Privacy Policy

repset is operated by Jack Allen Ltd ("we", "us", "our"), a company registered in England and Wales. We are the data controller for the personal data described in this policy. This policy explains what we collect when you use the repset app and website (the "Service"), why, how we handle it, and the rights you have. Questions and requests: support@repset.app.

Account information. When you sign in with Google, Apple, or an email one-time code we receive your name, email address, and profile photo (where provided), and a user ID. You choose a username when setting up your profile.

Health and fitness data. Workouts you track in repset, body measurements, goals, supplements, and data synced from services you choose to connect (such as Strong, Strava, Withings, or a gym platform): exercises, sets, reps, weights, routes, body metrics, and related information.

Precise location. If you connect Strava, the activities you import may include GPS route and precise location data. This comes only from activities in a fitness service you have chosen to connect — repset does not track your device location in the background or collect precise location directly from your device.

User content and social activity. The activities and posts you create, the people you follow, likes you give, profile details, and reports or blocks you make through our moderation tools.

Purchase and subscription status. If you subscribe to repset Pro, we receive your subscription and purchase status from Apple. We do not receive or store your full payment card details; payment is handled by Apple.

Technical data. Basic information needed to run and secure the Service, such as timestamps, device and app information, and IP addresses in server logs.

We use your data to provide and improve the Service: to create and manage your account; to show your workouts, measurements, trends, streaks, and stats; to power the social features (your profile, the feed you share with followers, likes, finding people); to generate AI workout suggestions, AI nutrition guidance, and AI chat responses; to sync data from services you connect; to process your subscription; to keep the Service secure; to provide support; and to comply with our legal obligations.

We do not sell your personal data, and we do not show third-party advertising.

To generate workout suggestions, nutrition guidance, and chat responses, relevant data is sent to third-party AI providers (such as OpenAI, directly or via an AI gateway) only to the extent needed to produce the response for you. These providers act as our processors under contract and process the data only on our instructions.

Your data is not used to train AI models — neither ours nor, under our contractual terms, our providers'. AI-generated content is informational only and is not medical, dietary, or professional advice; please see our Terms of Service.

Where the UK GDPR (and equivalent EU law) applies, we rely on the following legal bases:

Performance of a contract — to provide the Service you have signed up for, including accounts, tracking, social features, AI features, and subscriptions.

Legitimate interests — to secure, maintain, and improve the Service and prevent misuse, where these interests are not overridden by your rights.

Consent — where required, for example when you choose to connect a third-party service or share particular data. Health and fitness data may be special category data; where required we rely on your explicit consent, which you can withdraw at any time by disconnecting the service or deleting the data or your account.

Legal obligation — where we must process data to comply with the law.

With other users. Your activities are visible to people who follow you on repset, and your profile (name, username, photo, and stats) is visible to other signed-in users. You control much of what you share and can block other users.

With service providers (processors). We share data with providers who help us run repset — such as hosting, database, and AI processing — only as needed and under contracts that require them to protect it and use it only on our instructions.

With connected fitness services. When you connect a service such as Strong, Strava, Withings, or a gym platform, data is exchanged with that service at your direction and subject to its own privacy policy.

Legal and business transfers. We may disclose data if required by law or to protect our rights, and we may transfer data as part of a merger, acquisition, or sale of assets, in which case we will take steps to ensure it remains protected.

We do not sell your personal data and we do not share it for third-party advertising.

Some of our providers (including AI providers) may process data outside the UK or EEA. Where we transfer personal data internationally, we rely on appropriate safeguards, such as UK adequacy regulations or standard contractual clauses (with the UK addendum), to ensure your data remains protected.

We keep your data while your account is active and for as long as needed to provide the Service and meet legal requirements. You can delete individual activities in the app. To delete your account and associated personal data, email support@repset.app and we will action it within 30 days, except where we are required or permitted by law to retain certain information (for example limited records in backups or for legal, tax, or security purposes) for a longer period.

Depending on where you live, you may have rights to access your personal data, to have it corrected or erased, to receive a copy in a portable format, to restrict or object to certain processing, and to withdraw consent where we rely on it. To exercise any of these, contact support@repset.app and we will respond as required by law.

If you are in the UK, you can also complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EU, you can complain to your local data protection authority. We would appreciate the chance to address your concerns first.

We use reasonable technical and organisational measures to protect your personal data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials safe.

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We will update this policy as the Service evolves and change the effective date above. Where changes are material, we will take reasonable steps to flag them in the app. Your continued use of the Service after changes take effect means you accept the updated policy.