Privacy Policy

Meckley Health Tracker · Effective July 26, 2026

What this application is

Meckley Health Tracker is a private, single-user application built and operated by Andrew Meckley for his own personal use. It combines his own WHOOP physiological data with his own Lose It nutrition data into a daily summary report.

It is not a product, not a service, and is not offered to or usable by anyone else. There are no other users, no accounts, and no sign-up. It runs locally on a personal computer.

Whose data is processed

Only the operator's own data. The application never accesses, requests, or receives data belonging to any other person.

What data is accessed

Source	Data	How
WHOOP	Sleep stages and performance, recovery score, heart rate variability, resting heart rate, blood oxygen, skin temperature, day strain, calories burned, workouts, and profile and body measurement fields (height, weight, maximum heart rate)	WHOOP API v2 over HTTPS, authorized by the operator through OAuth 2.0 using the read-only scopes `read:cycles`, `read:recovery`, `read:sleep`, `read:workout`, `read:profile`, and `read:body_measurement`
Lose It	Daily calorie total and budget, per-meal and per-food entries, and nutrient totals (fat, saturated fat, cholesterol, sodium, carbohydrates, fiber, sugars, protein)	Read from the operator's own email inbox over IMAP, using summary report emails that Lose It sends to him. Messages are read only and are never modified, moved, or deleted
Entered directly	Body weight and, optionally, body composition readings	Typed in by the operator

Where data is stored

All data is stored in a local database file on the operator's own computer.
No data is stored on any server operated by the developer, because there is no such server.
The device uses full-disk encryption, which protects the stored data at rest. Data is encrypted in transit by HTTPS and by IMAP over TLS.
Credentials are held in a separate local file readable only by the operator's own user account, and are never written into logs or reports.

Who the data is shared with

The data is not sold, rented, published, or shared with any third party for any purpose. It is not used for advertising, profiling, or training any model. There is no analytics or telemetry of any kind in this application.

Data leaves the local machine only in these ways, all initiated by the operator:

WHOOP receives authenticated API requests in order to return the operator's own data.
Google is contacted to read the operator's own Gmail mailbox over IMAP.
Anthropic receives the computed daily figures in order to generate the written summary that accompanies the report.
The finished report is published to a private page visible only to the operator's own authenticated account.

Retention and deletion

Data is retained locally only as long as it is useful for personal trend analysis, and the operator can delete the local database at any time, which removes everything the application holds.

Revoking access

WHOOP access can be revoked at any time from the WHOOP app or account settings, or programmatically through WHOOP's de-authorization endpoint. Revoking access immediately stops all further data retrieval. Email access is granted through a revocable application-specific password that can be withdrawn at any time from the Google account security page without affecting the account itself.

Children

This application is not directed at children and is used solely by its adult operator.

Changes to this policy

If this policy changes, the updated version will be posted at this address with a new effective date.

Contact

Andrew Meckley · andrew.meckley1981@gmail.com