Privacy Policy

23 Hours (“we,” “our,” or “us”) is a performance intelligence platform operated by 2% Endurance. This policy explains what data we collect, why we collect it, how we protect it, and your rights over it. We take the privacy of health data seriously and apply it only to the purpose for which you provided it: helping you train and recover smarter.

1. What Data We Collect

Health and fitness data (from connected wearables)

When you connect a wearable device or fitness service, we import and store:

• Heart rate, heart rate variability (HRV), resting heart rate
• Sleep duration, sleep stages, sleep score
• Recovery score, strain score, readiness score
• SpO₂ (blood oxygen), respiratory rate, skin temperature
• Activity data: distance, pace, power (watts), cadence, elevation
• Body composition: weight, body fat percentage, muscle mass
• Step count, active energy, training load

Supported sources: Whoop, Oura Ring, Garmin, Apple Health, Strava, and hDrop sweat sensors.

Sweat and hydration data

Via the Salt Lab module, we store session-level data from hDrop or manual entry: sweat rate, fluid intake, sodium concentration, pre/post session weight, and environmental conditions (temperature, humidity).

Nutrition data

Food and supplement logs you enter manually or via barcode scan, including macronutrient and micronutrient breakdowns.

Account and profile data

Name, email address, date of birth, gender, height, weight, sport, training conditions, and metabolic preferences (e.g., VESPA protocol, PCOS, hypothyroidism flags) that you provide during onboarding or in profile settings.

Usage data

Standard server logs (IP address, browser type, pages visited, timestamps) for security monitoring and debugging. We do not use these for advertising.

2. How We Use Your Data

We use your data exclusively to provide the 23 Hours service:

• Computing your daily training load score and recovery readiness
• Generating food, supplement, and hydration recommendations tailored to your physiology
• Predicting race performance and building race-day hydration plans
• Delivering weekly snapshot reports to you and (if applicable) your coach
• Displaying your data in the dashboard and exporting it on your request

We do not sell your data. We do not use your health data for advertising, share it with data brokers, or use it for any purpose other than operating the service you signed up for.

3. How We Store and Protect Your Data

Your data is stored in a Supabase (PostgreSQL) database hosted on AWS infrastructure in the United States. We apply the following protections:

• Encryption in transit: All data is transmitted over HTTPS/TLS. HTTP connections are refused or redirected.
• Encryption at rest: OAuth access and refresh tokens (Whoop, Oura, Strava, Garmin) are encrypted with AES-256-GCM before being written to the database. The encryption key is stored separately as a server-side environment secret and is never exposed to the client.
• Row-level security: Database policies enforce that each user can only read and write their own rows. Coaches can access athlete data only for athletes who have explicitly connected to them via an invite link.
• API authentication: Every API endpoint requires a valid session token. Unauthenticated requests are rejected. Rate limiting is applied to prevent brute-force and abuse.
• No client-side exposure: Health data is never embedded in page HTML, logged to the browser console, or included in client-accessible caches.

4. Data Sharing

We share your data only in these limited circumstances:

• Your coach: If you sign up via a coach invite link, your coach can view your health metrics, training load, salt sessions, and race predictions within the 23 Hours platform. You can revoke this at any time by contacting us.
• Wearable providers: When you connect a device, we read data from their APIs using OAuth tokens you authorize. We do not write data back to those providers.
• Infrastructure providers: Supabase (database), Vercel (hosting), and Stripe (billing) process data as sub-processors under their own privacy and security programs. None of them receive your health data for their own purposes.
• Legal requirements: We may disclose data if required by law, court order, or to protect the safety of our users.

5. Data Retention

We retain your health and fitness data for as long as your account is active. If you delete your account, all personally identifiable data is permanently removed within 30 days. Anonymized, aggregated statistics (e.g., average training load across all users) that cannot be tied back to you may be retained indefinitely.

You can request deletion of your account and data at any time — see Section 7 below.

6. Children's Privacy

23 Hours is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us personal information, please contact us and we will delete it promptly.

7. Your Rights and Choices

You have the following rights over your data:

• Access: Download all your data from the Export tab in the dashboard.
• Correction: Update your profile at any time in Profile Settings.
• Deletion: Delete your account and all associated data by visiting Profile Settings → Delete Account or by emailing us at privacy@twopercent.life. Deletion is permanent and irreversible.
• Disconnect wearables: Revoke access to any connected device at any time from the Connect tab. This stops future syncing; historical data already imported remains until you delete your account.
• Opt out of emails: Unsubscribe from weekly snapshot emails in Profile Settings → Snapshot Preferences.

If you are located in the European Economic Area, United Kingdom, or California, you may have additional rights under GDPR or CCPA including the right to data portability and the right to object to processing. Contact us to exercise these rights.

8. Third-Party Integrations

Connecting a third-party service (Whoop, Oura, Strava, Garmin, Apple Health) is subject to that provider’s own privacy policy. We encourage you to review their policies. 23 Hours only requests the minimum scopes needed to read your fitness data — we do not request write access to any wearable platform.

9. Changes to This Policy

We may update this policy as our practices evolve or as required by law. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you by email. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

10. Contact Us

Questions, requests, or concerns about this policy: