. We request these WHOOP scopes:

• offline — so we can refresh access without asking you to log in every time
• read:profile — WHOOP user id (to keep your connection tied to the right WHOOP account)
• read:recovery — recovery score, resting heart rate, HRV
• read:cycles — strain
• read:sleep — sleep performance
• read:workout — authorised so we can add training-load context later; we do not currently store workout records

What we store

On our servers we store:

• OAuth access and refresh tokens (to call WHOOP on your behalf)
• Token expiry and last-synced time
• WHOOP user id, if WHOOP returns it
• Snapshots you (or the app) sync: recovery score, resting heart rate, HRV (rmssd), strain, sleep performance, and when the snapshot was taken

We do not store your WHOOP password. Authentication happens on WHOOP's site. We do not sell WHOOP data. We do not use WHOOP data for advertising.

How we use it

We use this information to show recovery, strain, sleep, and related scores on your football.io You page so you can see readiness next to your football identity. We may later show the same summaries to coaches, trainers, or club staff in organisations you already belong to, so they can plan training load. If we turn that sharing on, we will say so in the product before it applies to you.

Legal bases we rely on (UK GDPR): your consent when you connect WHOOP, and our legitimate interest in operating the feature you asked for. Recovery, heart-rate, HRV, strain, and sleep data can be health-related. We only process it if you connect WHOOP and we only keep what we need for that feature.

Who can see it

Today, WHOOP snapshots are shown to the signed-in account that connected WHOOP. Hosting, database, and engineering operators of football.io may access systems that hold this data in order to run and secure the service. We do not give WHOOP data to unrelated third parties. WHOOP itself continues to hold your full WHOOP account under WHOOP's policies.

Disconnect and deletion

On You, tap Disconnect. That deletes our WHOOP tokens and stored WHOOP snapshots for your account. We then cannot pull new WHOOP data until you connect again. You can also revoke football.io in the WHOOP app or WHOOP account settings. To delete your whole football.io account, or to ask us to erase WHOOP-related data, email football.io.buissness@gmail.com.

Under 18

football.io offers under-18 accounts. Connecting WHOOP is optional. A parent or guardian should review this notice and WHOOP's policies before a minor connects a WHOOP account. Do not connect someone else's WHOOP without their permission.

Security and retention

Tokens and snapshots sit in our application database with the rest of your account. We keep snapshots while the connection is active so you can see the last sync. After disconnect, we delete that WHOOP data as described above. We may keep limited logs (for example that a sync failed) for security and debugging, without storing your WHOOP password.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict processing of your personal data, and to withdraw consent. Withdrawal does not affect processing already done. Email the address above. You may also complain to the UK Information Commissioner's Office (ico.org.uk) or your local regulator.

Changes

If we change how we use WHOOP data, we will update this page and the date above. Material changes that expand sharing will be called out in the product where we can.