REPP Privacy Policy

Last updated: October 7, 2026

1. Overview 2. Data We Collect 3. Health & Fitness Data (Special Category) 4. How We Use Your Data 5. AI Processing (Trainer, Programmes and Meal Scanner) 6. Third-Party Services We Use 7. Data Storage & Security 8. Data Retention 9. Your Rights 10. International Users 11. Age Requirement 12. Changes to This Policy 13. Contact Us

1. Overview

REPP ("REPP," "we," "us," or "our") is a personal fitness and nutrition application that provides AI-assisted workout programming, nutrition tracking, and recovery insights. This policy explains what information REPP collects, how it is used, who it is shared with, and the choices and rights you have over your data.

REPP is developed and operated by Bruno Hejduk, an independent developer, contactable at the address listed in Section 13. REPP is not currently operated through a registered company; Bruno Hejduk is the accountable party for the personal data described in this policy.

REPP handles data about your body, workouts, sleep, and recovery — categories that many privacy laws (including the EU's GDPR) treat as sensitive. We only collect what the app needs to function, and none of it is sold to advertisers or data brokers.

2. Data We Collect

Account information

Email address and password (stored as a salted hash, never in plain text)
Name, age, and gender, provided during onboarding

Fitness & training data

Workout logs: exercises performed, sets, reps, weights, and notes you add
Training programme data: your generated weekly plan and any edits you make to it
Goals you set (e.g. strength, weight change, endurance targets)

Nutrition data

Meals you log manually, via search, or via photo scan (calories, macros, serving size, meal type, date)
Water intake
Supplement stack and adherence check-offs
Macro and calorie targets, including any custom targets you set

Body & progress data

Weight and body fat percentage entries you log, with the date logged
Progress photos you choose to add (stored on your device; see Section 7)

Recovery & vitals data

Self-reported energy and soreness ratings
Readiness/recovery score, heart rate variability (HRV), resting heart rate, and sleep duration — sourced either from data you enter manually, from Apple Health, or from a connected wearable (WHOOP or Oura, where you choose to connect one)

Trainer chat data

Messages you send to the in-app AI trainer, and the trainer's replies
Any photos you attach to a chat message

Technical data

Device type and user agent string, collected as part of session management
App usage such as streaks and session timestamps

3. Health & Fitness Data (Special Category)

Under GDPR and similar laws, data revealing health status — including sleep, heart rate, recovery scores, body weight, and body composition — is treated as a special category of personal data requiring a higher standard of protection. We collect this data only with your explicit action (logging it yourself, or explicitly authorizing a connection to Apple Health, WHOOP, or Oura), and we use it solely to power the personalization features you've asked for: your training plan, recovery guidance, and nutrition targets. We do not use this data for advertising, and we do not sell it.

4. How We Use Your Data

Purpose	Data used
Generate and adjust your training programme	Training history, goals, injuries/limitations you report, recovery data
Calculate nutrition targets	Weight, age, gender, goal, activity level
Power the AI trainer chat	Your messages, recent workout/nutrition/recovery context, chat history
Track progress over time	Weight logs, workout history, streaks
Maintain your account and session	Email, password hash, session tokens
Improve app reliability	Aggregated, de-identified usage patterns — never sold or shared for advertising

5. AI Processing (Trainer, Programmes and Meal Scanner)

REPP's trainer chat, programme generation, food search and meal scanner are powered by Google's Gemini API. When you send a message to the trainer, generate a programme, search for a food or scan a meal, relevant context (your profile, recent training, nutrition and recovery data, your message, and any meal photo you scan) is sent to Google's Gemini model to produce a response. This processing happens server-side; your raw account credentials are never included in this context. REPP asks for your explicit permission before any of this is sent, the first time you open the app after signing in. You can withdraw that permission at any time in Profile under Privacy, which turns the AI features off until you agree again.

Google's processing of this data is governed by Google's own API terms and privacy commitments for the Gemini API. We do not use your chat data to train our own models, and we do not use it for any purpose beyond generating your response.

6. Third-Party Services We Use

Service	What it's used for	Data shared
Google Gemini API	AI trainer chat, programme generation, food search and meal scanner	Profile context, training/nutrition/recovery data, chat messages, meal photos you scan
Apple HealthKit	Optional recovery/vitals sync, only if you grant permission on your device	Steps, heart rate, HRV, sleep — read-only, requested locally on your device, never routed through a third party
WHOOP	Optional recovery/vitals sync, only if you connect your WHOOP account	Recovery score, HRV, resting heart rate, sleep, cycle strain, workout activity, profile, body measurements — per the scopes you approve during connection
Oura	Optional recovery/vitals sync, only if you connect your Oura account	Sleep and readiness data, per the scopes you approve during connection
RevenueCat	Manages subscription purchases, entitlements, and renewal status for Pro and Elite plans	Purchase/subscription history, app-generated user ID, device platform — RevenueCat does not receive your name, email, or health data
Sentry	Crash and error reporting, used to find and fix bugs	Technical error details, device/app version, and an anonymous session identifier — not linked to your name or email

We do not use third-party advertising networks, analytics trackers, or data brokers. We do not sell your personal data to any third party.

7. Data Storage & Security

Account and app data (workouts, meals, weight logs, chat history) are stored in a database on our hosting infrastructure, secured with access controls limited to REPP's operator.
Passwords are stored as salted cryptographic hashes — REPP never stores or can view your plain-text password.
Progress photos are currently stored locally on your device, scoped to your account, and are not uploaded to our servers.
Connections to WHOOP and Oura use OAuth 2.0; REPP receives an access token authorized by you and revocable by you at any time, either in REPP's settings or directly in the WHOOP/Oura app.
Data in transit between the app and our servers is encrypted (HTTPS/TLS).

No system is perfectly secure, and we cannot guarantee absolute security of data transmitted over the internet. If we become aware of a data breach affecting your personal data, we will notify you and any applicable regulator as required by law.

8. Data Retention

We retain your account and app data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain certain records by law, or where data has already been anonymized/aggregated such that it no longer identifies you.

9. Your Rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Delete your data ("right to be forgotten")
Export your data in a portable format
Withdraw consent for optional integrations (WHOOP, Oura, HealthKit) at any time, without affecting the lawfulness of processing before withdrawal
Object to or restrict certain processing
Opt out of the sale or sharing of personal data (REPP does not sell or share personal data for cross-context behavioral advertising, so there is nothing to opt out of in practice)

EU/UK users have these rights under GDPR/UK GDPR. California residents have similar rights under the CCPA/CPRA. Residents of other jurisdictions may have comparable rights under local law. To exercise any of these rights, contact us using the details in Section 13. We will respond within the timeframe required by applicable law (generally 30 days for GDPR, 45 days for CCPA).

You can delete your account entirely from inside the app — Profile > Delete Account. This permanently removes your account and all associated data (workouts, meals, weight logs, chat history, goals, and programme) and cannot be undone. You can also contact us to request deletion if you prefer.

10. International Users

REPP is available worldwide. If you use REPP from outside the country where our servers are located, your data may be transferred to, stored, and processed in a different country. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for such transfers. By using REPP, you consent to this transfer, storage, and processing.

11. Age Requirement

REPP is intended for users aged 16 and older. We do not knowingly collect personal data from anyone under 16. If you believe a user under 16 has provided us with personal data, contact us and we will take steps to delete it.

12. Changes to This Policy

We may update this policy from time to time as REPP's features change. If we make material changes, we will notify you through the app or by email before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact Us

For any question about this policy, or to exercise a privacy right described above, contact:

Bruno Hejduk
Email: support@repp.fitness