Rephiq Privacy Policy

1.1 Account Information

When you create an account, we collect the information provided by your authentication provider:

• Google Sign-In: Your name and email address as associated with your Google account.
• Sign in with Apple: Your name (if provided) and email address (which may be a private relay address if you choose to hide your email).

1.2 Profile Information

During onboarding and profile setup, you may provide:

• First name and last name
• Date of birth
• Gender
• Height and weight
• Fitness goal, experience level, and training preferences
• Available equipment and workout location
• Preferred workout duration and training days per week

1.3 Social Profile Information

If you use our social features, you may additionally provide:

• Display name and username
• Profile photo (avatar)
• Bio
• Instagram and X (Twitter) handles
• Preferred workout types
• Public/private profile preference

1.4 Workout and Exercise Data

When you use the App to log workouts, we collect:

• Exercise names, sets, repetitions, weights, and rest times
• Workout duration, start and end times
• Workout templates and training programmes
• Personal records and strength milestones
• Rate of perceived exertion (RPE)

1.5 Body Measurements and Progress Photos

You may optionally record:

• Body weight measurements over time
• Progress photos (front, side, back), including the date each photo was taken

1.6 Health Platform Data

With your explicit permission, the App integrates with Apple HealthKit (iOS) and Health Connect (Android) to write the following data:

• Completed strength training workout sessions (duration and estimated calories burned)
• Body weight measurements

We do not read data from your health platform. Data is only written with your opt-in consent, and you can revoke this permission at any time in the App's settings or your device's health settings.

1.7 Social Interaction Data

When you use social features, we collect:

• Follow relationships (who you follow and who follows you)
• Shared workout posts, including captions
• Likes and comments on posts
• Abuse and content reports

1.8 Purchase Information

If you subscribe to Rephiq Pro, we use RevenueCat to manage in-app purchases. We store:

• Your premium subscription status
• A unique purchase identifier linked to your account

We do not store or have access to your payment card details, billing address, or other financial information. All payment processing is handled by Apple (App Store), Google (Google Play), and RevenueCat.

1.9 Usage and Analytics Data

We automatically collect anonymised usage data to improve the App:

• Feature usage events (e.g., workout started, workout completed, template created)
• Screen views
• App performance and error data (crash reports and stack traces)

This data does not include personally identifiable information. We do not track your activity outside of the Rephiq app.

1.10 Device and Technical Data

We collect limited technical data necessary for the App to function:

• Device type and operating system version
• App version
• Timezone (for scheduling local notifications)

We do not collect device identifiers, IP addresses (beyond what is automatically logged by our infrastructure providers), location data, contacts, calendar data, or browsing history.

3.1 Storage Locations

• On your device: Workout data, preferences, and cached content are stored locally in an encrypted SQLite database.
• In the cloud: Your data is synchronised to Google Cloud Firestore (database) and Firebase Storage (photos and avatars), hosted on Google Cloud infrastructure.
• Preferences: App settings (units, rest timer, theme) are stored locally on your device and are not synced to the cloud.

3.2 Security Measures

• All data transmitted between the App and our servers is encrypted using TLS (Transport Layer Security).
• Cloud data is protected by Firebase security rules that enforce user-level access control — you can only read and write your own data.
• Authentication is handled by Firebase Authentication using industry-standard OAuth 2.0 protocols.
• Social profile data has granular access controls: private profiles are only visible to approved followers.
• Firebase App Check is used to verify that requests to our backend originate from genuine instances of the App.

6.1 Access and Export

You can export your workout data and body measurements from the App's Settings screen in CSV or JSON format at any time.

6.2 Account Deletion

You can permanently delete your account from the App's Settings screen. This immediately and irreversibly removes:

• Your user profile and all personal information
• All workout data, templates, and exercise history
• All social profile data, posts, comments, and follow relationships
• All progress photos from our servers
• All leaderboard entries
• All AI usage records

This action cannot be undone.

6.3 Notification Preferences

You can enable or disable workout reminder notifications at any time in the App's Settings. You can also revoke notification permissions at the operating system level.

6.4 Health Data Permissions

You can enable or disable HealthKit/Health Connect integration at any time in the App's Settings. Revoking permission stops all future health data writes. Data previously written to your health platform remains under your control via your device's Health app.

6.5 Social Profile Visibility

You can set your social profile to private at any time, restricting visibility to approved followers only.

6.6 Data Portability and Requests

To request a copy of your data, ask questions about our data practices, or exercise any privacy rights, contact us at support@rephiq.com.

For European Economic Area (EEA) and UK Residents

Under the General Data Protection Regulation (GDPR), the legal bases for processing your data are:

• Contract performance: Processing necessary to provide the App's services (workout tracking, data sync, programme generation).
• Legitimate interests: Analytics and error monitoring to improve the App.
• Consent: Health data integration, push notifications, and social features.

You have the right to access, rectify, erase, restrict processing, and port your data. You also have the right to withdraw consent and lodge a complaint with your local data protection authority.

For California Residents

Under the California Consumer Privacy Act (CCPA), you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

For Australian Residents

We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988. You may contact us to access or correct your personal information or make a privacy complaint.