Privacy policy

Last updated: October 19, 2026

HoopLab is a private iPhone app built by one athlete for personal use. It has exactly one user, its owner; new sign-ups are closed. This page explains what the app does with data, including data it reads from Google with the owner's permission. The source code is public, so every statement here can be checked in the repository.

Data the app reads from Google

With the owner's consent, the app's server reads data from the Google Health API using four read-only permissions: activity and fitness, health metrics and measurements, sleep, and settings. In practice this means daily summaries such as heart rate variability, resting and sleeping heart rate, blood oxygen, breathing rate, skin temperature, steps, distance, calories and active minutes, plus sleep and exercise sessions. The app never writes to Google and does not download the raw all-day heart rate stream.

How the data is used

The data is used only to show the owner their own numbers inside the app, compared with their own baseline, with every threshold linked to a scientific source. An optional AI coach explains the numbers the app has already calculated.

Where it is stored and who receives it

• Supabase (database and server functions, Frankfurt, EU) stores the data. Row-level security lets only the owner's account read its rows.
• Anthropic (Claude API) receives the numbers the app has calculated (for example "heart rate variability below your usual range") when the owner asks the AI coach for a summary or answer. It does not receive name, email, date of birth or raw time series. Anthropic does not use API data to train its models by default.
• Nothing is sold, used for advertising or shared with anyone else. The owner may export a weekly PDF and send it to someone of their choosing, such as a physiotherapist.

Google API Services User Data Policy

HoopLab's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features described above, is not used to develop, improve or train general AI or machine learning models, and is not read by humans except for security purposes, to comply with law, or with the owner's explicit consent.

Keeping and deleting data

Data is kept until the owner deletes it. Disconnecting Google in the app (Me, then Google Health, then Disconnect) revokes the permission at Google and deletes the stored token; access can also be removed from the Google Account's security settings. Requests sent to the Anthropic API are deleted by Anthropic, by default within 30 days.

Contact

Questions about this page: open an issue in the GitHub repository.