Privacy policy

This policy explains what Repcurve collects, why, how long it is kept, and what you can do about it. It covers the Repcurve mobile app and this website.

Repcurve records health information — your bodyweight and how recovered you feel. Under UK data protection law that is a special category of personal data with extra protection, and we treat it accordingly. The short version: we collect what the analysis needs and nothing else, we do not sell anything to anybody, and there is no advertising in the product.

Who we are

Repcurve Ltd is the data controller for the information described here. We are registered in England and Wales.

For anything in this policy, write to privacy@repcurve.app.

What we collect

Account information

Your email address and an account identifier. If you sign in with Apple or Google we receive whatever that service passes on, which may be a relay address rather than your real one.

Training data

The substance of the product: every set you log, with its weight, repetitions, RPE and warm-up flag; rest and session duration derived from the timestamps of those sets; the session templates you build and each change you make to them; and which exercises from the library you select.

Health data

Your bodyweight, if you choose to record it, and your readiness inputs — sleep, soreness and stress on a five-point scale. These are optional. The analysis is less useful without them, but the product works and you can decline them.

Subscription status

Whether you have an active subscription, when it renews or lapses, and the store it came from. Payment is handled entirely by Apple or Google. We never see your card details.

Technical data

App version, device model and operating system version, and error reports when something fails. We use these to fix faults, not to build a profile of you.

This website sets no analytics or advertising cookies and does not track you across other sites.

Registering interest

If you give us your email address on the website to be told when Repcurve launches, we store that address, the date, which part of the site you submitted it from, and the exact wording you agreed to at the time.

We use it for one thing: to send you one email when the app is ready to try. It is not a newsletter, we will not send you anything else, and we will not pass the address to anybody. The basis is your consent, and you can withdraw it by replying to any email from us or writing to privacy@repcurve.app, which deletes the record.

We delete the list once the launch email has gone out, unless you have by then created an account — in which case your account details are covered by the rest of this policy instead.

Why we are allowed to use it

Under the UK GDPR we have to have a lawful basis for each use.

• To provide the service you signed up for — storing your sets, syncing them between your devices, running the analysis, managing your subscription. The basis is performance of our contract with you.
• To handle health data — bodyweight and readiness. The basis is your explicit consent, which we ask for separately in the app before any of it is collected. You can withdraw it at any time, which stops the collection and deletes what was gathered.
• To keep the product working and secure — diagnosing faults, preventing abuse. The basis is our legitimate interests, balanced against your rights.
• To tell you when we launch — if you registered interest on the website. The basis is your consent, given when you submitted the form, and withdrawing it deletes the record.
• To meet legal obligations — tax and accounting records relating to subscriptions.

Artificial intelligence

The analysis includes a chat feature. When you use it, a summary of your training data is sent to a third-party AI provider so that a response can be generated. That summary contains figures already computed from your logged sets — trends, estimates, counts — and the question you asked.

We ask for your permission before any of your data is sent to an AI provider, and the chat does not work until you give it. You can withdraw that permission and carry on using every other part of the analysis.

Our AI provider processes this data on our instructions and is contractually barred from using it to train their models. We do not send your email address, your name or your account identifier.

Who else sees your data

We use a small number of service providers, each acting on our instructions:

• Our hosting and database provider, which stores the data behind the app.
• Our AI provider, as described above.
• Our subscription management provider, which reconciles store purchases.
• Apple and Google, which process payments and operate the app stores.

We do not sell your personal data. We do not share it with advertisers or data brokers. We would disclose it if the law required us to, and we would tell you unless we were forbidden from doing so.

Where your data is held

We store data in the United Kingdom or the European Economic Area wherever we can. Some providers process data outside that area; where they do, the transfer is covered by the UK's International Data Transfer Agreement, the addendum to the EU Standard Contractual Clauses, or a country the UK has found adequate.

How long we keep it

• Training and health data — for as long as your account is open. The analysis reads a rolling 90-day window, but your history is kept beyond that so that longer comparisons remain possible and so that you can export it.
• After you delete your account — removed from our live systems promptly and from backups within 30 days.
• Subscription and billing records — six years, which is the period UK tax law requires.
• Error reports — 90 days.
• Interest registrations — until the launch email has been sent, or until you ask us to remove you, whichever comes first.

Your rights

Under UK data protection law you can ask us to give you a copy of your data; correct it if it is wrong; delete it; restrict or object to how we use it; or send it to another service in a portable format. Where we rely on consent, you can withdraw it at any time without affecting anything done before you did.

You do not need to ask us for the two most common ones. Export and account deletion are both in the app. Deleting your account removes your profile, your logged sets and your health data.

Write to privacy@repcurve.app for anything else. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would rather you came to us first so we can put it right.

Security

Data is encrypted in transit and at rest. Access to production systems is restricted and logged. Your training data is isolated at the database level so that one account cannot read another's.

No system is perfectly secure. If a breach affects your rights we will tell you and the ICO within the timescales the law sets.

Children

Repcurve is not intended for children. You must be at least 16 to create an account. If we discover an account belonging to someone younger, we will delete it.

Changes

If we change this policy we will update the date at the top. Where a change materially affects how we use your data, we will tell you in the app before it takes effect, and where the law requires it we will ask for your consent again.