Privacy Policy

This Privacy Policy explains how David Gradinariu ("RepChamp," "we," "us," or "our") collects, uses, stores, and protects personal data when you use the RepChamp mobile applications (iOS and Android) and the website at repchamp.vercel.app (together, the "Service").

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Romanian Law No. 190/2018 on measures implementing the GDPR, and other applicable data protection laws.

1. Who Is Responsible for Your Data?

The data controller responsible for your personal data is:

David Gradinariu
Str. Plaiesilor nr. 19, Iași, Romania
Email: repchampapp@gmail.com

For any question about this policy or to exercise your privacy rights, contact us at the email address above. We do not have a Data Protection Officer (DPO), as we are not required to appoint one under applicable law.

2. Scope of This Policy

This policy applies to:

• The RepChamp iOS app — account creation, workouts, social features, subscriptions, and related backend services
• The RepChamp Android app — the same core features on Google Play–compatible devices, with platform-specific sign-in, billing, and device integrity where noted below
• The repchamp.vercel.app website — our marketing and legal pages

Feature availability may vary slightly by platform and app version, but we process the same categories of personal data across iOS and Android unless this policy says otherwise.

This policy does not cover third-party services that have their own privacy policies, including Apple, Google, Google Play, Firebase, RevenueCat, and Discord. We describe how we use those services below and link to their policies where relevant.

3. What Personal Data We Collect

We collect only the data needed to operate the Service. The categories below reflect what the app and website actually process.

3.1 Account and authentication data

When you sign in with Apple or Google, we receive:

• A unique account identifier (Firebase user ID)
• Your email address and display name, if provided by your sign-in provider
• Authentication tokens required to keep you signed in securely

Sign-in options depend on your platform: on iOS you may use Sign in with Apple and/or Google Sign-In; on Android you sign in with Google Sign-In. We do not receive or store your Apple or Google password.

3.2 Profile and onboarding data

When you complete onboarding or edit your profile, we collect:

• Username (visible to other users)
• Age
• Gender (including "prefer not to say" if you select it)
• Training frequency (days per week)
• Profile photo or avatar, if you choose to upload or select one
• Free-plan duel energy balance and related refill timing (used to limit multiplayer duels for non-Pro users)

If you choose a custom profile photo from your device, the app requests access to your Photo Library (iOS) or device gallery / photos (Android) so you can pick an image. We only receive the photo you select to upload — not your entire library.

3.3 Workout and fitness activity data

When you train, duel, or progress in the app, we store:

• Exercise type (e.g. push-ups, squats)
• Rep counts, personal records, daily totals, and lifetime totals
• Streaks, XP, level, badges, and roadmap progress
• Duel results, opponent usernames, scores, and match history
• Leaderboard rankings (all-time and periodic)

Important: Your camera video is processed entirely on your device using MediaPipe AI to count reps. To help prevent cheating (for example, faking reps with a photo or screen), the app may also run additional on-device checks during workouts. On iOS, this may include face detection and depth sensing on supported devices (e.g. TrueDepth). On Android, this may include on-device face detection and related anti-spoof analysis (for example, via Google ML Kit and local image checks). Raw video frames, body pose data, and depth/face-check data are not uploaded, recorded, or stored on our servers. Only the resulting rep counts and related workout statistics are synced.

3.4 Social and multiplayer data

If you use friends, chat, or live duels, we process:

• Friend connections and friend requests (including usernames)
• Chat messages you send
• Real-time rep counts and duel state shared with opponents during live matches
• Online presence status (e.g. online/offline, last seen) during multiplayer sessions
• Players you block (block list under your account)
• User reports you submit about other players (reported user ID/username, reason, and optional details you provide), and reports others submit about you

3.5 Profile photos and moderation data

If you upload a profile photo:

• The image is stored in Firebase Storage under your account
• Before and after upload, the image is analyzed by Google Cloud Vision Safe Search to detect adult, violent, or inappropriate content
• Rejected images are deleted and removed from your profile

3.6 Subscription and payment data

RepChamp Pro subscriptions are processed by the app store on your platform: Apple through the App Store on iOS, and Google through Google Play Billing on Android. We use RevenueCat (and related server-side entitlement checks) to verify your subscription status and link it to your account.

• We receive subscription status, product identifiers, and entitlement information
• We do not receive or store your payment card number, billing address, or full payment details
• Your purchase is also subject to Apple's or Google Play's own terms and privacy practices, depending on where you subscribed

3.7 Technical and device data

To operate the Service, our infrastructure providers may automatically process limited technical data, such as:

• Device type, operating system version (iOS or Android), and app version
• IP address and connection timestamps (typically in server logs)
• Crash or error information only if reported through platform or provider systems
• Device timezone (used for day-based features such as energy refill and daily challenges)
• App Check device integrity tokens used to verify that Cloud Function requests come from a genuine installation of our app — via App Attest / DeviceCheck on iOS and Play Integrity on Android

We do not use Firebase Analytics, advertising identifiers, or third-party marketing trackers in the app. We do not request access to your advertising ID (such as Apple's IDFA or Google's Advertising ID) for marketing or cross-app tracking.

3.8 Website data

The repchamp.vercel.app website is a static marketing site. It does not use cookies, analytics, or tracking pixels. When you visit the site:

• We do not collect personal data through forms (there are none)
• We load fonts from Google Fonts, which may receive your IP address and browser information — see Google's Privacy Policy
• If you email us via a mailto link, we receive whatever information you include in your message

3.9 Community links (Discord)

The app may include a link to our Discord community. If you join Discord, your use of that platform is governed by Discord's own terms and privacy policy. We do not control Discord's data practices. Any information you share there is processed by Discord, not under this Privacy Policy (except for whatever you separately send us by email or in the app).

3.10 Data we do not collect

Based on our current app design, we do not collect:

• Precise location or GPS data
• HealthKit, Apple Health, or Android Health Connect data
• Contacts or calendar data
• Microphone audio for product features (workout camera capture runs without recording audio for our features)
• Raw camera video or recordings on our servers
• Advertising or cross-app tracking data

4. How and Why We Use Your Data

We use your personal data for the following purposes and legal bases under GDPR Article 6:

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

5. What Other Users Can See

RepChamp is a social fitness app. The following information may be visible to other users:

• Your username, avatar, level, badges, and public stats
• Your position on leaderboards
• Your rep count and profile info during live duels
• Messages you send to friends in chat

Choose your username and profile photo carefully. Do not share sensitive personal information in chat or your public profile.

6. Who We Share Data With

We do not sell your personal data. We share data only with trusted service providers ("processors") that help us operate the Service, under contracts that require them to protect your data:

We may also disclose data if required by law, court order, or government request, or to protect the rights, safety, and security of RepChamp, our users, or others.

7. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA), including the United States, where some of our service providers are located. When we transfer personal data outside the EEA, we rely on appropriate safeguards as required by GDPR Chapter V, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Processor agreements requiring equivalent data protection obligations
• Transfers to countries covered by an adequacy decision, where applicable

You may request more information about transfer safeguards by contacting us.

8. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes described in this policy:

• Account and profile data: While your account is active
• Workout, social, energy, and leaderboard data: While your account is active; some aggregated leaderboard history may persist briefly after deletion during routine cleanup
• Chat messages: While your account is active and for the duration of the conversation
• Block lists: While your account is active; removed when you delete your account
• User reports: Retained as needed for safety, abuse investigation, and legal compliance, including after the reporter or reported account is deleted. We may keep report records (such as user IDs, usernames at the time of the report, reason, and details) and may anonymize them when they are no longer needed
• Profile photos: Until you remove them or delete your account
• Subscription records: As long as needed for billing verification and legal/accounting requirements
• Support correspondence: Up to 3 years after resolution, unless a longer period is required by law
• Server logs and App Check tokens: Typically short-lived / up to about 90 days for logs, per provider defaults

When you delete your account (see Section 9), we delete or anonymize your personal data within a reasonable period, except where retention is required by law or for legitimate safety purposes (for example, user reports used to investigate abuse, tax records, fraud prevention, or legal claims).

9. Your Rights Under GDPR

If you are in the EEA, UK, or another jurisdiction with similar protections, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Correct inaccurate or incomplete data — you can update your profile in the app
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to restriction (Art. 18): Ask us to limit how we use your data in certain circumstances
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format where technically feasible
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent (Art. 7): Where processing is based on consent (e.g. profile photo upload), you may withdraw consent at any time without affecting the lawfulness of prior processing

How to exercise your rights

• Update profile: Edit your profile directly in the app
• Delete account: Go to Profile → Settings → Data Management → Delete Account. This permanently deletes your account and associated personal data from our systems, subject to legal retention requirements and the limited exceptions in Section 8 (including user reports kept for safety/abuse)
• Other requests: Email repchampapp@gmail.com with your request. We may ask you to verify your identity before responding

We will respond within one month of receiving your request, as required by GDPR. This may be extended by two further months for complex requests; we will inform you if an extension is needed.

Right to lodge a complaint

If you believe we have not handled your data properly, you have the right to lodge a complaint with a supervisory authority. In Romania, the competent authority is:

ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
Website: www.dataprotection.ro
Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania

You may also contact the supervisory authority in your country of residence or place of work if you are outside Romania.

10. Children's Privacy

RepChamp is not directed at children under 16 years of age. We do not knowingly collect personal data from anyone under 16. If you are under 16, do not use the Service. If you are a parent or guardian and believe your child has provided us personal data, contact us and we will delete it promptly.

11. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Firebase Authentication, App Check (App Attest on iOS / Play Integrity on Android), and security rules restricting data access
• Encrypted connections (HTTPS/TLS) for data in transit
• Server-side validation of workout data and leaderboard updates
• Automated profile photo moderation
• On-device camera processing (including pose tracking and anti-spoof checks) so workout video never leaves your phone

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to protect your data using industry-standard practices.

12. Cookies and Similar Technologies

The RepChamp app does not use cookies. The repchamp.vercel.app website does not set cookies or use analytics trackers. Third-party font providers may process limited technical data as described in Section 3.8.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version on this page and update the "Last updated" date above. For significant changes affecting how we use your data, we may also notify you through the app. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

For privacy questions, data subject requests, or concerns about this policy:

David Gradinariu (Data Controller)
Str. Plaiesilor nr. 19, Iași, Romania
Email: repchampapp@gmail.com