Privacy Policy

1. Summary at a glance

Privacy matters especially for a fitness app, because body photos, weight and wellbeing data are sensitive. The key points:

The sections below explain each processing activity in detail, including the legal basis, recipients and how long we keep the data.

2. Controller and contact

The controller within the meaning of Art. 4(7) of the EU General Data Protection Regulation (GDPR) is:

rep.ai is a product and project of yeeylo UG (haftungsbeschränkt). For questions about data protection or to exercise your rights, email privacy@rep-ai.online or write to the postal address above.

Data protection officer

We are not legally required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). Our privacy contact above handles all data protection matters directly.

3. Health data and your explicit consent

Some data you provide in rep.ai can reveal information about your health. Such data counts as a “special category of personal data” under Art. 9(1) GDPR. In rep.ai this includes in particular:

• body scan photos and the visual physique estimates derived from them (e.g. estimated body proportions, visible muscle development, body-fat estimate ranges);
• body weight, weight trend and body measurements;
• muscle injuries, physical limitations and pain information you enter;
• sleep duration, sleep quality, energy level and recovery speed;
• nutrition data related to your body goals (calorie and protein targets, meals logged, dietary style);
• the optional self-assessment of your libido/sex drive in the onboarding, which can concern data about your sex life;
• data imported from Apple Health or Health Connect, if you enable it.

We process this data only on the basis of your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). We ask for it in the app before the first processing, separately from accepting our Terms of Service. The consent screen tells you which data is involved, what it is used for, and that it is transferred to OpenAI for AI analysis (see Section 8 and Section 17).

Optional questions, such as libido or injuries, can be skipped. Skipping only means that rep.ai cannot use that information to personalise your plan.

4. Visiting our website

4.1 Hosting and server log files

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel delivers the website via a global content delivery network, so requests may be served from the server location closest to you. When you open the website, your browser automatically transmits information that the server stores temporarily in log files:

• IP address of the requesting device;
• date and time of the request;
• requested page or file, HTTP status code and amount of data transferred;
• referrer URL (the previously visited page), if transmitted;
• browser type and version, operating system.

Purpose: delivering the website, ensuring its stability and security, and detecting and defending against attacks. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free provision of the website. Storage: log files are deleted after 30 days at the latest, unless we need specific entries longer to investigate a security incident. We have concluded a data processing agreement with Vercel (Art. 28 GDPR). Vercel is certified under the EU–U.S. Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply (see Section 17).

4.2 No cookies, no tracking, no external fonts

Our website does not set cookies, does not use analytics or advertising tools, and does not load content from third-party servers. Fonts and images are delivered together with the website from our own hosting, so no data is transmitted to Google Fonts or similar services when you visit the website.

4.3 App store links

Our website contains links to the Apple App Store and Google Play. These are plain links: data is only transferred to Apple or Google once you click a link and leave our website. From then on, the privacy policies of Apple and Google apply.

5. Early-access list

You can sign up on our website to be notified about the launch of rep.ai. We process:

• your email address;
• the date and time of sign-up and confirmation, and the IP address used for confirmation (to prove your consent);
• the source of the sign-up (e.g. “rep.ai landing page”).

Purpose: sending you information about early access, beta invitations and the launch of rep.ai. We use the double opt-in procedure: you receive a confirmation email and are only added to the list once you click the confirmation link. Legal basis: your consent, Art. 6(1)(a) GDPR, together with § 7(2) No. 2 of the German Unfair Competition Act (UWG). Logging the sign-up is based on Art. 6(1)(c) and (f) GDPR (proof of consent).

Withdrawal: you can unsubscribe at any time via the link in every email or by emailing privacy@rep-ai.online. Storage: until you unsubscribe or the early-access programme ends, and at the latest 24 months after sign-up. After you unsubscribe, we may keep your email address on a blocklist for up to three years so that we can prove your earlier consent and make sure we do not contact you again (Art. 6(1)(f) GDPR).

Service provider: we send these emails through Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands (Zoho Mail / Zoho Campaigns), which processes the data on our behalf in its EU data centres under a data processing agreement (Art. 28 GDPR). We also use Zoho Mail for our email communication, e.g. when you write to hello@rep-ai.online or privacy@rep-ai.online.

6. Creating and using an app account

6.1 Downloading the app

When you download rep.ai from the Apple App Store or Google Play, the store operator processes data such as your account name, email address, device identifier and payment details. Apple and Google do this as independent controllers; we have no influence on it. Please refer to the privacy policies of Apple and Google.

6.2 Registration and sign-in

To save your plan and progress, you create an account. We process:

• email address and password (stored only as a salted, cryptographic hash);
• if you choose “Sign in with Apple” or “Sign in with Google” (where offered): a unique user identifier and, depending on your settings, your name and email address, or Apple’s private relay email address;
• your first name or display name (optional);
• account creation date, last sign-in, app version, device type, operating system and language;
• technical session data (authentication tokens) and IP addresses during sign-in, to protect your account against misuse.

Purpose: creating and managing your account, authentication, synchronising your data across devices, and protecting against unauthorised access. Legal basis: Art. 6(1)(b) GDPR (performance of the contract); for security logs, Art. 6(1)(f) GDPR (legitimate interest in IT security). Authentication runs through Supabase Auth on servers in Frankfurt, Germany (see Section 16).

6.3 Deleting your account

You can delete your account at any time in the app under Settings → Privacy & data → Delete account, or by emailing us. We then delete or irreversibly anonymise your account and all associated data, including body scan photos, within 30 days. Deleting the app from your device does not delete your account. An active subscription must be cancelled separately in your App Store or Google Play account (see Section 13).

7. Onboarding and training profile

So that rep.ai can create a plan that suits you, the onboarding asks you for information about yourself. Depending on what you enter, we process:

Purpose: personalising your training, nutrition and recovery recommendations and displaying your profile and progress in the app. Your profile is stored in our Supabase database in Frankfurt.

8. AI body scan

The AI body scan helps you get a visual starting point and track visible changes over time. It is optional and requires your explicit consent (see Section 3).

8.1 What data is processed

• Photos you take with the guided in-app camera (e.g. front and side view), including the time of capture;
• scan context, such as height, weight, gender and age, used to interpret the images;
• scan results: visual physique estimates such as body proportions, estimated ranges for body fat or muscle development per muscle group, posture notes and a progress comparison with previous scans.

8.2 How the scan works

1. Capture and upload. The photos are transferred over an encrypted connection (TLS) to our Supabase Storage in Frankfurt and saved in a private, access-restricted storage bucket. Before upload, we remove embedded metadata such as GPS location (EXIF data).
2. Our own machine-learning scripts. Our own ML scripts check image quality and pose, detect body landmarks and contours, and calculate proportions. These scripts run on our infrastructure within the EU.
3. Analysis with OpenAI. To generate visual physique insights, we send the photos together with the necessary scan context to the OpenAI API (vision models). We do not send your name, email address or account ID; requests carry only a random, pseudonymous identifier.
4. Saving results. We combine both analyses into your scan result, store it in your account and use it to personalise your plan and compare progress.

8.3 What the scan does not do

• It does not identify you. We do not use facial recognition or biometric templates to identify individuals. We recommend framing the photo so that your face is not needed.
• It does not provide medical measurements or diagnoses. Results are estimates (see our Terms of Service).
• We do not publish or share your photos with other users, and we do not use them for advertising.

8.4 OpenAI and model training

Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models. OpenAI may store inputs and outputs for up to 30 days to detect abuse and then deletes them, unless longer storage is legally required. We do not use your body scan photos to train our own ML models either, unless you separately give us optional consent to do so in the app.

8.5 Storage and deletion

Photos and results remain stored until you delete the scan in the app, withdraw your consent or delete your account. Deleted photos are removed from active storage immediately and from backups within 30 days.

Legal basis: Art. 9(2)(a) and Art. 6(1)(a) GDPR (explicit consent), including the transfer to OpenAI.

9. AI-generated workout and nutrition plans

rep.ai creates your personalised workout plan (exercises, sets, reps, suggested weights) and nutrition guidance (calorie and protein targets, water target, meal and recipe suggestions) automatically. For this we use our own rule-based and machine-learning logic as well as OpenAI’s language models.

9.1 Data used

• your training profile (goals, experience, schedule, equipment, focus areas);
• health-related data, if you have consented (weight and weight trend, injuries, energy, sleep, recovery);
• your logged workouts (weights, reps, completed sessions) and logged meals;
• scan results, if you use the body scan;
• nutrition preferences and excluded foods.

9.2 How we limit the data sent to OpenAI

We send OpenAI only the information needed to generate the specific recommendation, in pseudonymised form: no name, no email address, no account ID and no exact date of birth (only an age range where needed). We check AI output against our own safety rules (e.g. minimum calorie levels, sensible weight increases, exercise restrictions for reported injuries) before showing it to you.

Purpose: creating, adapting and explaining your plans. Legal basis: Art. 6(1)(b) GDPR for general profile data; Art. 9(2)(a) and Art. 6(1)(a) GDPR for health-related data.

10. Workout tracking, progress and recovery check-ins

When you use rep.ai, we store the data you enter or that is created while you use the app:

• workout logs: exercises, sets, reps, weights, rest times, completed sessions, personal records;
• progress data: body weight entries, check-ins, streaks, achievements, strength trends;
• nutrition logs: meals added, protein and water intake;
• recovery check-ins: sleep duration, bedtime, sleep quality, energy rating;
• notes you add to a workout or check-in.

Purpose: displaying your history and progress, and adapting your training, nutrition and recovery recommendations over time. Legal basis: Art. 6(1)(b) GDPR; for health-related entries (weight, sleep, energy), Art. 9(2)(a) and Art. 6(1)(a) GDPR. Storage: for as long as your account exists.

11. Apple Health and Health Connect (optional)

Where offered, you can connect rep.ai to Apple Health (iOS) or Health Connect (Android). You decide in your device’s system settings which data types rep.ai may read or write, e.g. body weight, sleep, workouts or active energy. You can revoke access at any time in those settings.

Data received from Apple Health or Health Connect is used only to provide rep.ai’s features. It is never used for advertising, never sold, and never shared with third parties for marketing purposes. Legal basis: Art. 9(2)(a) and Art. 6(1)(a) GDPR.

12. Push notifications and reminders

If you allow notifications, we send reminders for workouts, meals, check-ins and scans as well as coach messages. For this we process a device-specific push token, which is delivered via Apple Push Notification service (Apple) or Firebase Cloud Messaging (Google), together with your notification settings. Notification content is kept general and does not contain health details on the lock screen.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can turn notifications off at any time in the app or in your device settings.

13. Subscriptions and in-app purchases (RevenueCat)

Paid features of rep.ai are sold as in-app subscriptions through the Apple App Store and Google Play. Payment is processed entirely by Apple or Google; we never receive your credit card or bank details.

To manage subscriptions, verify purchases and unlock premium features across your devices, we use RevenueCat, Inc. (USA). RevenueCat processes on our behalf:

• a pseudonymous app user ID that we assign (no name or email address);
• purchase and subscription information (product, price, currency, purchase date, renewal and cancellation status, trial status);
• store receipts and transaction IDs;
• device and app information (operating system, app version, country/storefront) and IP address.

Purpose: providing paid features, managing entitlements, preventing fraud, and accounting. Legal basis: Art. 6(1)(b) GDPR; for retaining accounting records, Art. 6(1)(c) GDPR in conjunction with § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB). Data processing agreement: yes (Art. 28 GDPR). On transfers to the USA, see Section 17.

You manage and cancel your subscription in your Apple ID or Google Play account settings. Deleting your rep.ai account does not automatically cancel a store subscription.

14. Support and communication

When you contact us by email or through in-app support, we process the information you provide (e.g. name, email address, message content, attachments) and, where needed to solve your request, account details. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or account; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries). Storage: up to three years after the request is closed (standard limitation period, § 195 BGB), unless statutory retention obligations apply.

We send service emails that are necessary for your account, such as confirmation emails, password resets, security notices and important changes to these policies (Art. 6(1)(b) and (c) GDPR). We send product news only with your consent.

15. Profiling and automated decision-making

rep.ai evaluates your personal data automatically to personalise recommendations. This is profiling within the meaning of Art. 4(4) GDPR. Its logic in brief: your goal and experience determine the training structure, available equipment determines exercise selection, logged performance controls progression (e.g. a slightly higher suggested weight after you meet your rep target), and your weight trend and goal determine calorie and protein targets. Sleep and energy check-ins can lower or raise intensity suggestions.

These recommendations are suggestions that you are free to follow, adjust or ignore. They do not produce legal effects for you and do not significantly affect you in a similar way. There is therefore no automated decision-making within the meaning of Art. 22 GDPR. You can contact us at any time to have a recommendation explained or reviewed by a person.

16. Recipients and processors

We share personal data only where necessary for the purposes described here. We have concluded data processing agreements under Art. 28 GDPR with all processors. They may process your data only on our instructions.

Beyond this, we disclose data only if we are legally obliged to (e.g. to authorities on the basis of a court order), or if it is necessary to establish, exercise or defend legal claims (Art. 6(1)(c) or (f) GDPR). We do not sell personal data and do not share it with advertising networks or data brokers.

17. Transfers to countries outside the EU/EEA

Our main data storage is in Germany. Some service providers (Vercel, OpenAI, RevenueCat, Apple, Google and possibly Supabase support staff) are based in or process data in the USA or other third countries. We transfer personal data to these countries only if the requirements of Art. 44 et seq. GDPR are met, in particular:

• on the basis of the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework (Art. 45 GDPR), where the recipient is certified; and/or
• on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), plus additional technical measures such as encryption in transit and pseudonymisation.

For health data, transfer to OpenAI also takes place on the basis of your explicit consent, in which we inform you about this transfer. You can request a copy of the relevant safeguards by emailing privacy@rep-ai.online.

18. Storage periods

We store personal data only for as long as necessary for the respective purpose, or as long as statutory retention periods require.

19. Data security

We take appropriate technical and organisational measures (Art. 32 GDPR) to protect your data against loss, misuse and unauthorised access. These include in particular:

• encryption of all data in transit (TLS 1.2 or higher) and encryption of databases and file storage at rest;
• Row Level Security in our database, so that each user can access only their own data;
• private storage buckets for scan photos with short-lived, signed access links;
• pseudonymisation before data is passed to AI services;
• strict access control based on the need-to-know principle, two-factor authentication for administrative access, and access logging;
• regular backups, updates and reviews of our security measures.

No transmission over the internet is completely secure. If a data breach occurs that poses a high risk to your rights and freedoms, we will inform you without undue delay (Art. 34 GDPR).

20. Storage of information on your device (TDDDG)

The app stores information on your device that is strictly necessary to provide the service you requested, e.g. your sign-in session, app settings, cached plans and data waiting to be synced. This is permitted without consent under § 25(2) No. 2 TDDDG. Access to the camera, photos, Apple Health/Health Connect and notifications happens only after you grant permission in the system dialog. The app contains no advertising or cross-app tracking SDKs, and does not use your device’s advertising identifier.

21. Children and young people

rep.ai is intended for people aged 16 and over. We do not knowingly collect personal data from children under 16. If we learn that a person under 16 has registered, we will delete the account and the associated data. Parents or guardians who believe their child has provided us with data can contact privacy@rep-ai.online.

22. Your rights

Under the GDPR you have the following rights with regard to your personal data:

• Access (Art. 15 GDPR): information about the data we process about you and a copy of it.
• Rectification (Art. 16 GDPR): correction of inaccurate or completion of incomplete data. You can edit most data directly in the app.
• Erasure (Art. 17 GDPR): deletion of your data, e.g. by deleting individual scans or your account in the app.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): receiving the data you provided in a structured, commonly used, machine-readable format (e.g. JSON/CSV), via Settings → Privacy & data → Export data or on request.
• Withdrawal of consent (Art. 7(3) GDPR): at any time, with effect for the future.
• Objection (Art. 21 GDPR): see below.
• Complaint to a supervisory authority (Art. 77 GDPR).

To exercise your rights, email privacy@rep-ai.online. To protect your data, we may ask you to confirm your identity, e.g. by sending your request from the email address linked to your account. We respond within one month (Art. 12(3) GDPR).

You can lodge a complaint with any data protection supervisory authority, in particular in the EU member state where you live or work, or where the alleged infringement took place. The authority responsible for us is: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Werderstraße 74a, 19055 Schwerin, Germany, www.datenschutz-mv.de.

23. Obligation to provide data

You are not legally or contractually obliged to provide personal data. However, we need an email address (or Apple/Google sign-in) and basic profile data to create an account and a plan. Without health-related data and your consent, features such as the body scan and weight-based adjustments are unavailable. All other information is voluntary.

24. Changes to this Privacy Policy

We update this Privacy Policy when our services, legal requirements or service providers change. The current version is always available on this page and in the app. If changes affect processing based on your consent, we will ask for your consent again. We will inform you of other material changes in the app or by email before they take effect.

Effective date: 14 October 2026 (Version 1.0)