This Privacy Policy explains how David Gradinariu ("RepChamp," "we," "us," or "our") collects, uses, stores, and protects personal data when you use the RepChamp iOS mobile application and the website at repchamp.vercel.app (together, the "Service").
We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Romanian Law No. 190/2018 on measures implementing the GDPR, and other applicable data protection laws.
1. Who Is Responsible for Your Data?
The data controller responsible for your personal data is:
David Gradinariu
Str. Plaiesilor nr. 19, Iași, Romania
Email: repchampapp@gmail.com
For any question about this policy or to exercise your privacy rights, contact us at the email address above. We do not have a Data Protection Officer (DPO), as we are not required to appoint one under applicable law.
2. Scope of This Policy
This policy applies to:
- The RepChamp iOS app — account creation, workouts, social features, subscriptions, and related backend services
- The repchamp.vercel.app website — our marketing and legal pages
This policy does not cover third-party services that have their own privacy policies, including Apple, Google, Firebase, and RevenueCat. We describe how we use those services below and link to their policies where relevant.
3. What Personal Data We Collect
We collect only the data needed to operate the Service. The categories below reflect what the app and website actually process.
3.1 Account and authentication data
When you sign in with Apple or Google, we receive:
- A unique account identifier (Firebase user ID)
- Your email address and display name, if provided by your sign-in provider
- Authentication tokens required to keep you signed in securely
We do not receive or store your Apple or Google password.
3.2 Profile and onboarding data
When you complete onboarding or edit your profile, we collect:
- Username (visible to other users)
- Age
- Gender (including "prefer not to say" if you select it)
- Training frequency (days per week)
- Profile photo or avatar, if you choose to upload or select one
3.3 Workout and fitness activity data
When you train, duel, or progress in the app, we store:
- Exercise type (e.g. push-ups, squats)
- Rep counts, personal records, daily totals, and lifetime totals
- Streaks, XP, level, badges, and roadmap progress
- Duel results, opponent usernames, scores, and match history
- Leaderboard rankings (all-time and periodic)
Important: Your camera video is processed entirely on your device using MediaPipe AI to count reps. Raw video frames and body pose data are not uploaded, recorded, or stored on our servers. Only the resulting rep counts and related workout statistics are synced.
3.4 Social and multiplayer data
If you use friends, chat, or live duels, we process:
- Friend connections and friend requests (including usernames)
- Chat messages you send
- Real-time rep counts and duel state shared with opponents during live matches
- Online presence status (e.g. online/offline, last seen) during multiplayer sessions
3.5 Profile photos and moderation data
If you upload a profile photo:
- The image is stored in Firebase Storage under your account
- Before and after upload, the image is analyzed by Google Cloud Vision Safe Search to detect adult, violent, or inappropriate content
- Rejected images are deleted and removed from your profile
3.6 Subscription and payment data
RepChamp Pro subscriptions are processed by Apple through the App Store. We use RevenueCat to verify your subscription status and link it to your account.
- We receive subscription status, product identifiers, and entitlement information
- We do not receive or store your payment card number, billing address, or full payment details
3.7 Technical and device data
To operate the Service, our infrastructure providers may automatically process limited technical data, such as:
- Device type, operating system version, and app version
- IP address and connection timestamps (typically in server logs)
- Crash or error information only if reported through platform or provider systems
We do not use Firebase Analytics, advertising identifiers, or third-party marketing trackers in the app.
3.8 Website data
The repchamp.vercel.app website is a static marketing site. It does not use cookies, analytics, or tracking pixels. When you visit the site:
- We do not collect personal data through forms (there are none)
- We load fonts from Google Fonts, which may receive your IP address and browser information — see Google's Privacy Policy
- If you email us via a mailto link, we receive whatever information you include in your message
3.9 Data we do not collect
Based on our current app design, we do not collect:
- Precise location or GPS data
- HealthKit or Apple Health data
- Contacts, calendar, or microphone data
- Raw camera video or recordings on our servers
- Advertising or cross-app tracking data
4. How and Why We Use Your Data
We use your personal data for the following purposes and legal bases under GDPR Article 6:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account | Authentication data, profile data | Performance of a contract (Art. 6(1)(b)) |
| Providing workout tracking, duels, leaderboards, and progression | Workout data, profile data | Performance of a contract (Art. 6(1)(b)) |
| Enabling friends, chat, and multiplayer features | Social data, profile data | Performance of a contract (Art. 6(1)(b)) |
| Managing RepChamp Pro subscriptions | Subscription status, account ID | Performance of a contract (Art. 6(1)(b)) |
| Moderating profile photos for safety | Profile photos | Legitimate interests — keeping the community safe (Art. 6(1)(f)); consent where required by local law |
| Preventing fraud, abuse, and cheating | Account, workout, and social data | Legitimate interests (Art. 6(1)(f)) |
| Responding to support requests and legal obligations | Contact details, account data | Legitimate interests; legal obligation (Art. 6(1)(c) and (f)) |
| Uploading a profile photo (optional) | Profile photo | Consent (Art. 6(1)(a)) — you can remove it anytime |
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
5. What Other Users Can See
RepChamp is a social fitness app. The following information may be visible to other users:
- Your username, avatar, level, badges, and public stats
- Your position on leaderboards
- Your rep count and profile info during live duels
- Messages you send to friends in chat
Choose your username and profile photo carefully. Do not share sensitive personal information in chat or your public profile.
6. Who We Share Data With
We do not sell your personal data. We share data only with trusted service providers ("processors") that help us operate the Service, under contracts that require them to protect your data:
| Provider | Purpose | Location / transfer |
|---|---|---|
| Google Firebase | Authentication, database, file storage, cloud functions | EU/US — SCCs where applicable |
| Google Sign-In | Account authentication | EU/US — SCCs where applicable |
| Apple Sign In | Account authentication | Per Apple's policies |
| RevenueCat | Subscription status verification | US — SCCs where applicable |
| Google Cloud Vision | Profile photo safety moderation | EU/US — SCCs where applicable |
| Google Fonts | Website typography | EU/US — SCCs where applicable |
We may also disclose data if required by law, court order, or government request, or to protect the rights, safety, and security of RepChamp, our users, or others.
7. International Data Transfers
Your data may be processed in countries outside the European Economic Area (EEA), including the United States, where some of our service providers are located. When we transfer personal data outside the EEA, we rely on appropriate safeguards as required by GDPR Chapter V, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Processor agreements requiring equivalent data protection obligations
- Transfers to countries covered by an adequacy decision, where applicable
You may request more information about transfer safeguards by contacting us.
8. How Long We Keep Your Data
We retain personal data only as long as necessary for the purposes described in this policy:
- Account and profile data: While your account is active
- Workout, social, and leaderboard data: While your account is active; some aggregated leaderboard history may persist briefly after deletion during routine cleanup
- Chat messages: While your account is active and for the duration of the conversation
- Profile photos: Until you remove them or delete your account
- Subscription records: As long as needed for billing verification and legal/accounting requirements
- Support correspondence: Up to 3 years after resolution, unless a longer period is required by law
- Server logs: Typically up to 90 days, per provider defaults
When you delete your account (see Section 9), we delete or anonymize your personal data within a reasonable period, except where retention is required by law (e.g. tax, fraud prevention, or legal claims).
9. Your Rights Under GDPR
If you are in the EEA, UK, or another jurisdiction with similar protections, you have the following rights regarding your personal data:
- Right of access (Art. 15): Request a copy of the personal data we hold about you
- Right to rectification (Art. 16): Correct inaccurate or incomplete data — you can update your profile in the app
- Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
- Right to restriction (Art. 18): Ask us to limit how we use your data in certain circumstances
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format where technically feasible
- Right to object (Art. 21): Object to processing based on legitimate interests
- Right to withdraw consent (Art. 7): Where processing is based on consent (e.g. profile photo upload), you may withdraw consent at any time without affecting the lawfulness of prior processing
How to exercise your rights
- Update profile: Edit your profile directly in the app
- Delete account: Go to Profile → Settings → Data Management → Delete Account. This permanently deletes your account and associated personal data from our systems, subject to legal retention requirements
- Other requests: Email repchampapp@gmail.com with your request. We may ask you to verify your identity before responding
We will respond within one month of receiving your request, as required by GDPR. This may be extended by two further months for complex requests; we will inform you if an extension is needed.
Right to lodge a complaint
If you believe we have not handled your data properly, you have the right to lodge a complaint with a supervisory authority. In Romania, the competent authority is:
ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
Website: www.dataprotection.ro
Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania
You may also contact the supervisory authority in your country of residence or place of work if you are outside Romania.
10. Children's Privacy
RepChamp is not directed at children under 16 years of age. We do not knowingly collect personal data from anyone under 16. If you are under 16, do not use the Service. If you are a parent or guardian and believe your child has provided us personal data, contact us and we will delete it promptly.
11. Security
We implement appropriate technical and organizational measures to protect your data, including:
- Firebase Authentication and security rules restricting data access
- Encrypted connections (HTTPS/TLS) for data in transit
- Server-side validation of workout data and leaderboard updates
- Automated profile photo moderation
- On-device camera processing so video never leaves your phone
No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to protect your data using industry-standard practices.
12. Cookies and Similar Technologies
The RepChamp app does not use cookies. The repchamp.vercel.app website does not set cookies or use analytics trackers. Third-party font providers may process limited technical data as described in Section 3.8.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version on this page and update the "Last updated" date above. For significant changes affecting how we use your data, we may also notify you through the app. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
14. Contact Us
For privacy questions, data subject requests, or concerns about this policy:
David Gradinariu (Data Controller)
Str. Plaiesilor nr. 19, Iași, Romania
Email: repchampapp@gmail.com