Privacy Policy

This Privacy Policy explains how David Gradinariu ("RepChamp," "we," "us," or "our") collects, uses, stores, and protects personal data when you use the RepChamp mobile applications (iOS and Android) and the website at repchamp.vercel.app (together, the "Service").

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Romanian Law No. 190/2018 on measures implementing the GDPR, and other applicable data protection laws.

1. Who Is Responsible for Your Data?

The data controller responsible for your personal data is:

David Gradinariu
Str. Plaiesilor nr. 19, Iași, Romania
Email: repchampapp@gmail.com

For any question about this policy or to exercise your privacy rights, contact us at the email address above. We do not have a Data Protection Officer (DPO), as we are not required to appoint one under applicable law.

2. Scope of This Policy

This policy applies to:

• The RepChamp iOS app — account creation, workouts, social features, subscriptions, and related backend services
• The RepChamp Android app — the same core features on Google Play–compatible devices, with platform-specific sign-in, billing, device integrity, and optional rewarded advertising where noted below
• The repchamp.vercel.app website — our marketing and legal pages

Feature availability may vary slightly by platform and app version. We process the same core categories of personal data across iOS and Android unless this policy says otherwise. In particular, rewarded ads (Google AdMob) are currently offered on Android only, not on iOS.

This policy does not cover third-party services that have their own privacy policies, including Apple, Google, Google Play, Google AdMob, Firebase, RevenueCat, and Discord. We describe how we use those services below and link to their policies where relevant.

3. What Personal Data We Collect

We collect only the data needed to operate the Service. The categories below reflect what the app and website actually process.

3.1 Account and authentication data

When you sign in with Apple or Google, we receive:

• A unique account identifier (Firebase user ID)
• Your email address and display name, if provided by your sign-in provider
• Authentication tokens required to keep you signed in securely

Sign-in options depend on your platform: on iOS you may use Sign in with Apple and/or Google Sign-In; on Android you sign in with Google Sign-In. We do not receive or store your Apple or Google password.

3.2 Profile and onboarding data

When you complete onboarding or edit your profile, we collect:

• Username (visible to other users)
• Age
• Gender (including "prefer not to say" if you select it)
• Training frequency (days per week)
• Profile photo or avatar, if you choose to upload or select one
• Free-plan duel energy balance and related refill timing (used to limit multiplayer duels for non-Pro users)
• On Android only: a daily count of rewarded ads you have completed to earn energy (server-side limit; see Section 3.10)

If you choose a custom profile photo from your device, the app requests access to your Photo Library (iOS) or device gallery / photos (Android) so you can pick an image. We only receive the photo you select to upload — not your entire library.

3.3 Workout and fitness activity data

When you train, duel, or progress in the app, we store:

• Exercise type (e.g. push-ups, squats)
• Rep counts, personal records, daily totals, and lifetime totals
• Streaks, XP, level, badges, and roadmap progress
• Duel results, opponent usernames, scores, and match history
• Leaderboard rankings (all-time and periodic)

Important: Your camera video is processed entirely on your device using MediaPipe AI to count reps. To help prevent cheating (for example, faking reps with a photo or screen), the app may also run additional on-device checks during workouts. On iOS, this may include face detection and depth sensing on supported devices (e.g. TrueDepth). On Android, this may include on-device face detection and related anti-spoof analysis (for example, via Google ML Kit and local image checks). Raw video frames, body pose data, and depth/face-check data are not uploaded, recorded, or stored on our servers. Only the resulting rep counts and related workout statistics are synced.

3.4 Social and multiplayer data

If you use friends, chat, or live duels, we process:

• Friend connections and friend requests (including usernames)
• Chat messages you send
• Real-time rep counts and duel state shared with opponents during live matches
• Online presence status (e.g. online/offline, last seen) during multiplayer sessions
• Players you block (block list under your account)
• User reports you submit about other players (reported user ID/username, reason, and optional details you provide), and reports others submit about you

3.5 Profile photos and moderation data

If you upload a profile photo:

• The image is stored in Firebase Storage under your account
• Before and after upload, the image is analyzed by Google Cloud Vision Safe Search to detect adult, violent, or inappropriate content
• Rejected images are deleted and removed from your profile

3.6 Subscription and payment data

RepChamp Pro subscriptions are processed by the app store on your platform: Apple through the App Store on iOS, and Google through Google Play Billing on Android. We use RevenueCat (and related server-side entitlement checks) to verify your subscription status and link it to your account.

• We receive subscription status, product identifiers, and entitlement information
• We do not receive or store your payment card number, billing address, or full payment details
• Your purchase is also subject to Apple's or Google Play's own terms and privacy practices, depending on where you subscribed

3.7 Technical and device data

To operate the Service, our infrastructure providers may automatically process limited technical data, such as:

• Device type, operating system version (iOS or Android), and app version
• IP address and connection timestamps (typically in server logs)
• Crash or error information only if reported through platform or provider systems
• Device timezone (used for day-based features such as energy refill and daily challenges)
• App Check device integrity tokens used to verify that Cloud Function requests come from a genuine installation of our app — via App Attest / DeviceCheck on iOS and Play Integrity on Android
• On Android only, when rewarded ads are available: limited advertising-related identifiers and device signals processed by Google AdMob / Google Mobile Ads as described in Section 3.10 (including Google's Advertising ID where permitted by your device settings and consent choices)

We do not use Firebase Analytics or our own third-party marketing trackers for cross-app advertising campaigns. On iOS, we do not request Apple's IDFA for advertising. On Android, advertising identifiers may be accessed solely in connection with the optional rewarded ads described in Section 3.10, subject to Google's consent / privacy messaging (UMP) and your device ad settings.

3.8 Website data

The repchamp.vercel.app website is a static marketing site. It does not use cookies, analytics, or tracking pixels. When you visit the site:

• We do not collect personal data through forms (there are none)
• We load fonts from Google Fonts, which may receive your IP address and browser information — see Google's Privacy Policy
• If you email us via a mailto link, we receive whatever information you include in your message

3.9 Community links (Discord)

The app may include a link to our Discord community. If you join Discord, your use of that platform is governed by Discord's own terms and privacy policy. We do not control Discord's data practices. Any information you share there is processed by Discord, not under this Privacy Policy (except for whatever you separately send us by email or in the app).

3.10 Advertising data (Android rewarded ads)

On the Android app only, free-plan users who run out of duel energy may optionally watch a rewarded video ad served by Google AdMob (Google Mobile Ads SDK) to earn energy (typically +1 energy per completed ad). This is limited (currently up to 2 rewarded ads per UTC day, enforced on our servers) and is not available to Pro users who already have unlimited energy. The iOS app does not currently show these ads.

In connection with Android rewarded ads, the following may be processed:

• Ad requests, impressions, and reward-completion signals needed to show the ad and confirm you earned the reward
• Device and advertising identifiers and related technical signals used by Google AdMob to deliver and measure ads (subject to your consent choices and Android ad / privacy settings)
• On our side: your account ID and a daily rewarded-ad usage counter so we can grant energy and enforce the daily limit across devices

Where required (for example in the EEA/UK and certain other regions), Google's User Messaging Platform (UMP) may show a consent / privacy form before ads are requested. You can change or withdraw eligible ad privacy choices later in the Android app under Profile → Settings → Ad privacy when that option is shown. Ads are optional: you can wait for the free energy refill or subscribe to RepChamp Pro instead of watching an ad.

Google AdMob acts as an independent controller or joint controller (as applicable under Google's terms) for data it processes to provide advertising. See Google's Privacy Policy and AdMob & privacy for details. We do not sell your personal data.

3.11 Data we do not collect

Based on our current app design, we do not collect:

• Precise location or GPS data
• HealthKit, Apple Health, or Android Health Connect data
• Contacts or calendar data
• Microphone audio for product features (workout camera capture runs without recording audio for our features)
• Raw camera video or recordings on our servers
• Advertising identifiers or AdMob ad data on iOS (rewarded ads are Android-only today)
• Our own cross-app marketing trackers or Firebase Analytics for advertising campaigns

4. How and Why We Use Your Data

We use your personal data for the following purposes and legal bases under GDPR Article 6:

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

5. What Other Users Can See

RepChamp is a social fitness app. The following information may be visible to other users:

• Your username, avatar, level, badges, and public stats
• Your position on leaderboards
• Your rep count and profile info during live duels
• Messages you send to friends in chat

Choose your username and profile photo carefully. Do not share sensitive personal information in chat or your public profile.

6. Who We Share Data With

We do not sell your personal data. We share data only with trusted service providers ("processors") that help us operate the Service, under contracts that require them to protect your data:

We may also disclose data if required by law, court order, or government request, or to protect the rights, safety, and security of RepChamp, our users, or others.

7. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA), including the United States, where some of our service providers are located. When we transfer personal data outside the EEA, we rely on appropriate safeguards as required by GDPR Chapter V, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Processor agreements requiring equivalent data protection obligations
• Transfers to countries covered by an adequacy decision, where applicable

You may request more information about transfer safeguards by contacting us.

8. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes described in this policy:

• Account and profile data: While your account is active
• Workout, social, energy, and leaderboard data: While your account is active; some aggregated leaderboard history may persist briefly after deletion during routine cleanup
• Chat messages: While your account is active and for the duration of the conversation
• Block lists: While your account is active; removed when you delete your account
• User reports: Retained as needed for safety, abuse investigation, and legal compliance, including after the reporter or reported account is deleted. We may keep report records (such as user IDs, usernames at the time of the report, reason, and details) and may anonymize them when they are no longer needed
• Profile photos: Until you remove them or delete your account
• Subscription records: As long as needed for billing verification and legal/accounting requirements
• Support correspondence: Up to 3 years after resolution, unless a longer period is required by law
• Server logs and App Check tokens: Typically short-lived / up to about 90 days for logs, per provider defaults

When you delete your account (see Section 9), we delete or anonymize your personal data within a reasonable period, except where retention is required by law or for legitimate safety purposes (for example, user reports used to investigate abuse, tax records, fraud prevention, or legal claims).

9. Your Rights Under GDPR

If you are in the EEA, UK, or another jurisdiction with similar protections, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Correct inaccurate or incomplete data — you can update your profile in the app
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to restriction (Art. 18): Ask us to limit how we use your data in certain circumstances
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format where technically feasible
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent (Art. 7): Where processing is based on consent (e.g. profile photo upload, or ad consent choices collected via Google UMP on Android), you may withdraw consent at any time without affecting the lawfulness of prior processing. On Android, reopen Profile → Settings → Ad privacy when available

How to exercise your rights

• Update profile: Edit your profile directly in the app
• Delete account: Go to Profile → Settings → Data Management → Delete Account. This permanently deletes your account and associated personal data from our systems, subject to legal retention requirements and the limited exceptions in Section 8 (including user reports kept for safety/abuse)
• Other requests: Email repchampapp@gmail.com with your request. We may ask you to verify your identity before responding

We will respond within one month of receiving your request, as required by GDPR. This may be extended by two further months for complex requests; we will inform you if an extension is needed.

Right to lodge a complaint

If you believe we have not handled your data properly, you have the right to lodge a complaint with a supervisory authority. In Romania, the competent authority is:

ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
Website: www.dataprotection.ro
Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania

You may also contact the supervisory authority in your country of residence or place of work if you are outside Romania.

10. Children's Privacy

RepChamp is not directed at children under 16 years of age. We do not knowingly collect personal data from anyone under 16. If you are under 16, do not use the Service. If you are a parent or guardian and believe your child has provided us personal data, contact us and we will delete it promptly.

11. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Firebase Authentication, App Check (App Attest on iOS / Play Integrity on Android), and security rules restricting data access
• Encrypted connections (HTTPS/TLS) for data in transit
• Server-side validation of workout data and leaderboard updates
• Automated profile photo moderation
• On-device camera processing (including pose tracking and anti-spoof checks) so workout video never leaves your phone

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to protect your data using industry-standard practices.

12. Cookies and Similar Technologies

The RepChamp apps do not use browser cookies. The repchamp.vercel.app website does not set cookies or use analytics trackers. Third-party font providers may process limited technical data as described in Section 3.8.

On Android, the Google Mobile Ads / AdMob SDK may use advertising identifiers, local storage, and similar technologies on your device to deliver and measure the optional rewarded ads described in Section 3.10. That processing is subject to Google's policies and your consent / privacy choices.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version on this page and update the "Last updated" date above. For significant changes affecting how we use your data, we may also notify you through the app. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

For privacy questions, data subject requests, or concerns about this policy:

David Gradinariu (Data Controller)
Str. Plaiesilor nr. 19, Iași, Romania
Email: repchampapp@gmail.com