In the span of a few weeks, WHOOP's business model got stress-tested by two people who don't work in fitness at all. The first, a developer known for a project called Mirage, reverse-engineered his own WHOOP to pull per-minute heart-rate data, then cross-referenced it with his work calendar — producing, meeting by meeting, a stress leaderboard of his coworkers. The second, an open-source developer, built Goose — an app that intercepts the WHOOP 5.0's Bluetooth stream and visualizes the raw sensor data locally, no subscription required. It took him about a day to get working.
Neither project is a mass-market product. Both are proofs of the same uncomfortable theorem: the tracking layer — the thing the subscription paywall was built to protect — is not defensible.
The paywall was never around the data. It was around the interpretation. Now the interpretation is getting commoditized too.
— The Run RateBecause the third front is the commercial one. Bevel turns any modern Apple Watch into a functional WHOOP — Recovery, Strain and Sleep scores computed from Apple Health data, with an AI layer that explains your trends in plain language. The core scores are free; the AI coaching is a subscription that undercuts WHOOP's. Bevel's entire pitch is that the analysis wearable companies charge a monthly fee for can be reconstructed from data your existing device already collects — making stats accessible and, through AI, actually understandable. The sensor, in this framing, is just a vehicle.
That's a genuine problem for a company that built a $1B category on screenless hardware plus subscription analytics. Here's the value stack, and what just happened to each layer:
| Layer | The old moat | What happened to it |
|---|---|---|
| Hardware | Proprietary sensor you must buy | Commodity — phones and watches carry equivalent sensors |
| Raw data | Locked behind the subscription | Intercepted at the Bluetooth layer in ~24 hours |
| Scores & algorithms | Proprietary Recovery/Strain models | Replicated by free apps on other people's hardware |
| Interpretation & trust | Brand, coaching, clinical validation | The only layer still standing |
Which explains why WHOOP has been sprinting up the stack. Its FDA clearance for blood-pressure estimation — a fight Apple and Samsung hadn't won — looks less like a feature release now and more like the actual strategy: regulatory moats can't be reverse-engineered over a weekend. Clinical validation, medical-grade credibility and institutional trust are the layers a Bluetooth sniffer can't replicate.
What does this mean for studios betting on wearable integrations?
Two things. First, don't pick wearable partners for data lock-in — lock-in is evaporating, and portability means member data will follow the member, not the vendor. Choose platforms for the quality of interpretation and coaching they add. Second, treat biometric data as a liability, not just an asset. Project Mirage fused HRV (heart rate variability) and heart-rate streams with calendar data to profile identifiable people — exactly the kind of cross-referencing a studio or corporate wellness program could stumble into. If you collect member biometrics, you need a privacy posture before you need a dashboard.
There's also a quieter cultural signal here. Members are already ambivalent about their own tracking data — anxious when the score is bad, dependent when it's good. A world where that data is provably loose — hackable, fusible, rankable by your coworkers — sharpens the question operators should be asking every vendor: not "what does it track?" but "who else can see it, and what do you add beyond the number?"
The wearable industry spent a decade convincing consumers that measurement was the product. Two developers and one free app just called the bluff. What survives is what was always hardest to build: being the brand people trust to tell them what the number means.