Privacy

The site connects to one WHOOP account: Yash's own. The WHOOP authorization screen is only used by him, to let the site read his recovery, sleep, cycle (strain) and workout data, which Hole 7 shows publicly.

The site stores the OAuth tokens WHOOP issues for that account, plus a summary of the latest numbers cached for about ten minutes, in a private Upstash Redis database. No other WHOOP data is kept, and nothing is shared with anyone else. Access can be revoked at any time from the WHOOP app, which stops the site reading any further data.

Leaderboards. If you sign a leaderboard, the site stores the one to three initials you enter and your score. To stop spam, your IP address is used as a short-lived rate-limit counter that expires after 60 seconds.

Booking a call. The name, email and notes you enter on the booking page are sent to Cal.com to create the meeting. The site itself does not store them.

Your browser. Your game progress (carting or scrolling, and your scores) is kept in session storage for the current tab. The sound setting, the collapsed scorecard, and the last Spotify track shown are kept in local storage. None of this is sent anywhere.

Hosting and embeds. The site is hosted on Vercel, which keeps standard server logs. The Spotify players and the Substack subscribe form are provided by Spotify and Supascribe, and their own privacy policies apply to them.

Email yashgandhi2023@gmail.com to ask about or remove anything described here.