Privacy Policy

Cloudbath AI Coach · coach.cloudbath.co
Effective date: 6 October 2026

Cloudbath AI Coach ("the Service", "we") is a personal AI wellness, recovery and fitness coaching application operated by Cloudbath. This policy explains what information the Service accesses, how it is used, and the choices you have.

1. Information we access

The Service connects to WHOOP only after you explicitly authorize it through WHOOP's own sign-in and consent screen (OAuth 2.0). We never see or store your WHOOP password. With your authorization, the Service may access the following data from your WHOOP account:

• Recovery data (for example recovery score, heart rate variability, resting heart rate)
• Sleep data (for example sleep duration, stages, performance and need)
• Cycle data (for example daily strain and average heart rate)
• Workout data (for example activity type, duration, strain and heart rate zones)
• Body measurements (for example height, weight and maximum heart rate)
• Basic profile information (for example name and email address)

We also store the access and refresh tokens WHOOP issues so the Service can keep your data up to date without asking you to sign in again ("offline" access). No health or fitness data is accessed before you grant authorization.

2. How we use your information

Your data is used only to provide you with personalized wellness, recovery and fitness insights, such as training load guidance, recovery trends, sleep observations and suggestions for planning your training. We do not use your data for advertising, and we do not sell it.

3. Not medical advice

The Service provides general wellness and fitness information only. It does not provide medical advice, diagnosis or treatment, and it is not a medical device. Nothing produced by the Service should be used as a substitute for advice from a qualified healthcare professional. If you have a health concern, or before making significant changes to your training, please consult a doctor.

4. How your information is stored and protected

Authorization tokens and any stored data are kept on the Service's backend and are never exposed in your browser. Connections to the Service use HTTPS. Access to stored data is limited to what is needed to operate the Service. No method of storage or transmission is completely secure, but we take reasonable measures to protect your information.

5. Sharing

We do not sell, rent or trade your personal data. Your data may be processed by service providers that we rely on to run the Service — for example cloud hosting, database and AI model providers — only as needed to deliver the features described above. We may disclose information if required by law.

6. Retention

We keep your data for as long as your WHOOP account remains connected to the Service, or until you ask us to delete it.

7. Your choices: revoking access and deleting data

• Revoke access. You can disconnect the Service at any time from your WHOOP account's connected apps / integrations settings. Once access is revoked, the Service can no longer retrieve new data from WHOOP.
• Request deletion. You can ask us to delete the data and tokens we have stored about you by emailing contact@cloudbath.co. We will delete it within a reasonable period, normally within 30 days.
• Access and correction. You can also ask us for a copy of the data we hold about you, or to correct it.

8. Cookies

The Service uses only essential cookies — for example a short-lived security cookie during the WHOOP sign-in process to protect against forged requests. We do not use advertising or tracking cookies.

9. Children

The Service is not intended for anyone under the age of 18.

10. Changes to this policy

We may update this policy from time to time. The effective date above shows when it was last revised.

11. Contact

Questions or requests about this policy or your data: contact@cloudbath.co