Account and membership privacy · October 4, 2026

Your details. Your choice.

StrainArena uses the details you submit to create your builder profile and manage membership in its founding cohort.

What we collect

Your email and any name, X handle, or business URL you provide, the time you sign up, your consent, and an optional referral link. X handles are self-reported at this stage. No WHOOP health data, payment details, or passwords are collected through this form.

How we use it

We store requests in our database so we can contact you about access. Signup details are private. Referral links are public, contain no email address, and do not change a competitive rank. Technical logs record signup success or failure without your submitted details.

Registration is open without an invitation. Saving a profile records your registration against your verified email. Starting WHOOP authorization temporarily reserves an available place; completing the connection admits you automatically. If capacity is full, your saved profile stays on the waitlist. We record automatic admissions and administrator decisions for audit purposes. Administrators may restrict accounts or grant exceptions. Optional invitation emails are sent through Resend, with the message and send-attempt details stored to prevent duplicate retries. Membership alone does not publish your profile.

Spam prevention

A temporary keyed hash of your network address is used to limit repeated requests. The address itself is not stored in the signup database. Hosting providers may process request logs under their own privacy terms.

Optional account sign-in

When sign-in is enabled and you choose Google or GitHub, StrainArena stores your provider account identifier, name, email, email verification status and profile image, plus encrypted provider tokens and server-side session records. Session records can include your network address and browser information. Essential, host-only cookies keep you signed in; we do not receive your Google or GitHub password.

Your account is held by StrainArena. Signing in does not publish a profile or connect WHOOP. Signing out revokes the current session; it does not delete your account or invitation request. Contact us for account deletion and session-revocation requests. Separate consent will be requested before health data is connected or displayed.

If you choose email sign-in, your email address and a short-lived code are sent through Resend to deliver the login message. StrainArena stores a secret-keyed hash of the code, its expiry and verification attempts, not the code itself. Verifying the code creates an account or signs you in to the existing account for that email address. Email login does not subscribe you to marketing.

Optional WHOOP connection and public scores

You can optionally link X from Integrations. After X authorization we read your account ID and username to verify ownership, prevent the same X identity being linked to multiple builders, and show the handle when your profile is public. X requires read-only account and post scopes; we do not fetch posts or messages or publish for you. We request no offline access, retain no X access or refresh tokens, and attempt to revoke the temporary access token after the lookup. If revocation fails, that token is discarded and expires with X; you can also revoke the app in X settings. The stored identity remains until you remove the connection or delete your profile. Reconnect to refresh a changed handle. Legacy self-reported handles are not verified connections. This integration is separate from sign-in.

Connecting WHOOP requires consent to reading WHOOP identity, physiological cycle Strain, Recovery, sleep, workout summaries and body measurements. These are included together in the standard connection when available from WHOOP. Tokens are encrypted in our database. We store the WHOOP identifier to prevent one device account being linked to multiple builders, plus the measurements described below. Existing connections with narrower permissions must reconnect and authorize the full connection before additional collection starts. Public display remains a separate choice from collection.

Health-data collection and public display are separate choices. Agreeing to appear on the public leaderboard makes your builder name, self-reported X handle, business details, weekly Strain/Recovery, Sleep Performance, score, rank and data-receipt counts available to anyone. Connected builders appear immediately, even before the first sync. Open cycles contribute changing Strain; missing elapsed days count as zero and pending data is marked Processing. A separate expanded-profile switch controls the dedicated profile page and its share card without removing your leaderboard row. Withdrawing leaderboard consent or disconnecting hides both. Previously shared screenshots, social previews and third-party copies cannot be recalled.

Automatic public posts on X

Public arena participation includes automatic announcements from StrainArena’s X account when a builder joins and when they finish in the weekly top three. Posts and branded images use public builder names, verified connected X handles and business details; weekly podium posts also include rank and composite score. Welcome posts may link to an available public profile. No separate social opt-in is required. You can disable future posts and tags under Settings → Automatic posts on X while keeping your leaderboard entry. We honor saved opt-outs. Hiding your public profile or disconnecting WHOOP also stops future posts. Already published posts and copies shared by others remain public. We do not post from your personal X account.

Sleep data

Sleep access is included in the standard WHOOP connection, not a separate optional feature. It requires your consent and WHOOP authorization for read:sleep. Existing members must reconnect to grant this additional access before sleep collection starts. We retain Sleep Performance, duration, consistency and efficiency for eligible completed days. Daily sleep summaries are kept for up to 21 days and weekly summaries for 13 weeks; the six-month Strain/Recovery setting does not extend sleep retention. With a public leaderboard entry, your weekly Sleep Performance may be shown and used as a tie-breaker after score, days of data received and Recovery. Weekly sleep details may also appear on your expanded profile. Sleep is not part of the performance-score formula. Disconnecting removes stored sleep summaries and stops further sleep collection. You can also revoke access in WHOOP.

Use your account to hide your profile or disconnect. Disconnecting immediately removes local samples and weekly scores and stops public display; encrypted credentials may be retained for up to seven days solely to retry revocation at WHOOP. If revocation cannot be confirmed, remove StrainArena from your WHOOP connected applications. By default, scheduled cleanup retains samples for up to 21 days and weekly metrics for 13 weeks. These scores are a competition formula, not a medical assessment or training advice.

You can separately opt in to importing your last 180 completed days of strain and recovery for graph history. This extends daily-data retention to a rolling 180-completed-day window while enabled, alongside the current cycle, without changing weekly-score retention. Existing users remain on the original 21-day limit unless they choose this option. Disabling six-month history deletes samples outside the original 21-day window and cancels pending imports; disconnecting also clears this opt-in.

All charts and activity calendars require active Pro Builder access. A separate, optional daily-activity setting publishes retained daily strain and recovery values on a Pro Builder profile. It is off by default and does not follow automatically from weekly-profile consent or history-import consent. Existing daily sharing remains limited to 21 days. Sharing up to 180 completed days requires an additional explicit public-history choice after enabling six-month history. Losing Pro access hides the charts without deleting existing retained data or consent. Turning daily sharing off is always available and removes public access to daily history; hiding your weekly profile or disconnecting also clears this daily opt-in. Copies or screenshots made while it was public cannot be recalled.

Recent activity and live updates

Signed WHOOP Recovery, Sleep and workout updates or deletions queue a sync of the data you have authorized. Notifications do not themselves publish workouts or new measurements.

While your profile is public and connected, the recent activity feed can show when you first become visible or climb the current leaderboard. These events are retained for up to seven days and are hidden when you withdraw public consent or disconnect. They do not include workout sessions, locations or additional health measurements. We keep minimal milestone markers to avoid repeating join announcements. Signed WHOOP recovery notifications queue a sync of the strain and recovery data you already authorized; notification receipts are kept for up to seven days to prevent duplicate processing.

When live updates are enabled, your browser connects to Ably to receive a notification that the leaderboard has changed. Ably processes the network and connection information needed to deliver it. We send only a revision number through this service, not your name, email, WHOOP data or score. Your browser retrieves the current public standings from StrainArena. If live delivery is unavailable, the page checks for updates periodically instead.

Additional private WHOOP data

With consent to the full WHOOP connection and the required authorization, we sync a rolling 21-day window of cycle energy expenditure (kilojoules and derived kilocalories), average and maximum heart rate; workout type, timing, duration, Strain, energy, heart-rate zone durations, recording coverage, distance and elevation totals; Recovery score, calibration status, resting heart rate, HRV, blood oxygen and skin temperature when available; sleep and nap timing, sleep stages, awake and unrecorded time, disturbances, sleep cycles, sleep need and debt, respiratory rate and sleep quality percentages. We also retain the latest available height, weight and maximum heart rate from WHOOP body measurements, not a history of body measurements. We retain source identifiers, update times and timezone offsets to reconcile activity records, but not raw API responses, GPS routes, continuous heart-rate streams or additional identity fields.

These additional records remain private and are not currently displayed, included in public APIs, used for rankings or shared with sponsors or analytics services. Activity records are retained for up to 21 days; the body-measurement snapshot expires 21 days after its last successful refresh. The separate six-month Strain/Recovery import does not extend this retention. Existing members are not automatically opted in. Disconnect WHOOP in Integrations to stop and remove all local health data. Later publication or uses beyond this consent will require a separate choice.

Country, age and training preferences

Nationality is required when saving your profile once country settings are enabled. Existing profiles are not assigned a nationality automatically. Country of residence, date of birth and sports/training preferences are optional and self-reported, not verified by WHOOP. If you provide a date of birth, we store it privately to calculate your age automatically. Your date of birth is only available in your signed-in account; it is not included in public profiles, leaderboard data or share cards.

When public display is allowed, nationality appears as a flag on the leaderboard, and nationality, country of residence, age and training preferences appear on your builder profile and in public profile data. None affects your score or ranking. You can change your nationality, clear any optional detail, or hide your profile by saving your visibility choice. Previously shared screenshots and third-party copies cannot be recalled.

Public profile images

For visible builder profiles, we send the public X handle to Unavatar to retrieve its public profile photo. This does not verify ownership of the handle. Business icons load from Google’s favicon service using only the business hostname. Image providers receive the network information needed to serve an image; WHOOP data, scores, email addresses and private URL parameters are not sent to them.

Analytics and crawler requests

We record aggregate profile opens from leaderboard rows and clicks through to business websites. Business-click totals appear on the public leaderboard and builder profile only while that builder has active Pro access and public visibility; counts for free builders remain hidden. These counts never affect ranking and are not unique-visitor counts. We do not store visitor-level click histories, health metrics or visitor cookies for these counters. Temporary keyed network-address hashes limit repeated clicks and abuse, using the same short-lived request-limit storage as signup protection; raw addresses are not stored in the counters. Counting respects Do Not Track and Global Privacy Control, stops when the builder withdraws public visibility, and totals are deleted with the builder profile.

We use MetricPanel to understand visits to public pages and requests from AI and search crawlers. Browser analytics uses cookies to recognize visitors and sessions and respects Do Not Track and Global Privacy Control. Public campaign/referral labels may be included; account pages, sign-in and API routes are excluded. Crawler tracking includes the requested public path, user agent and, on Vercel, the client IP for crawler verification, but excludes query strings and authentication headers. No form fields, email addresses, login codes, WHOOP data or payment details are intentionally sent to analytics.

Account emails and optional recaps

Resend delivers sign-in codes, a one-time welcome after your email is verified, and invitations you have requested. These do not subscribe you to marketing. Weekly recaps and WHOOP reconnect reminders are optional and off by default; manage them in your account or unsubscribe from the email.

If you opt into recaps, your email address, weekly rank, StrainArena score and days received are sent through Resend after the correction window closes. A recap requires your current public-display and collection consent. Recaps also feature the top three publicly visible builders from the same week: their public profile photos, names, business names, ranks, StrainArena scores and public profile links where available. If you appear in the public top three, those public details may be included in other members’ recaps. Photos load from the same public image sources as the app; image requests may pass through your email provider’s proxy or reveal network information to the image host. We do not add recipient identifiers to those image URLs. Raw WHOOP data and private measurements are not included. We recheck public visibility before sending; previously delivered emails cannot be recalled.

We retain preference choices and minimal send records to prevent duplicate emails. Retry payloads are removed after provider acceptance or cancellation, or at the next scheduled cleanup after the 23-hour retry window. Weekly and reconnect send records expire after 90 days and are removed by that cleanup. The welcome send marker remains while your account exists. Provider acceptance is not confirmation of inbox delivery.

Optional Pro Builder tools

When paid subscriptions are available and you explicitly choose to subscribe, Stripe processes your billing email, address and payment details. We store the Stripe customer and subscription identifiers, status, paid-through date and renewal choices; we do not receive or store your card number. Billing data never affects admission, WHOOP consent or ranking. Billing-event identifiers are retained for up to 90 days to avoid duplicate processing. Before account deletion, contact us to settle or cancel any recurring subscription; deleting local profile data alone does not cancel a Stripe subscription.

With an active Pro subscription you can save a longer business description, extra HTTPS links and share-card appearance choices. They display publicly only while your expanded public profile is enabled and Pro access is active. Saved appearance and business settings remain private when Pro expires, until you change them or delete your profile. Previously downloaded cards and third-party previews cannot be recalled.

A separate Pro checkbox lets us retain up to 52 weeks of weekly Strain, Recovery, score and days-received summaries instead of the existing 13 weeks. It is off by default, private, does not extend daily samples or Sleep retention, and does not restore deleted weeks. Turning it off immediately removes older summaries. When paid access ends, scheduled cleanup restores the 13-week limit. Disconnecting WHOOP removes these health summaries and clears the extended-history choice.

While Pro is active, tracked profile opens and outbound business clicks also contribute to daily aggregate counts retained for up to 90 days. These are not unique visitors or all page views, include no visitor-level history, and use the same visibility and Do Not Track controls as aggregate click recording. Only the builder can see the report while Pro is active; aggregate records are removed by retention cleanup or profile deletion. If you connect TrustMRR, we match your verified X account and business website and retain the selected startup’s aggregate MRR, total revenue, source link and fetch timestamp. Connecting enables public revenue display while Pro and public visibility remain active. Snapshots are refreshed manually, hidden after 24 hours without a refresh, and removed on disconnect or profile deletion. No customer records or payment credentials are collected.

Keeping and deleting details

Invite-list details are retained while invitations are being managed. You can ask us to remove your request at any time. Separate consent and retention information will be provided before health data is connected or published.

Contact

For access or deletion requests: [email protected].