Privacy Policy

This policy explains what personal data Repurr collects, why, and what you can do about it. It covers the Repurr app for iPhone and this website.

Who we are

Repurr is run by operator legal name, postal address. In this policy, “we” means that operator. We decide how your data is used, so we are the controller of your data.

Write to us at hello@repurr.app with any question about your data.

The short version

• We keep your account details and training data so that the app works for you.
• We never sell your data. Repurr shows no ads and reads no advertising identifier.
• The app has no analytics or crash reporting tools from other companies.
• After you agree in the app, the AI features send the training data they need to OpenAI.
• Our servers and database are in Frankfurt, Germany.
• You can delete your account in the app at any time.

What we collect and why

Your account

• Your email address and a scrambled form of your password (a bcrypt hash). We never see the password itself.
• If you sign in with Apple or Google, an identifier from them. Apple can give us a private relay address instead of your email. We also keep a token from Apple. When you delete your account, we use it to revoke Repurr’s access.
• Your name. You type it, or Apple or Google gives it to us.

We need these to create your account and to sign you in. The legal basis is our contract with you.

Your profile

Your username, your name, a short bio, a link and a profile picture. If you add your birthday, we keep it too. You also choose whether your profile is private.

We use these to show your profile to other people on Repurr. The legal basis is our contract with you.

Your training profile

Your goal, your experience, how often and how long you train, where you train and what equipment you have. You can also mark body areas to work around, such as a knee or the lower back, and add a short note.

We use these to write workouts that fit you. Body areas to work around and your note can say something about your health. We use them only because you choose to enter them, and you can remove them at any time in the app.

Your workouts and body weight

Your workouts with their sets, notes, the gym you name and your records. Your saved workouts, any exercises you create, and the body weights you log.

We keep these so that you can log your training and see your progress. Body weight is health data. We use it only because you choose to log it, and you can delete any entry.

Friends and community

The people you follow and block, your likes and comments, and the reports you send about content or people.

We use these to run the social features and to keep Repurr safe. When you send a report, our moderators get an email with the report and your note. If you report an answer from Buddy chat, that email also quotes your question and the answer.

The AI features

Repurr has three AI features: Build with Buddy, AI weights and Buddy chat. They work only after you agree to the AI terms in the app. You can withdraw your consent in Privacy & social. You must be 18 or over to turn them on.

• Build with Buddy sends your training profile, including body areas to work around and your note, and the focus you pick.
• AI weights send your goal, your units, the names of the exercises in the workout, and your last three workouts with each exercise.
• Buddy chat sends your training profile, your latest body weight and its date, and your time zone. It also sends a summary of your last five workouts, the names of your saved workouts and your recent messages. While it answers, Buddy can read more of your history, such as workout notes and sets.

We send this data to OpenAI, which writes the answer. We ask OpenAI not to store the requests. OpenAI’s terms say that it does not train its models on data sent through its API. They also say that it can keep that data for up to 30 days to detect abuse. Chat messages are also checked by OpenAI’s moderation service.

We keep each AI request with its answer, and your chat messages. The features need them. If something goes wrong, they let us find out why. If Buddy shows a support card in the chat, for example about a crisis, we keep a note of that with the request.

The legal basis is your consent, together with our contract with you.

Your contacts and phone number

If you choose to find friends from your contacts, your phone turns each email address and phone number into a code. It sends only those codes (SHA-256 hashes). We store only how many codes were sent, and never your address book.

If you add a phone number, Twilio sends you a code by text message to check it. We keep the number to let friends find you, and you can remove it at any time.

Purchases

If you buy Repurr Plus, Apple handles the payment, and RevenueCat tells us that your subscription is active. We keep only your plan and its end date, never your payment details.

Notifications

If you allow notifications, we keep a token for your phone, so that we can send you likes, comments and follows through Expo’s push service.

Usage data, only if you share it

The app asks whether you want to share usage data. If you say yes, it sends these events:

• the screens you open and what each one showed
• what you tap
• your visits and your time in the app
• each time you create, start, save or discard a workout
• the steps of a purchase
• the words of exercise searches that found nothing

Those words are cut to 40 characters. They are the only words you type that usage data ever holds. Each event also keeps its time.

We use usage data to improve Repurr. The legal basis is your consent. You can turn it off in Privacy & social, and turning it off deletes the usage data already stored.

Active days

For every account, we record which days it was used. We do this to count active users and to protect the service. The legal basis is our legitimate interest in running Repurr.

What we do not store

Your IP address is used only in memory, to limit requests from one network, and is never saved. Your time zone travels with each request and is not saved. The one exception is a Buddy chat request, which keeps it.

Who sees what

• Your workouts are visible to everyone on Repurr by default. You can change this for each workout, and you can change the default in Privacy & social.
• If your profile is private, only the followers you approve see your workouts. Everyone who is signed in can still see your username, name, picture, bio and link.
• Other people in the app never see your body weight. But the volume of a workout made only of bodyweight exercises includes your body weight, so people who see that workout can work it out.

Who helps us run Repurr

We share data only with the companies that run parts of Repurr for us, and only what each one needs.

Profile pictures are stored at a public web address, so anyone with that address can see the picture.

When you speak to Buddy chat, your phone’s own speech recognition turns your voice into text. Apple can process that audio on its servers. Only the text reaches Repurr.

Some of these companies are outside the European Economic Area. We send data to them under the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.

On your phone

The app keeps you signed in with tokens stored in the iPhone keychain. To open fast, it keeps a copy of recent data for up to 7 days. It also keeps a queue of workouts that wait to sync. Signing out clears the copy. Logging out also clears the queue.

How long we keep your data

• Your account, profile, training and AI history stay until you delete your account.
• Your chat messages stay until you clear the chat or delete your account.
• Usage events are deleted after 90 days.
• Active days stay until you delete your account.
• Our database provider keeps backups for a short time. As those backups expire, deleted data is gone from them too.

When you delete your account

You can delete your account in the app: open Settings, then Account, then Delete account. We then delete your account and almost everything tied to it. The Delete account page lists what goes and what stays.

Your rights

You can ask us to:

• tell you what data we hold about you, and give you a copy
• correct data that is wrong
• delete your data
• limit how we use it, or object to a use that rests on our legitimate interest
• send your data to you in a format that a computer can read

You can withdraw your consent at any time in the app, or by writing to us. This does not change what we did before.

Write to hello@repurr.app from the email address of your account. We answer within 30 days.

If you live in the EU or the UK, you can also complain to your data protection authority. In Ukraine, you can complain to the Ukrainian Parliament Commissioner for Human Rights.

If you live in California or another US state with a privacy law, you have the same rights to know, correct and delete. We do not sell your data or share it for advertising.

Age

Repurr is for people aged minimum age and over. The AI features are for people aged 18 and over. If you think that a child under the minimum age uses Repurr, write to us, and we will delete the account.

Security

We store passwords only as hashes. The iPhone keychain holds the tokens that keep you signed in. All data travels over encrypted connections. We also limit how often anyone can try to sign in.

This website

This website sets no cookies, uses no analytics and loads no scripts from other companies. Its fonts come from our own server.

If you leave your email for the beta, we store it in our database. With it, we store when you sent the form, your browser’s language and which of the two forms you used. We use it to invite you to the beta on TestFlight, Apple’s app for testing new apps. For the invite, we can give your email to Apple. We use it once more to tell you that Repurr is in the App Store. We then delete the list, and we never keep it longer than 12 months. Write to us to remove your email sooner.

Changes

As Repurr changes, we will update this policy. If a change is important, we will tell you in the app before it applies.