Privacy Policy

Effective date: 19 September 2026

This Privacy Policy explains what information Repvia ("the app", "we", "us") collects, how it is used, who it is shared with, and the choices you have. Repvia is operated by [YOUR FULL LEGAL NAME OR COMPANY NAME], which is the data controller for personal data processed through the app. If you have any questions, contact us at support@getrepvia.com. Hosted copies of these documents (when available) are at https://getrepvia.com.

The short version: most of your fitness, nutrition and body logs stay on your device. Data leaves your device when you sign in for social or coaching features, when we send push notifications, when you search external food databases, or when you choose to post, message or share something. Workout and meal logs are not uploaded just because you have an account — only what you share, and the account data needed to run social and coaching features. We do not sell your data, we do not show ads, and we do not use third-party analytics or tracking SDKs.

Direct messages: messages are private from other users, but they are not end-to-end encrypted. Our systems (and moderators we appoint) can access them when needed to operate the service or investigate a report — including nearby messages in that chat for context, not only the message you flagged.

1. Information stored only on your device

When you use Repvia without signing in, or use features that don't involve other people, the following is stored locally on your iPhone (and Apple Watch, if paired) and is not sent to us:

• Your profile details: name, date of birth, sex, height, weight, activity level, goals, and nutrition and water targets.
• Workout plans, workout sessions, logged sets, cardio entries, and readiness check-ins.
• Meals, foods, recipes, meal plans, shopping lists and supplement logs.
• Body measurements and weight entries.
• Progress photos (which you can additionally lock behind Face ID / passcode). The Face ID / passcode lock uses your device's authentication; we do not receive or store Face ID templates.
• Documents you import (PDF, Markdown, text, JSON). These are processed on-device, including by Apple's on-device intelligence features, and are not uploaded.

This on-device app data may be included in your device backups (iCloud or computer) according to your own Apple settings, except where we exclude personal health information from iCloud backup to comply with Apple's HealthKit rules. Health data obtained from Apple Health is governed by section 2. We cannot access your on-device store.

2. Apple Health (HealthKit)

If you choose to connect Apple Health, Repvia may read and write health and fitness data such as workouts, active energy, heart rate, body weight, and nutrition. You choose exactly which categories to allow in the iOS permission screen, and you can change this at any time in the Health app or iOS Settings.

Data obtained from Apple Health:

• is used only to provide fitness and health features within the app that you request;
• is never used for advertising, marketing, data mining unrelated to those features, or sold or shared with data brokers;
• is not uploaded to our servers unless you explicitly choose to share it — for example by posting a workout summary to the feed, or turning on sharing of specific summaries with a coach. Automatic activity sharing is off by default. Each sharing path asks for your confirmation; other people may copy or screenshot what you share.

3. Location

If you record an outdoor workout (for example a run, walk or ride), the app uses your device's location to measure distance, pace and route. If you grant "Always" permission, location may be used while a workout is running in the background. Location is only collected during a workout you start and is not shared with other users or sent to our servers. Route points kept for the workout stay on your device until you delete that workout or the app. If you have connected Apple Health, the workout route is saved to Apple Health, where Apple stores and syncs it according to your Health and iCloud settings; you can delete routes in the Health app.

4. Information stored on our servers (when you sign in)

Social and coaching features require an account. When you sign in (with Sign in with Apple or email and password), we store the following on our backend provider, Supabase:

• Account data: your email address (or Apple's private relay address), an account identifier, and authentication records. Passwords are handled by Supabase and are stored hashed; we cannot see them. Our servers may also hold authentication and security logs (for example IP address, timestamps and device information needed to keep accounts secure).
• Profile: display name, username, avatar photo, bio, and privacy settings such as your default post visibility.
• Social activity: follows, the people you select, posts and activity you share to the feed (including workout summaries and progress photos you choose to post), comments, reactions, challenge participation, and items you share with other users.
• Direct messages: the contents of messages you send and receive, and who they were exchanged with. Messages are encrypted in transit and at rest by our provider, but they are not end-to-end encrypted (see the short version above).
• Community contributions: recipes, foods and barcode entries you contribute to the community database.
• Coaching: if you connect with a coach or trainer using an invite code, the relationship itself, programmes they assign to you, and the summaries you choose to share with them. You control what is shared: workout sessions, nutrition summaries, body measurements and — only if you turn it on — progress photos. Progress photo sharing with a coach is always off by default. When you revoke sharing or disconnect, we stop new access; copies a coach already downloaded may remain on their devices, and they are responsible for deleting those.
• Safety records: blocks, reports you make or that are made about your content, and any moderation actions taken on your account.
• Support: messages you send us for help.
• Push notification token: a device token so we can notify you about messages and social activity. Message notifications may include the sender's name and a short preview of the message, delivered through Apple's push notification service (APNs). That preview can appear on your lock screen. You can hide previews in iOS Settings → Notifications.

Health-related information is not limited to Apple Health. Information you enter or share — such as weight, nutrition, workouts, readiness, progress photos, or messages about health — can be sensitive. We treat that carefully and only process special-category health data with your explicit consent where UK / EEA law requires it.

5. Third-party services

We use a small number of service providers. They process data only to provide their service to us, under contracts that restrict how they may use it.

• Supabase — database, authentication, file storage and server functions for accounts, social and coaching features (processor).
• Apple — Sign in with Apple, Apple Health, push notifications (APNs), and on-device intelligence. Apple's handling of this data is governed by Apple's own privacy policy.
• Food databases — when you search for foods or scan a barcode, the search text or barcode number is sent to the relevant database to return results: Open Food Facts, the USDA FoodData Central API, and Nutritionix. We do not send your name, account or health data with these requests. These services receive the query and, as with any internet request, your device's IP address; they may act as independent recipients under their own privacy policies for that request.

Coaches you connect with are independent of us. When you share data with a coach, that coach receives it as a separate recipient and is responsible for how they use it.

We do not use advertising networks, third-party analytics, or cross-app tracking. Repvia does not "track" you as defined by Apple's App Tracking Transparency framework.

6. How we use information

We use the information described above to:

• provide the app's features, including syncing social and coaching data between users (contract);
• personalise your nutrition targets and workout plans on your device from information you provide (contract / legitimate interests for on-device personalisation);
• send notifications you have enabled (consent);
• keep the community safe, including reviewing reported content and messages, enforcing our Community Guidelines, and preventing abuse, spam and fraud (legitimate interests / legal obligation where applicable);
• respond to your support requests (contract / legitimate interests);
• comply with legal obligations.

When content is reported, the reported content (and, for direct messages, the surrounding conversation where needed for context) may be reviewed by us or by moderators we appoint. Access is limited to authorised roles for that purpose.

Legal bases (UK / EEA users). We process your data to perform our contract with you (providing the app), on the basis of your consent (Apple Health connection, location, notifications, and sharing health-related data with a coach or publicly — which you can withdraw at any time), for our legitimate interests (keeping the service safe and secure), and to comply with the law. Special-category health data is processed only with your explicit consent (or another Article 9 condition where the law allows). Withdrawing consent for optional sharing stops future sharing; it does not always erase copies already held by other users or coaches.

7. Who can see your information

• Other users can see your public profile and the content you post, according to the visibility you choose (for example public or friends-only). People you message can see your messages.
• Coaches you connect with can see only what you have agreed to share, and you can revoke access at any time. Coaches are independent of us and are responsible for how they use information you share with them.
• Service providers listed in section 5.
• Authorities, where we are legally required to disclose information, or where necessary to protect someone's safety.
• A successor, if Repvia is sold or transferred, in which case this policy will continue to apply to your data until you are notified of any change.

We do not sell or rent your personal information. We also do not "sell" or "share" personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) for cross-context behavioural advertising, because we do not engage in that activity. If that ever changes, we will update this policy and provide any required opt-out.

8. Data retention

• On-device data is kept until you delete it or delete the app.
• Server account and profile data is kept for as long as your account is active.
• Posts, comments, reactions and similar social content are kept until you delete them or delete your account (subject to the exceptions below).
• Direct messages on our servers are kept while your account is active, and may remain visible to the other person after you delete your account if they still have their copy.
• Push tokens are kept while the device is registered and removed when you sign out or the token is replaced.
• Support emails are kept as long as needed to resolve your request and for a reasonable follow-up period.
• When you delete your account (Settings → Account → Delete account & data), we delete your profile and associated server data from our active systems. Exceptions:
• Community contributions (recipes, foods and barcode entries) may remain available to other users without your name attached.
• Messages and shared items already held by other users may remain on their accounts or devices.
• Limited safety and legal records (for example serious Community Guidelines violations, bans and report records needed to prevent abuse) may be kept for as long as reasonably necessary for those purposes, then deleted or anonymised.
• Residual copies may persist in encrypted backups for up to 30 days after deletion from active systems.

9. Your choices and rights

• Delete your account: Settings → Account → Delete account & data.
• Export your logs: Settings → Export & import creates a copy of your on-device logs. That export is not a complete copy of every server record. To request a fuller copy of personal data we hold about you, or to exercise other rights, contact support@getrepvia.com.
• Control permissions: Apple Health, location, camera and notifications can be changed in iOS Settings at any time.
• Control sharing: change post visibility, block users, and manage what a coach can see in Settings.

Depending on where you live (including the UK, EEA, California and other US states), you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent, and (where applicable) to opt out of sale/sharing or limit use of sensitive personal information. We will not discriminate against you for exercising these rights. Contact support@getrepvia.com; we may need to verify your identity. If you are in the UK or EEA you also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office).

10. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS/TLS), access controls on our database so users can only access data they are permitted to see, and optional biometric locking of progress photos on your device. No system is perfectly secure, so we cannot guarantee absolute security.

11. International transfers

Our service providers may store and process data in countries other than the one you live in, including the United States. Where required, these transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs, together with transfer risk assessments where needed.

12. Children and younger users

Repvia is not intended for anyone under 16. We do not knowingly collect personal information from anyone under 16. If you believe someone under 16 has provided us with personal information, contact support@getrepvia.com and we will delete it.

Users aged 16 or over may use the app. If you are under 18, use high-privacy settings where available, be careful what you share (especially progress photos and health information), and talk to a parent or guardian if you are unsure.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you in the app before they take effect. Where the law requires renewed consent (for example for new uses of health data), we will ask for it. The effective date at the top shows when it was last updated.

14. Contact

[YOUR FULL LEGAL NAME OR COMPANY NAME]
[POSTAL ADDRESS FOR LEGAL NOTICES]
support@getrepvia.com
https://getrepvia.com