Privacy Policy
The short version
- MOVLI turns your daily sleep, recovery and strain into a game. We read those numbers from WHOOP only with your permission.
- We keep the scores and game results derived from your WHOOP data, not the raw recordings. You can disconnect WHOOP at any time.
- Your health numbers are never shown to friends. Friends only see your creature, its level and your collection.
- We do not sell your data, do not show ads, and do not share your data with advertisers.
- You can delete your account and all of its data from inside the app.
1. Who we are
MOVLI (“we”, “us”) is a creature‑collecting game for iOS that is driven by real health data from WHOOP. This policy explains what we collect, why, and the choices you have. It applies to the MOVLI app and to movli.xyz.
Questions or requests can be sent to [email protected].
2. Data we collect
2.1 Data from your WHOOP account
When you connect WHOOP, you authorize MOVLI through WHOOP’s OAuth screen. We request the following permissions and use them only for the purposes listed:
| Permission | What we read | Why |
|---|---|---|
read:recovery | Your daily recovery score | Sets your recommended strain range and part of your daily score |
read:sleep | Your sleep performance score | Largest part of your daily score |
read:cycles | Your daily strain | Compared against your recommended range |
read:workout | Whether you logged a workout, and roughly how long | Daily activity flag for the game |
read:profile | Your WHOOP user ID | Links exactly one WHOOP account to your MOVLI account |
offline | A refresh token | Lets us fetch your morning scores without asking you to sign in every day |
What we store. Each morning we compute a health score, a strain alignment result, a workout flag and the game rewards that follow. We store those derived values, plus the three daily scores WHOOP gives you (recovery score, sleep performance and the day’s final strain) so your trend chart in MOVLI keeps working. We do not keep raw WHOOP recordings such as heart‑rate series, sleep stages, GPS or workout details; they are used in memory to compute the day’s result, or to show you a detail panel when you tap a score, and then discarded. Your WHOOP access and refresh tokens are stored encrypted so we can fetch your next morning’s scores.
Webhooks. WHOOP notifies us when your recovery is ready. We store only the notification ID (to avoid processing it twice) and the day it applies to.
Revoking access. If you disconnect WHOOP in MOVLI, we tell WHOOP to revoke our access and delete your tokens at once. If you instead remove MOVLI from your WHOOP account, our next request fails and we delete your tokens then; either way we stop receiving your data. Game results you already earned stay on your account. We use WHOOP data only as you authorized, in line with the WHOOP API Terms of Use; we never sell it, share it with advertisers, or use it to build products that compete with WHOOP.
2.2 Account data
- Sign in with Apple: the stable user identifier Apple gives us and, if you choose to share them, your name and email (or Apple’s private relay address).
- Passkeys: the public key and credential ID your device creates. We never see your biometrics or device passcode.
- Session tokens that keep you signed in on your device.
2.3 Game data
Your creatures, gear, in‑game currency (VOLT), daily results, streaks, collection progress, invite codes and friendships. VOLT is a game currency with no cash value; it cannot be bought, sold or transferred.
2.4 Device and technical data
- Push notification token for your device, so we can tell you when your morning result is ready. Only collected if you allow notifications.
- Time zone offset, so your game day starts at your local morning.
- Standard server logs (IP address, request path, timestamp, app version) kept briefly for security and debugging.
We do not use third‑party analytics or advertising SDKs, and we do not collect precise location, contacts or photos.
3. How we use your data
- To run the game: compute your daily result, grow your creature, wear your gear, keep your streak.
- To keep you signed in and to secure your account.
- To send you a notification when your morning result is ready (if enabled).
- To let you add friends by invite code and show them your creature and collection.
- To detect abuse, fix bugs and keep the service reliable.
We do not use your data for advertising, profiling for marketing, or selling to anyone.
4. What friends can see
Social features in MOVLI compare collections, not bodies. Friends can see your creature, its name, level, rarity and form, what gear it wears, your collection progress, how long you have played, and whether you have checked in today. Friends cannot see your sleep, recovery, strain, workouts or any other health metric. There is no public profile; only people you add by invite code can see you.
5. Sharing with third parties
We share data only with service providers who process it on our behalf to run MOVLI, under contract and only as needed:
- WHOOP (WHOOP, Inc.) — you authorize us to read data from your WHOOP account; WHOOP’s own privacy policy governs your WHOOP account.
- Apple — Sign in with Apple and push notifications (APNs).
- Railway — hosting for our servers and database (United States).
- Cloudflare — network security and delivery for movli.xyz.
We may also disclose data if required by law, or to protect the rights and safety of our users and the service. If MOVLI is ever part of a merger or acquisition, your data would remain subject to this policy.
6. Your choices and controls
- Disconnect WHOOP in the app’s settings. We delete your WHOOP tokens immediately and stop fetching data. You can also revoke MOVLI from your WHOOP account settings.
- Notifications can be turned off at any time in iOS Settings; we then delete the push token.
- Delete your account from the app’s settings. This permanently removes your account, WHOOP connection, creatures, gear, results, friendships and device tokens. Backups are purged within 30 days.
- Access, correction, portability and objection. Email [email protected] from the address on your account and we will send you a copy of the data we hold about you, correct it, or delete it within 30 days. You may also lodge a complaint with your local data protection authority.
7. Data retention
We keep your account and game data for as long as you have an account. Derived daily results are kept so you can see your history. Server logs are kept for up to 30 days. When you delete your account, everything associated with it is removed as described above.
8. Security
All traffic between the app, our servers and WHOOP uses TLS. WHOOP tokens are encrypted at rest. Sign‑in uses Apple’s identity services and passkeys rather than passwords, so we never store a password for you. Access to production systems is restricted to the people who operate MOVLI. If we ever learn of unauthorized access to your data, we will notify you and WHOOP promptly, as the law and our agreements require.
9. Children
MOVLI is designed to be suitable for all ages, but it requires a WHOOP account and an Apple ID and is not directed at children under 13 (or the minimum age in your country). We do not knowingly collect personal data from children under that age. If you believe a child has created an account, contact us and we will delete it.
10. International transfers
Our servers are located in the United States. If you use MOVLI from elsewhere, your data is transferred to and processed there. Where required, we rely on standard contractual protections with our providers.
11. Not medical advice
MOVLI is a game. Scores, recommended ranges and rewards are for entertainment and motivation only and are not medical advice, diagnosis or treatment.
12. Changes to this policy
If we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the app. Continued use after a change means you accept the updated policy.
13. Contact
MOVLI · [email protected] · movli.xyz