Privacy Policy
Effective October 9, 2026
This policy covers DenaliFW, a private personal-assistant application run by Joey Bryce (“we”) for members of one household. It is not offered to the public. If you connect an account to DenaliFW, this is what happens to your data.
What we collect
Only what you authorize when you connect an account. For WHOOP, depending on the permissions you grant on WHOOP’s consent screen, that may include:
| WHOOP permission | Data |
|---|---|
read:recovery | Recovery score, heart rate variability, resting heart rate |
read:cycles | Day strain, average and max heart rate per cycle |
read:sleep | Sleep duration, stages, start and end times, sleep performance |
read:workout | Workout activity type, strain, heart rate zones |
read:profile | Name and email address on your WHOOP account |
read:body_measurement | Height, weight, max heart rate |
We also store the OAuth access and refresh tokens WHOOP issues, so the assistant can read your data without asking you to log in each time. We never see or store your WHOOP password.
How we use it
Solely to answer your own questions and give you summaries about your own health and fitness data through a personal chat assistant. We do not use it for advertising, profiling, research, or any purpose you did not ask for.
Who it is shared with
- AI model provider. To answer a question, the relevant portion of your data is sent to the large-language-model provider that powers the assistant (currently xAI, maker of Grok), under that provider’s API terms. It is sent only in response to your request.
- Hosting. Data is processed on infrastructure we control (Google Cloud) and passes through Cloudflare for network security.
- No one else. We do not sell, rent, or trade your data, and we do not share it with advertisers or data brokers.
Storage and security
Tokens and any cached data are kept on access-controlled servers, transmitted only over HTTPS, and never committed to source code. Access is limited to the operator.
Retention
We keep your tokens while your account is connected. Cached data is kept only as long as needed to answer your questions. When you disconnect, we delete your tokens and cached data within 30 days.
Your choices
- Disconnect any time by revoking DenaliFW’s access in your WHOOP account settings, or by emailing us. Revoking access stops all further collection immediately.
- Request a copy or deletion of anything we hold by emailing us; we will respond within 30 days.
Children
DenaliFW is not directed to children under 13 and does not knowingly collect their data.
Changes
If this policy changes, the effective date above will change. Material changes will be communicated to connected users before they take effect.