Privacy Policy

1. Introduction

Repple ("we," "our," or "us") is a fitness tracking and gamification application. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your personal data.

By using Repple, you agree to the collection and use of information as described in this policy.

2. Information We Collect

2.1 Account & Authentication Information

When you register, we collect and store:

Authentication is handled by Supabase Auth, which issues JWT tokens (ES256/RS256 asymmetric keys) that we validate on every request.

2.2 Profile & Personal Characteristics

After onboarding, you may provide the following optional profile data:

2.3 Workout & Exercise Data

The core fitness data we collect includes:

Workout Splits & Structure:

• Split name, description, plan mode (regimented or free-for-all), and days-per-week target
• Workout day names, focus type (push/pull/legs/chest/back/shoulders/arms/core/full body/rest), and order within the split
• Exercise selections from our reference catalog
• Per-exercise notes (e.g., form cues you write)
• Cardio blocks associated with workout days

Exercise Logs (per workout session):

• Date the workout was performed
• Sets, reps, and weight for each exercise
• Per-set granular data: set number, reps, weight, and RPE (Rate of Perceived Exertion, 1–10 scale)
• Weight unit (lbs or kg)

Workout Completion Tracking:

• Which workout days you completed, and on which calendar dates
• Your position in your split cycle over time
• Weekly and daily streak counts
• Last workout date

2.4 Points & Performance History

We maintain a detailed record of your performance scoring:

• Weekly points records: total points, exercise points, missed-workout-day penalties, perfect week bonuses, streak bonuses, and whether a week was "perfect"
• Daily point snapshots: a nightly snapshot (created automatically at 23:59 UTC) of your points, exercises completed, workout days completed, streak status, and a full exercise-level breakdown
• Split snapshots: a frozen copy of your workout structure taken each Monday at 00:00 UTC to ensure consistent weekly calculations
• Pending changes: if you modify your split mid-week, the change is queued and applied the following Monday

2.5 Gamification Data

2.6 Teams & Social Data

Teams:

• Team name, description, and icon
• Whether the team is public or private
• Team invite code (8-character code generated for sharing)
• Maximum team size and challenge mode setting
• Team creation and modification timestamps

Team Membership:

• Which teams you belong to, your role (owner or member), and when you joined

Team Join Requests:

• Your request status (pending/approved/declined/expired)
• An optional message you write explaining why you want to join
• Request expiration (7 days from creation)
• Who approved or declined your request and when

Friend Relationships:

• Accepted friendships (stored as a pair of user IDs)
• Pending and historical friend requests (sender, receiver, status, timestamps)

2.7 Challenges & Competition Data

• Which challenges your team participated in, week, status, and results
• Team scores, average member scores, member contribution breakdown, and which user IDs were on the team at challenge time
• ELO rating before and after each challenge, ELO change, and final rank
• Peak ELO achieved and the date it was reached
• Win/loss/draw records
• Challenge invites: which team sent/received the invite, week targeted, invite status, and response timestamps

2.8 Callouts (Workout Verification)

Callouts are challenges issued when a team member disputes another member's logged workout. We collect:

Video evidence is stored in Supabase Storage (bucket: callout-videos) and is also sent to OpenAI for automated review.

2.9 Chat & Messaging

2.10 Activity Feed

For each team, we generate an activity feed that records:

• Who completed a workout
• Who set a personal record
• Who created or resolved a callout
• Who joined the team
• Points associated with each activity
• Which exercise or workout day the activity relates to

2.11 Notifications

2.12 Device Information

2.13 AI-Generated Content & Image Analysis

Images and workout descriptions are sent to OpenAI for processing.

2.14 Invite Links

3. How We Use Your Information

4. Third-Party Services

We share data with the following third-party services to operate the app:

5. Data Retention

5.1 Account Deletion

When you delete your account, the following data is permanently deleted:

• All workout splits, workout days, exercises, and exercise logs
• All exercise log set records
• All weekly points, daily snapshots, and split snapshots
• All team memberships and join requests
• All challenge participation records
• All chat messages and @mentions
• All notifications and activity feed entries
• All device tokens
• All power-ups, spins, streak milestones, and icon unlocks
• All callouts, callout votes, and submitted proof videos
• All friend relationships and friend requests
• All invite links you created
• All AI plan generation tasks and results
• Your user profile record

Some records that reference your account may have the user ID set to NULL rather than deleted (e.g., if you approved a team join request on behalf of a team you no longer own).

5.2 Automatic Expiration

5.3 Automated Data Generation

6. Data Security

• Authentication: Your password is never stored in plaintext. Supabase handles all password hashing. We validate your identity using cryptographically signed JWT tokens.
• Secrets: API keys and credentials are stored in server-side environment variables and never committed to source code.
• Transport: All API communication occurs over HTTPS.
• Cron endpoints: Administrative cron endpoints are protected by a secret key (X-Cron-Secret header) and are not accessible to regular users.
• Database: All data is stored in a PostgreSQL database hosted on Render. User ownership is enforced on every data access query.

7. Children's Privacy

Repple is not intended for users under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and all associated data
• Object to certain types of data processing
• Data portability — request a copy of your data in a machine-readable format
• Withdraw consent for optional data (e.g., disable push notifications, remove device tokens)

To exercise any of these rights, contact us at the address below.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top. If changes are significant, we will notify you via push notification or in-app message.

10. Contact

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us at:

Repple
apprepple@gmail.com