Privacy Policy

We collect information in the following ways:

Information you provide directly

• Account information: name, email address, and password (or Google OAuth token)
• Profile data: age, gender, height, weight, fitness goals, training experience, and available equipment
• Progress photos: front and/or back photos you upload for AI analysis
• Workout data: exercises, sets, reps, weights, and duration of logged workouts
• Body weight logs
• Communications you send to us, including support requests

Information collected automatically

• Usage data: pages visited, features used, and time spent in the app
• Device information: browser type, operating system, and general device type
• Authentication tokens (stored in session cookies for sign-in purposes only)

We do not collect precise geolocation data. We do not collect or store your payment card details — these are handled entirely by Apple through the App Store.

We use the information we collect to:

• Create and manage your account
• Provide personalised AI-generated workout plans, meal plans, and physique analyses
• Process your subscription payments via Apple In-App Purchase
• Calculate your XP, levels, streaks, personal records, and leaderboard position
• Send workout reminders, weekly progress summaries, and service-related notifications (if you opt in)
• Respond to your support requests and communications
• Detect and prevent fraud, abuse, and violations of our Terms of Service
• Improve and develop the Service, fix bugs, and analyse usage patterns
• Comply with applicable legal obligations

We will never: sell your personal data, use your data for advertising or profiling unrelated to the Service, share your data with data brokers, or use your photos for any purpose other than generating your AI analysis.

Specifically regarding progress photos:

• Photos are stored in our secure database and associated only with your account
• When you submit a photo for analysis, it is sent to Anthropic's Claude AI API over an encrypted connection. Anthropic processes the image to generate your analysis and does not retain the image beyond the API request
• Photos are never sold, licensed, or shared with any third party other than Anthropic for the sole purpose of AI analysis
• Photos are never used in advertising, marketing materials, training datasets, or for any purpose unrelated to your personal analysis
• You can delete your photos at any time from within the app or by contacting Officialrepz2008@gmail.com
• Upon account deletion, all your photos are permanently removed from our systems within 30 days

We work with the following trusted third-party providers to deliver the Service. Each has their own privacy policy governing how they handle data:

We do not use advertising networks, social media trackers, or analytics platforms that collect data for cross-site tracking purposes.

This data is transmitted securely and used solely to generate your requested results. It is not used by these AI providers to train their models. Both Anthropic and Google maintain their own privacy protections for data processed through their services.

We obtain your explicit consent within the app before any data is sent to these third-party AI services.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account and profile data: retained until you request account deletion
• Workout logs and progress data: retained until account deletion
• Progress photos: retained until deleted by you or until account deletion
• Payment records: retained for 7 years as required by financial regulations
• Support communications: retained for up to 3 years

Upon account deletion, we will permanently delete your personal data within 30 days, except where we are required to retain it by law (e.g., financial records).

We use the following types of cookies:

• Session cookies: Required to keep you signed in. These expire when you close your browser or sign out
• Authentication tokens: Secure HTTP-only cookies used by NextAuth to manage your session

We do not use advertising cookies, third-party tracking cookies, or any cookies that follow you across other websites. You can configure your browser to block cookies, but doing so may prevent you from signing in to the Service.

Depending on your location, you may have the following rights regarding your personal data. We honour these rights for all users regardless of location:

GDPR rights (EU/EEA/UK users)

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): Request deletion of your personal data
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to certain types of processing
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

CCPA rights (California residents)

• Right to know what personal information we collect, use, and disclose
• Right to delete personal information we have collected from you
• Right to opt out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your CCPA rights

To exercise any of these rights, contact us at Officialrepz2008@gmail.com. We will respond within 30 days. We may need to verify your identity before processing your request.

The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected data from a child under 16, please contact us immediately at Officialrepz2008@gmail.com and we will delete the data promptly.

We take security seriously and implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration, including:

• All data transmitted between your browser and our servers is encrypted using TLS/HTTPS
• Passwords are hashed using bcrypt — we cannot see your password
• Database data is encrypted at rest
• Access to production systems is restricted to authorised personnel only
• Payment card data is never stored on our servers — it is handled entirely by Apple's App Store

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you discover a security vulnerability, please disclose it responsibly by emailing Officialrepz2008@gmail.com.

Repz is operated from the United States. If you are accessing the Service from outside the United States, your data may be transferred to, stored in, and processed in the United States and other countries where our service providers operate.

For users in the European Economic Area (EEA) and United Kingdom, we ensure that any international transfer of personal data is subject to appropriate safeguards in accordance with GDPR requirements, including using Standard Contractual Clauses where applicable.

We may update this Privacy Policy from time to time. We will notify you of material changes by emailing the address associated with your account and posting a notice on the Service at least 14 days before the changes take effect.

The date at the top of this policy indicates when it was last updated. We encourage you to review this policy periodically. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

For any privacy-related questions, requests, or concerns, please contact us: