A strategy case study on the collision between subscription retention and data trust
In June 2026, a small group of developers released Goose, an open-source tool that intercepts Bluetooth signals to pull raw biometric data directly off a WHOOP 5.0 tracker, skipping WHOOP's servers, app, and subscription paywall entirely. It's rough, iOS-only, and pre-alpha.
WHOOP's entire brand promise is "know your body." But by mid-2026, a meaningful slice of its most technically capable users had concluded the fastest way to actually own their own data was to reverse-engineer their own hardware, rather than pay the company that sold it to them.
This isn't WHOOP's first trust crisis. In 2023, the company paywalled features users already considered part of their existing plan, triggering backlash over "renting access" to their own biometrics. In May 2025, it happened again: a promised free hardware upgrade to WHOOP 5.0 turned out to only apply to members with 12+ months left on their subscription, everyone else had to pay or prematurely renew. WHOOP reversed the policy under pressure, but only after the damage was public. Layered on top: a 2025 class-action lawsuit alleging WHOOP shared health data with a third party despite promising it never sells data, and a peer-reviewed study ranking WHOOP among the highest privacy-risk wearable brands in its category.
What's notable isn't that WHOOP made one bad call in 2023. It's that by 2026, some of its most loyal users, the kind willing to strap on a $300 device every night, decided reverse-engineering their own hardware was more trustworthy than the company that built it. That's the real signal. Not the lawsuit, not the Reddit threads, but the fact that trust had eroded enough for people to build their own workaround.
It's tempting to read each incident as a one-off misstep: a badly worded policy, an overzealous legal team, an engineering leak. But three separate trust failures across three separate teams (product, hardware, security) in three years isn't a coincidence. It's what happens when a company's business model and its brand promise are quietly pulling in opposite directions.
The business model needs subscription lock-in. The brand promise needs data ownership to feel unconditional.
WHOOP doesn't sell hardware, it gives it away or prices it near cost, and makes its money on the $199 to $359 a year membership. That means the subscription isn't a nice-to-have layered on top of a good product; it is the product. Every strategic lever WHOOP has to grow revenue, raising prices, gating features, timing hardware upgrades to renewal cycles, pulls in the same direction: make the subscription harder to leave, and make more things live behind it.
But the entire reason people strap on a WHOOP every night is the promise that it's theirs: their heart rate, their sleep, their recovery, tracked continuously and owned unconditionally. That promise only holds if data access feels permanent, not contingent on payment status. The moment users sense their own biometric history is a bargaining chip, keep paying or lose access to what your body already told you, the core premise of the product breaks.
These two forces don't fight occasionally. They fight by default, every time WHOOP ships anything:
Each time, the team responsible was almost certainly optimizing for something legitimate: margin, retention, revenue diversification. None of them were reckless in isolation. But none of them were evaluated against the one constraint that actually protects WHOOP's long-term value: does this decision preserve the feeling that the user's data is unconditionally theirs. No one owns that question. There's no structural checkpoint anywhere in WHOOP's decision-making that forces it before a policy ships, which is why the same failure mode keeps recurring in different departments, wearing different clothes. That missing checkpoint is the actual root cause, and it's the thing any real fix has to install.
Goose is the most honest evidence of the gap: users didn't route around WHOOP's encryption. They routed around its monetization logic, because that logic, not any technical barrier, was what stood between them and their own data.