Privacy Policy

The data controller responsible for your personal data is:

We collect data from the following sources:

We use your data for the following purposes:

• Workout Generation: Creating personalized workouts based on your recovery score and training history
• Power Analysis: Calculating your power curve from Strava activities to optimize workout intensity
• Training Load: Analyzing CTL (Chronic Training Load), ATL (Acute Training Load), and TSB (Training Stress Balance)
• Compliance Tracking: Matching generated workouts to completed Strava activities
• Service Improvement: Understanding usage patterns to improve the service (aggregated, anonymized data only)

We do not: Sell your data, share it with advertisers, use it for targeted advertising, or share it with third parties except as required to provide the service.

We implement industry-standard security measures:

• Encryption: All data transmitted via HTTPS; OAuth tokens encrypted at rest
• Password Security: Passwords are hashed using secure algorithms; we never store plaintext passwords
• Database: Data stored in MongoDB with appropriate access controls
• Infrastructure: Hosted with security-compliant cloud providers

Data is processed and stored in compliance with Swiss data protection standards, which provide strong privacy protections equivalent to GDPR requirements.

Zwoop integrates with the following third-party services via OAuth:

• Whoop: We access recovery, strain, and workout data with your explicit authorization. See Whoop's Privacy Policy.
• Strava: We access activity and power data with your explicit authorization. See Strava's Privacy Policy.

We only request the minimum scopes necessary to provide our service. You can revoke access at any time through your Profile settings in Zwoop, or directly through Whoop/Strava's connected apps settings.

Under GDPR and Swiss data protection law, you have the following rights:

• Active accounts: Data retained while your account is active
• Deleted accounts: All data permanently removed immediately upon account deletion
• Strava data: Removed within 48 hours if deleted from Strava (per API requirements)
• Cached data: Power curves cached for 24 hours; activity lists cached for 1 hour

Zwoop uses minimal cookies strictly necessary for the service:

We do not use: Tracking cookies, analytics cookies, advertising cookies, or any third-party cookies.

Your data is processed in Switzerland, which is recognized by the EU as providing an adequate level of data protection. When interacting with Whoop or Strava APIs, data may be transferred to servers in the United States according to their respective privacy policies.

Zwoop is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated through the service or via email. The "Last updated" date at the top indicates when changes were last made.

For privacy-related inquiries or to exercise your data rights, contact us at:

If you are in the EU/EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority.