Privacy Policy

1. Responsible Party

The responsible party for data processing on this website is:

A data protection officer is not required under § 38 BDSG, as the statutory thresholds are not met.

2. Overview of Data Processing

We process the following categories of personal data:

• Account data: Name, email address, password (stored only as a hash) and your in-app settings, such as language, accent color and available weight plates
• Session data: Session token, plus the IP address and browser identifier (user agent) at sign-in
• Workout data: Training plans, exercises, sets with reps, weight and RIR, skip reasons, personal records, exercise notes and timestamps
• Body data: Body weight and related notes, if you record them
• Technical data: For every request, our hosting provider logs the IP address, browser identifier, time and requested address
• Security data: TOTP secret and backup codes for two-factor authentication (both stored encrypted), plus time-limited codes and tokens for email confirmation, sign-in and password reset
• Security log: Entries for security-relevant events, namely enabling and disabling two-factor authentication, regenerating backup codes, two-factor sign-in with an emailed code, requesting, cancelling and carrying out an account deletion, sending emails (with the recipient address), and interventions in your account by the operator, some with IP address and browser identifier
• Studio data (only if you use the coach features): Studio memberships and roles, consents to coach visibility, assigned training plans, invitations and redeemed invite links; for people who create a coaching area, also the acceptance of the data processing agreement and the plan, subscription status, and Stripe customer and subscription IDs
• Shared workout links: the links you create, the workout each belongs to, and their creation and revocation dates

3. Legal Bases

We process your data on the following legal bases:

• Account, workout, body and studio data, security data, email delivery and billing for coaching-area subscriptions: Art. 6(1)(b) GDPR (performance of a contract). Providing REPPPS requires processing this data.
• Visibility of your training data to a studio: Art. 6(1)(a) GDPR and, where skip reasons allow conclusions about your health, Art. 9(2)(a) GDPR (consent given when joining the studio). You can withdraw this consent at any time with effect for the future (section 8).
• Public workout links: Art. 6(1)(a) GDPR (consent given by creating the link); you withdraw it by revoking the link (section 9).
• Technical log data, the security log and rate limiting (IP addresses, browser identifiers, access times): Art. 6(1)(f) GDPR (legitimate interest in security, stability and abuse prevention). You may object to this processing pursuant to Art. 21 GDPR.

4. Cookies and Storage on Your Device

We only use technically necessary cookies: a sign-in cookie that keeps you signed in (without “Remember me” until you close the browser and for 24 hours at most, otherwise for up to 30 days), a cookie that caches session data for 5 minutes, a cookie valid for 5 minutes during sign-in with two-factor authentication, a cookie that stores your choice when you do not select “Remember me”, and a language cookie if you use a different language from the one set in your browser.

In your browser's local storage, the app keeps a workout in progress so that it survives a page reload, as well as your display and workout settings (such as theme, “Keep screen awake”, the countdown before a set and collapsed folders). A service worker stores static app files such as scripts, fonts and images so that the app loads faster; no personal data is cached there. The cookies and storage described here do not require consent under § 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as they are strictly necessary to provide the service you have explicitly requested; see also Art. 5(3) of the ePrivacy Directive.

5. Analytics and Tracking

REPPPS uses no analytics or tracking tools, no advertising, no tracking pixels and no third-party error monitoring. Fonts and all other parts of the app are served from our own server; no content is loaded from third-party servers while you use the app. Only when you take out or manage a subscription for the coaching area are you redirected to pages hosted by Stripe. If this changes, we will ask for your consent beforehand where required and update this policy.

6. Subprocessors

A full list of subprocessors, the data they process and the basis for data transfers is available on our subprocessors page.

7. Service Providers

To operate REPPPS, we use the following service providers, which process data on our behalf:

• Railway (Railway Corporation, USA) – hosting of the application, database and cache in the europe-west4 region (Netherlands). Where data is transferred to the USA, this is based on Railway's DPA (EU standard contractual clauses or the EU-US Data Privacy Framework, where the recipient is certified).
• Resend (Plus Five Five, Inc., USA) – delivery of transactional emails. Transfer to the USA based on the EU-US Data Privacy Framework and EU standard contractual clauses.
• Stripe (Stripe Payments Europe, Limited, Ireland) – payment processing for coaching-area subscriptions; applies only to people who create a coaching area. For its own purposes, such as fraud prevention, Stripe acts as an independent controller. Transfers to Stripe, LLC (USA) based on the EU-US Data Privacy Framework and EU standard contractual clauses.

8. Studio and Coach Features

If you join a studio through an invitation and consent to coach visibility, the studio's coaches can see part of your data so they can guide your training. The studio is responsible for processing in the coach area; to that extent, REPPPS processes the data on the studio's behalf.

• What coaches see: Your name and email address, your sessions, sets with reps, weight and RIR, personal records, skip reasons (these may allow conclusions about your health, for example “pain”), progression charts, and the training plans assigned to you with your progress in them. Your body weight and personal notes stay private.
• Contact on inactivity: Coaches see when you last trained, and your studio may contact you if you haven't trained for a while.
• Withdrawal: You can withdraw your consent at any time by leaving the studio under Settings > My studios. Your data is then no longer visible to the studio; your own training journal stays unchanged.
• Billing: If you create a coaching area, a Stripe customer account with your email address and an internal studio identifier is created for the subscription. You enter payment details directly with Stripe; REPPPS receives no card data.

9. Shared Workout Links

You can create a public link to a single completed workout. Anyone who has the link can open it without an account.

The page shows your first name (or “A REPPPS lifter” if none can be shown), the date and duration of the workout, its exercises with sets, weights, repetitions and RIR, and PR markers.

It never shows your last name, email address, plan name, notes or body data. The page tells search engines not to index it. The app keeps no record of who opens the link; every request is still subject to the rate limiting per IP address and to the hosting provider's HTTP logs described under Data Retention.

You can revoke a link at any time in the workout's share menu or under Settings, Data, Shared links. A revoked link stops working immediately and is never reactivated; sharing again creates a new link. Deleting the workout, or requesting deletion of your account, also makes its links stop working immediately; if you withdraw the deletion request, links you have not revoked work again. Revoking cannot remove previews that chat apps have already generated or copies that recipients have saved.

We store the link, the workout it belongs to, the time zone used to show its date, its creation date and, if applicable, its revocation date, so that revoked links cannot be reactivated. These records are part of your data export and are deleted with your account.

Legal basis for publishing your workout through a link: Art. 6(1)(a) GDPR (consent). Creating a link is your own action, and you can withdraw your consent at any time with effect for the future by revoking the link.

10. Contact by Email

If you contact us by email, for example at hi@reppps.app, by replying to an email from REPPPS or at another address under reppps.app, we process your email address, the content of your message and any details you provide in it in order to handle your request.

Where your request relates to a contract with us or to steps taken before entering into a contract, the legal basis is Art. 6(1)(b) GDPR; otherwise it is Art. 6(1)(f) GDPR (legitimate interest in answering requests addressed to us).

Emails to hi@reppps.app and to all other addresses under reppps.app are received and stored by the mail servers of IONOS SE (Germany).

We delete your request and our related correspondence once your matter has been fully dealt with, unless statutory retention obligations prevent this.

11. Data Retention

We retain your data for the following periods:

• Account data: Until your account is deleted. You can withdraw a deletion request made in the settings for 30 days; after that, the deletion is carried out automatically.
• Sessions: Without “Remember me” 24 hours at most, otherwise up to 30 days after last use. Signing out deletes the session; expired sessions are removed the next time they are used, and at the latest when your account is deleted.
• Workout and body data: Until your account is deleted
• Studio data: Until the studio is deleted. When the studio subscription ends, we notify the studio owner by email; unless the studio is reactivated, we automatically delete it with all studio data 30 days after the end of the subscription, but no earlier than 14 days after the notification. If the studio requests the return of its data before then, we delete it after the return. If you created a coaching area, deleting your account immediately cancels the Stripe subscription and deletes the studio with all studio data. In both cases, the members' own accounts and training logs remain. Your Stripe customer account is not deleted; we are required to keep the invoices issued through it for the statutory retention periods.
• Shared workout links: Until your account is deleted; revoked links stay stored without being reachable, so they can never be reactivated
• Hosting provider HTTP logs: 30 days
• Rate-limiting counters: One hour at most
• Security log: Entries are deleted automatically 90 days after they are created. If your account is deleted before then, the link between the entries and your account, the IP address and the browser identifier are removed immediately, and entries about emails sent to your address are deleted immediately.
• Email queue: Emails whose delivery initially fails are stored with the recipient address and content and sent again. These entries are deleted automatically 90 days after they are created, whether or not the renewed delivery succeeded. If your account is deleted before then, entries addressed to you are deleted immediately.
• Backups: Deleted data can remain in the database backups and in the point-in-time recovery archive for up to about 4 weeks, until it is overwritten in the regular rotation.

12. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please contact us at the email address listed above.

13. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority competent for us is the Landesbeauftragter für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern (State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania).