Morphy — Privacy Policy

Last updated: June 23, 2026

Morphy is a personal, non-commercial Android app that shows an animated creature in a screen overlay. The creature's mood and behaviour reflect the user's own body state using data from the user's WHOOP account. This policy explains what data Morphy accesses and how it is handled.

1.Scope

Morphy is a private project built for personal use by its developer and is not distributed publicly. In this policy, "Morphy" or "the app" refers to this application.

2.Data Morphy accesses

With your explicit consent through WHOOP's OAuth login, Morphy requests read-only access to the following data from your WHOOP account:

Recovery — recovery score, heart rate variability (HRV), resting heart rate, blood oxygen (SpO₂), skin temperature
Sleep — sleep stages, duration, and sleep performance
Cycles — daily strain and average heart rate
Workouts — workout strain and average heart rate
Profile — your name and email address
Body measurements — height, weight, and maximum heart rate

Morphy requests read access only. It cannot create, modify, or delete any data in your WHOOP account.

3.How Morphy uses your data

Your WHOOP data is used only to compute the state of the on-screen creature (for example, its energy, sleepiness, and heart-rate baseline) and to animate it. The data is not used for any other purpose, and not for advertising, profiling, or analytics.

4.Where your data is stored

Morphy connects to WHOOP through a small private server (a "broker") operated by the developer. Your WHOOP authentication tokens are stored on this server, not in the app, so the app never holds your WHOOP credentials. Your WHOOP data is fetched through the broker and passed to the app on your device, where it is used to animate the creature. The broker does not retain your WHOOP data beyond what is needed to relay each request, and your data is not shared with any third party.

5.Data sharing

Morphy does not sell, rent, or share your data with anyone. The only external party involved is WHOOP itself, which is the source of the data and is governed by WHOOP's own privacy policy.

6.Data retention and deletion

Your WHOOP authentication tokens are kept on the broker until you revoke Morphy's access (see below) or the developer deletes them. WHOOP data is not stored long-term — it is fetched on demand and only cached briefly on your device to show the creature's current state. Uninstalling Morphy removes its locally cached data from your device.

7.Revoking access

You can revoke Morphy's access to your WHOOP data at any time from your WHOOP account settings, under connected / third-party apps. After you revoke access, Morphy can no longer fetch new data from your account.

8.Children's privacy

Morphy is not intended for children and does not knowingly collect data from anyone below the minimum age required by WHOOP's terms of service.

9.Changes to this policy

If Morphy's data handling changes — for example, if a server component is later introduced — this policy will be updated and the "Last updated" date above will change accordingly.

10.Contact

Questions about this policy can be sent to: lizka59@gmail.com