Privacy Policy

Last updated: 12 October 2026

1. Data controller

The data controller within the meaning of the GDPR is Michael Kamleiter, Deutenbacherstraße 46, 90547 Stein, Germany. Contact: info@getreppd.app.

2. Data protection officer

Given the current scale of the service, appointing a data protection officer is not legally required. You can reach the controller directly at info@getreppd.app for any privacy-related inquiry.

3. What data we process

3.1 Website (getreppd.app)

This site consists mostly of static pages; only the pages for shared workouts (3.1.3) are generated on request. We do not use analytics, tracking pixels, advertising cookies, external fonts, or third-party embeds. Beyond simply serving the page, we only process the technical connection data described below.

3.1.1 Server log files

When you access getreppd.app, our hosting provider automatically processes the following technical connection data in log files:

  • truncated IP address
  • date and time of the request
  • URL requested and HTTP status code
  • amount of data transferred
  • referrer URL
  • user agent (browser / operating system identifier)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website and defense against abusive access). Storage period: as a rule, no longer than 14 days, after which the data is automatically deleted. This data is not combined with other data sources.

Hosting processor: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers). A data processing agreement under Art. 28 GDPR is in place. Cloudflare is certified under the EU-U.S. Data Privacy Framework; additionally, EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) apply. Content is served primarily from edge servers in the user's region.

3.1.2 Contact by email

If you contact us by email, we process the data you provide (email address, name, content) to handle your inquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / contract performance) or Art. 6(1)(f) GDPR (legitimate interest in responding). We delete the correspondence as soon as it is no longer required for its purpose, at the latest after three years, unless statutory retention periods (e.g. § 257 HGB) require longer retention.

3.1.3 Shared workouts (getreppd.app/w/…)

When you open a link to a shared workout or training plan, our server looks up the code contained in the link with our app backend and shows a preview. No data about you is transmitted in the process, neither your IP address nor cookies; your browser makes no requests to third parties. We only log that the code was opened (without reference to a person) to evaluate the use of official codes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the preview).

3.2 reppd App

a) Authentication data

When you create an account, we store your email address and a hashed password verifier with our backend provider Supabase (see Section 5). This data is not end-to-end encrypted on our servers so that login and account security can work. System emails (e.g. sign-up confirmation, password reset) are sent via the email service Resend (Resend, Inc., USA), which processes your email address and the content of the respective system email. Legal basis: Art. 6(1)(b) GDPR (contract performance).

b) Training and body data (special category, Art. 9 GDPR)

Workouts, sets/reps/weights, conditioning sessions, and optional body measurements (e.g. weight, circumferences) may be health data within the meaning of Art. 4(15) GDPR and then fall under the special category of Art. 9 GDPR. reppd stores this data locally on your device first and syncs it with your account on the servers of our backend provider Supabase (data centre in Frankfurt am Main, EU).

The following applies:

  • End-to-end encrypted (optional): If you enable encryption in the app, your personal profile data (name, date of birth, gender, height, body weight) and your body measurements are encrypted on your device with AES-256-GCM before they reach our servers. Only your devices (iCloud Keychain) and your recovery key hold the key — we cannot decrypt this content. Without encryption enabled, this data is not synced to the server.
  • Not end-to-end encrypted: All other content — in particular workouts, sessions, sets, conditioning sessions, training plans, statistics, achievements and points, as well as the limitations and preferences you save in Spotter — is stored on the server in readable form. It is protected by TLS transport encryption, the hosting provider's encryption at rest, and database-level access rules (Row Level Security) so that only your account can retrieve it. As the operator, we are technically able to access this data; we only do so where necessary for operating the service (e.g. AI features at your request, troubleshooting).

Details on our encryption page.

Legal basis: Art. 9(2)(a) GDPR (explicit consent, given when creating the account) in conjunction with Art. 6(1)(b) GDPR (contract performance). You may withdraw your consent at any time by deleting your account in the app — your data will then be deleted immediately via cascading delete (see Section 10).

c) Apple Health Sync (optional)

If you enable the Health integration, reppd on your iPhone writes your completed workouts (including the effort rating, where available) and the body measurements you log in reppd (weight and waist circumference) to Apple Health. The iPhone app does not read any data from Apple Health.

If you use the Apple Watch app, it starts a workout on the Watch during a session and, with your permission, reads heart rate and active energy (calories) from HealthKit to show them live on the Watch and on the iPhone's session screen. At the end, the Watch saves the workout including these values to Apple Health. Heart-rate and calorie values are only transferred locally between Watch and iPhone; reppd does not store them permanently and does not send them to our servers.

You can revoke the Health permissions at any time in your iOS system settings.

Legal basis: Art. 9(2)(a) GDPR (consent, given when you first enable the Health integration).

d) Subscriptions & payment (Pro)

Purchases and subscriptions are processed exclusively via Apple In-App Purchase. The contractual partner for the payment is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. To manage subscriptions and credit purchases we use RevenueCat (RevenueCat, Inc., USA). RevenueCat processes your pseudonymous reppd account ID (as app user ID), purchase and subscription information (e.g. product, purchase date, term, status) and technical device and app information, and reports the subscription status to our backend. We receive no payment data, no credit card information, and no Apple ID details. Legal basis: Art. 6(1)(b) GDPR (contract performance). The transfer to the USA is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where applicable, the EU-U.S. Data Privacy Framework.

e) AI features (Spotter, AI workouts, import)

Only when you actively use an AI feature (e.g. the Spotter chat, ratings and reviews, AI workouts, exercise tips and alternatives, or the workout import), our server transmits the data required for it in plain text to our AI processor Anthropic. This is your input (e.g. your question, a workout plan you describe, or the text recognised on your device from an image — not the image itself) and, where relevant to the feature, your training profile (fitness level, goal, training days, training location, volume goals, equipment), the limitations and preferences you saved in Spotter, the number of your training sessions in the last 28 days and the names of your most recent workouts. We do not pass on your email address, profile identifier, or body data.

All AI requests are handled by Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA (Claude API), regardless of feature or plan. Anthropic states that it does not use API inputs to train its models.

Results such as workout and plan ratings and weekly and monthly reviews are stored in your account so you can open them again in the app. We do not store chat messages and replies on our server; there we only log usage data (feature, time, model, token count, credits used and, if given, your thumbs feedback) for quotas and billing.

Legal basis: Art. 6(1)(b) GDPR (contract performance, where you actively use the AI feature). Data processing agreements under Art. 28 GDPR are in place with the providers. The transfer to the USA is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where applicable, the EU-U.S. Data Privacy Framework.

f) Sharing workouts (Pro)

When you share a workout or training plan, we store a copy of its content (name, exercises, sets/reps, rest times, notes) under a random code on our servers. This copy is not encrypted: anyone with the code or link can view and import it. Personal values such as your training weights, training history or body data are not included, and neither is your name. The code is valid for 4 days and is deleted no later than 30 days after that; deleting your account immediately deletes all of your shares. Legal basis: Art. 6(1)(b) GDPR (providing the sharing feature you use).

g) Crash reports / diagnostics

To maintain app stability, we use Sentry (Functional Software, Inc., 45 Fremont St, 8th Floor, San Francisco, CA 94105, USA). In the event of crashes and errors, technical diagnostic data is transmitted (stack trace, device and OS version, app version, technical log entries preceding the error, and where applicable the random ID of the currently running training session), as well as sampled app performance data. The app deliberately does not send your email address, a user identifier or screenshots; your IP address is processed for technical reasons when the connection is established. Training content is not part of the error reports.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in debugging and app security). A data processing agreement under Art. 28 GDPR is in place with Sentry; the transfer to the USA is based on EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

4. How we use your data

  • Authentication and account management
  • Providing the reppd service (storing and syncing your data)
  • Handling subscriptions and purchases
  • Responding to support inquiries
  • Stability and error diagnostics
  • Providing optional AI features

We do not use your data for advertising, external tracking, or sale to third parties. No automated decision-making with legal effect against you within the meaning of Art. 22 GDPR takes place. Within the service, we use your training data exclusively to provide reppd's features. Progression suggestions, statistics and the rule-based Spotter hints are calculated on your device; AI analyses only take place at your request as described in Section 3.2 e).

5. Recipients / processors

We do not sell, share, or rent your data. The following processors support us under Art. 28 GDPR:

  • Supabase, Inc. (USA) — app backend: account/login, database, sync, server functions; data hosted in the Frankfurt am Main data centre (EU)
  • Resend, Inc. (USA) — sending system emails (sign-up, password reset)
  • RevenueCat, Inc. (USA) — managing subscriptions and in-app purchases
  • Anthropic PBC (USA) — AI features (Claude API, only when actively used)
  • Functional Software, Inc. (Sentry) (USA) — crash and error diagnostics for the app
  • Cloudflare, Inc. (USA) — hosting / edge delivery of the website

Apple (Apple Distribution International Ltd., Ireland) is independently responsible for app distribution and payment processing in the App Store; Apple Health and HealthKit run on your device under Apple's terms.

Beyond this, we share data with third parties only where we are legally required to do so (e.g. under a binding government order).

6. International data transfers

Insofar as data is transferred to providers in the USA (see Sections 3 and 5), this takes place on the basis of:

  • the European Commission's adequacy decision regarding the EU-U.S. Data Privacy Framework (Art. 45 GDPR), where the respective recipient is certified, and/or
  • EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary technical and organizational measures (including transport encryption, data minimisation — e.g. no email address sent to the AI provider — and optional client-side end-to-end encryption of profile and body data).

The app's database is located in the EU (Frankfurt am Main). Because Supabase, Resend, RevenueCat, Sentry, Anthropic and Google are US-based companies and/or may process data (also) in the USA, not all data remains exclusively in the EU.

7. Data storage & security

The app's database is operated by Supabase in the Frankfurt am Main data centre (EU). All connections are TLS-encrypted; stored data is protected by the hosting provider's encryption at rest and database-level access rules (Row Level Security). Only your personal profile data and body measurements are end-to-end encrypted — and only if you have enabled encryption (see Section 3.2 b). In addition, we employ regular security updates and access controls in line with Art. 32 GDPR.

8. Your rights (GDPR)

Under the GDPR you have the right to:

  • Access (Art. 15 GDPR) — request a copy of your data
  • Rectification (Art. 16 GDPR) — correct inaccurate data
  • Erasure (Art. 17 GDPR) — delete your account and all data
  • Data portability (Art. 20 GDPR) — export your data
  • Restriction (Art. 18 GDPR) — limit how we process your data
  • Objection (Art. 21 GDPR) — object to data processing
  • Withdrawal of given consent (Art. 7(3) GDPR) with effect for the future

To exercise any of these rights, contact us at info@getreppd.app. Account deletion is also available directly in the app and permanently removes your data from our database via cascading delete.

9. Cookies and similar technologies

We currently set neither cookies nor comparable storage on your terminal device on getreppd.app. Should we introduce strictly necessary cookies in the future, this will be based on § 25(2)(2) TDDDG in conjunction with Art. 6(1)(f) GDPR. Details in our cookie policy.

10. Retention

We retain your data for as long as your account exists and as required to provide the service. When you delete your account, all content data is deleted immediately and permanently from our database (cascading delete, no soft-deletes). Automatic backups of the hosting provider may still contain data until they are overwritten in their regular rotation. Purchase and subscription information held by Apple and RevenueCat is subject to their retention periods and statutory retention obligations. Technical log files are deleted after at most 14 days. Email correspondence is deleted as soon as it is no longer required.

11. Minors

reppd is not directed at children under 16. We do not knowingly collect personal data from children under 16. Should we become aware that an account was created by a person under 16, we will delete it without undue delay.

12. Changes to this policy

We may update this privacy policy to reflect changes in the law or in our processing. The current version is always available on this page with a date stamp. For material changes, we will additionally notify you via the app or by email.

13. Contact & supervisory authority

For privacy inquiries, contact us at info@getreppd.app.

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Phone: +49 981 180093-0
Email: poststelle@lda.bayern.de
Web: www.lda.bayern.de