Privacy Policy

Thrivv Technologies (“Thrivv”, “we”, “us”) builds a fitness platform that gyms deploy to their members. This Privacy Policy explains what information we collect when you use the Thrivv app or website (the “Service”), how we use it, who we share it with, and the controls you have over your information.

Before creating an account, we ask you to read and acknowledge this policy. This acknowledgement does not opt you into marketing or authorise access to any wearable account. Connecting a wearable is a separate, optional step that requires your authorisation.

We collect three broad categories of information.

Account information

• Information you provide when you sign up, including your name, email address, phone number, and a hashed password.
• The version of the Privacy Policy you agreed to and the time your agreement was recorded during signup.
• Optional profile details such as your gym, membership start date, and preferences.

Activity and check-in information

• Daily check-ins you log in the app, including whether you completed a workout, calories, sleep hours, and the wellness habits you tracked.
• Health Score values, streaks, leaderboard standing, rewards activity, and similar engagement data generated by your use of the Service.
• Workouts, meal plans, recipes, bookings, and other content you create or interact with inside the app.

Device and technical information

• Basic technical information such as your IP address, device type, browser, and timestamps of requests, used to operate the Service securely.
• A signed session cookie used to keep you logged in.

If you choose to connect a wearable account such as WHOOP, we use that provider’s OAuth flow to access a limited set of fitness and recovery data on your behalf. We currently support WHOOP and may add additional providers (for example Apple Health, Garmin) in future releases.

What WHOOP data we access

• Recovery score and related cardiovascular metrics, including heart-rate variability (HRV) and resting heart rate.
• Sleep metrics, including sleep performance percentage, sleep efficiency percentage, and total time in bed.
• Daily strain, kilojoules, and basic workout / cycle information.
• Your WHOOP user identifier, used to associate the data with your Thrivv account.

How WHOOP credentials are handled

• WHOOP access and refresh tokens are stored encrypted at rest on our database and are never exposed to your browser, the Thrivv mobile shell, or any other client.
• We use the tokens only to fetch the data described above, and only for as long as you remain connected to WHOOP through Thrivv.
• Synced WHOOP data is stored in our database as one row per day, alongside the raw payload returned by WHOOP for that day, so we can recompute your scores if our algorithms change.

Why we use WHOOP data

• To compute your Thrivv Health Score using objective measures (recovery, sleep quality, activity strain) in addition to your manual check-ins.
• To rank you on your gym’s weekly leaderboard and to award rewards points based on consistency.
• To display your recent recovery, strain, and sleep on the wearables surface inside the app.

We use the information we collect to:

• Provide, operate, and improve the Service.
• Calculate your Health Score, streaks, leaderboard rank, and rewards points.
• Authenticate you, secure your account, and prevent abuse.
• Communicate with you about the Service, including transactional emails and important updates.
• Aggregate usage statistics in non-identifying form to help us understand how the Service is used and to improve it.

We do not sell your personal information to third parties, and we do not use your fitness or wearable data to serve advertising.

Your data is stored on infrastructure operated by our hosting and database providers, primarily Supabase (PostgreSQL) and Vercel. We rely on industry-standard measures including encrypted connections (HTTPS), encryption at rest provided by these vendors, hashed passwords, and access controls limiting who on our team can access production data.

Wearable access and refresh tokens are kept server-side only and are never returned in any API response or to any client device.

No system is perfectly secure. While we work hard to protect your information, we cannot guarantee absolute security and we encourage you to use a strong, unique password.

We share your information only in the limited circumstances described below.

Your gym

If you joined Thrivv through a gym, your gym’s owner and authorised staff may see information needed to operate their pilot, including your name, your aggregate activity and engagement metrics, and your standing on their gym leaderboard. They do not receive your raw wearable payloads.

Service providers

We use a small number of third-party providers to run the Service, including Supabase (database and authentication infrastructure) and Vercel (application hosting). These providers process data on our behalf under their own security and privacy commitments.

Wearable providers

When you connect a wearable, the provider (for example WHOOP) receives standard OAuth metadata from us as part of that connection. We never send your Thrivv password or other Thrivv account secrets to wearable providers.

Legal and safety

We may disclose information when we believe in good faith that disclosure is required by law, necessary to enforce our terms, or necessary to protect the rights, property, or safety of users or the public.

What we do not do

We do not sell your personal information. We do not rent, trade, or share your data with advertisers. We do not share your raw wearable payloads with anyone other than the service providers strictly required to store them.

You are in control of your Thrivv data.

Disconnect WHOOP at any time

You can disconnect your WHOOP account at any time from the wearables section of the app. When you disconnect, we immediately remove your WHOOP access and refresh tokens from your Thrivv account, which prevents any further data sync.

Delete your account in the app

Open Account settings and choose Delete my account. Enter your current password and confirm deletion to permanently remove your account and its associated personal data, including workout and nutrition records, habits, health data, points and reward history. Successful deletion signs you out on all devices and stops WHOOP syncing. Deleting Thrivv does not cancel a gym membership or WHOOP subscription. Records belonging to other gym members are preserved without your account identity.

Other data requests

On request, we will delete the wearable data we have stored for your account. To request deletion of WHOOP data, your full Thrivv account, or any other personal information we hold about you, email us at bashar@thrivv.dev from the email address on your account. We aim to action deletion requests within 30 days. Some information may be retained where we have a legitimate business need (for example fraud prevention or financial records), and only for as long as that need persists.

Access and correction

You can view and update most of your account information directly in the app. For anything you cannot change yourself, contact us at the address above.

Thrivv uses a single signed, HTTP-only session cookie to keep you logged in across visits. This cookie does not track you across other websites and is not used for advertising. We may use a small number of strictly necessary cookies for security (for example a temporary cookie that protects the wearable OAuth flow against cross-site request forgery).

We do not use third-party advertising or behavioural tracking cookies on the Thrivv site.

Thrivv is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at bashar@thrivv.dev and we will take appropriate steps to remove that information.

We may update this Privacy Policy from time to time as the Service evolves or as required by law. When we do, we will update the “Last updated” date at the top of the page. Material changes will be communicated to you by an in-app notice or by email to the address on your account before they take effect.

Questions about this Privacy Policy or about how Thrivv handles your information are welcome. You can reach us at:

bashar@thrivv.dev

Thrivv Technologies. The fitness app your gym deploys.