Downshift Privacy Policy

Effective date: September 1, 2026 · Last updated: September 1, 2026

Downshift is a research and wellness application operated by Ice Bath Boston & Breath LLC ("we", "us"). Trained operators use Downshift to run supervised cold-immersion sessions, and participants use it to view their own results. This policy explains what information the app collects, how it is used and protected, and the choices you have — including what happens when you connect a WHOOP account.

1. Information we collect

We collect only what the program needs:

Profile information, entered when you enroll: your name, date of birth, email address, and intake responses (such as prior cold-immersion experience and health screening answers).
Session recordings, captured during supervised sessions with your knowledge: heart-rate readings and heart-beat (R-R) intervals from a Bluetooth heart-rate sensor, session timing markers, water temperature and immersion depth, the sensor model used, and the scores computed from these recordings.
Wellness ratings you provide before and after each session (mood, energy, stress, anxiety).
Operator notes written by the session operator.
Operator voice notes: audio recordings of the session operator's spoken observations during your session, made on the operator's device, and transcripts produced on that device. These may capture your voice if you speak while a note is being recorded.
WHOOP data, only if you choose to connect a WHOOP account (section 2).

The app does not collect your precise location, does not use advertising identifiers, and does not track you across other apps or websites.

2. Your WHOOP connection

Connecting a WHOOP account is optional and opt-in. If you connect one, you sign in on WHOOP's own page and approve exactly what we may read. With your authorization, we retrieve from the WHOOP API:

Recovery — daily recovery score, resting heart rate, heart-rate variability (RMSSD), and where available blood-oxygen (SpO2) and skin-temperature readings;
Sleep — sleep and nap timing, sleep-stage totals, respiratory rate, and sleep performance scores;
Cycles — daily strain, average and maximum heart rate, and energy expenditure;
Workouts — activity type, timing, strain, heart-rate summary, and distance;
your WHOOP account identifier, used to attribute the data to you.

We import up to 180 days of history when you connect, then sync new records about once a day. The credentials that authorize this access are stored encrypted on our server and are never available in the app, to operators, or to other participants.

You can disconnect at any time — remove Downshift's access in your WHOOP app or account settings, or ask us and we will revoke it. Disconnecting stops all future syncing; you may also ask us to delete the WHOOP data already collected (section 6). Your use of WHOOP itself is governed by WHOOP's own privacy policy.

3. How we use information

To run your sessions and show you your results, scores, and trends — in the Downshift app and, after you sign in, on this website.
To operate, secure, and improve the program — for example, verifying that a recording was complete enough to score.
For research and analysis of cold-immersion response and, where you have connected WHOOP, its relationship to daily recovery, sleep, and strain. Research outputs are aggregated or de-identified.
To build research datasets and to develop, train and evaluate models, including AI models, that support cold-immersion research, using session recordings, operator notes, voice notes and transcripts. Training data is de-identified where practical, and WHOOP data is not used for model training.

We do not sell your information, use it for advertising, or use WHOOP data for any purpose other than the analysis described here.

4. Where data lives and how it is protected

Data is stored in a managed PostgreSQL database (Supabase) hosted in the United States, encrypted in transit and at rest by the hosting provider.
Access is role-based and enforced at the database layer: participants can see only their own records; operators are the study staff who run sessions.
WHOOP access credentials are held server-side only and are not readable by any app user, including operators.
Voice notes are stored in private storage that only operators can open. They are transcribed on the operator's device; the audio is not sent to a transcription service.
Data captured while a device is offline is held on that device until it uploads, then delivered over an encrypted connection.
This website reads the same database under the same access rules. It keeps only your sign-in session in your own browser and sets no tracking cookies.

Service providers that operate our infrastructure, only as needed to run the service: Supabase (database and sign-in), Brevo (transactional email such as invitations and password resets), Lovable (hosting for this website), and Apple (app distribution).
Research outputs shared outside the program are aggregated or de-identified so they do not identify you.
Legal requirements — if we are required to by law, or to protect the safety of participants.
If the program's operator changes (for example a business transfer), data transfers with it under this same policy.

No one else. We never sell personal information, and we never share WHOOP data with third parties.

6. Retention and deletion

Session data, voice notes and WHOOP data are retained for the duration of the research program and as long as needed for the analyses described above. You can ask us to delete your data at any time (section 7); we will delete it unless a legal or research-integrity obligation requires a de-identified record to be kept. Deleted sessions are removed from all participant-facing views immediately.

7. Your choices and rights

Access and export — ask for a copy of the data we hold about you.
Correction — ask us to fix inaccurate profile information; corrections are logged for research integrity.
Deletion — ask us to delete your account and data.
Password — change it yourself at any time from this website's Forgot password page.
Disconnect WHOOP — at any time, from your WHOOP account or by asking us (section 2).

To exercise any of these, contact us (section 10). Depending on where you live, you may have additional rights under state or national privacy laws; we honor the rights above for all participants regardless of location.

8. Age requirement

Downshift is for adults. We do not enroll participants under 18 and do not knowingly collect information from anyone under 18.

9. Changes to this policy

If this policy changes materially — especially anything affecting WHOOP data — we will notify enrolled participants by email before the change takes effect, and update the dates at the top of this page.

10. Contact

Ice Bath Boston & Breath LLC
rachel@icebathboston.com