Privacy Policy

Who we are

RepTrack (“we”, “us”) is operated by Reptrack. For data protection purposes we are the controller of the personal data described here. You can reach us at support@reptrack.me.

What we collect

Account details. Your email address, and a unique account identifier. If you sign in with Google, we receive the email address and basic profile information on that Google account. Passwords are handled entirely by Firebase Authentication — we never see or store them.

Your training data. The sessions you log (exercises, weights, reps, sets and timestamps), body-weight entries, any custom exercises you create, the program you are following, your unit preference, and your coaching profile — goal, days per week, available equipment and session length.

Subscription status. Whether your account is on Free, Pro or Coach, and any tier granted by a promo code. Payments themselves are processed by Apple and Google — we never receive your card number or billing address.

Security codes. When you verify an email address or reset a password, a one-time code is generated. Only a hash of it is stored, it expires after ten minutes, and it can be used once.

What we do not collect. There is no analytics SDK, no advertising SDK, no tracking pixel and no third-party session recorder in the app or on this website. We do not build advertising profiles, and we do not sell or rent personal data to anyone.

Where your data lives

RepTrack is local-first. Every entry is written to your device first, and the app never waits on a network connection to record a set — which is why it works with no signal at all.

Provided you are signed in, that data is also mirrored to our Firestore database so it survives a lost phone and follows you to a second device. The mirror is keyed to your account, and our security rules permit each account to read and write only its own records. Syncing happens in the background shortly after you make changes, and resumes when a connection returns.

The coaching engine itself runs entirely on your device. Your sessions are not sent anywhere to be analysed, and no language model is involved in producing your insights or generated workouts.

Why we process it

• To provide the service — storing your log, running progression, syncing between your devices. This is necessary to perform our contract with you.
• To keep accounts secure — verification codes, password resets and abuse prevention. This is our legitimate interest in a service that is not trivially hijacked.
• To handle subscriptions — confirming entitlements with Apple and Google and honouring promo codes, again to perform our contract.
• To meet legal obligations — tax and accounting records where they apply.

Who else touches it

We use a small number of processors, each for a specific job:

• Google Firebase — authentication, the Firestore database and server functions.
• Apple App Store and Google Play — payment processing and subscription management. Their own privacy policies govern that transaction.
• Our email provider — delivering verification and password-reset messages. These emails contain a code, not your training data.
• Our hosting provider — serving this website.

These providers operate globally, so your data may be stored or processed outside your own country, including in the United States. Where required, transfers rely on the safeguards those providers offer, such as Standard Contractual Clauses.

How long we keep it

Your training data is kept for as long as your account exists — a training log is only useful across years, so we do not quietly expire it. Security codes are deleted after ten minutes. If you delete your account, your data is removed from our systems, other than anything we must retain for legal or accounting reasons.

Your rights

Depending on where you live, you have some or all of the following rights. We do not charge for exercising them and we will not degrade your service for asking.

• Access and portability — get a copy of what we hold.
• Correction — fix anything inaccurate. Most of it you can edit directly in the app.
• Deletion — erase your data. The app’s erase function clears the cloud copy as well as the one on your device, so it is a real deletion rather than a local reset.
• Objection and restriction — ask us to stop or limit certain processing.
• Withdraw consent — where we rely on it, at any time.
• Complain — to your local data protection authority. In the UK that is the Information Commissioner’s Office.

Email support@reptrack.me and we will respond within one month.

If you are a client of a trainer

On the Coach tier, a trainer can see the training data of clients on their roster — the sessions you log, your adherence, and the flags the app raises. Your trainer decides how they use that information and is responsible for their own handling of it. If you do not want a trainer to see your log, do not join their roster; ask your trainer to remove you and that access ends.

Children

RepTrack is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal information, contact us and we will delete it.

Security

Data is encrypted in transit. Access to the database is governed by per-account rules enforced on the server rather than in the app, so one account cannot reach another’s records. Sensitive server operations run with credentials that are never shipped to the app. No system is perfectly secure, but we will tell you promptly if a breach affects your data and the law requires notice.

Changes to this policy

If we change how we handle data we will update this page and move the date at the top. For anything significant we will tell you in the app or by email rather than relying on you to notice.