Privacy Policy

This policy explains what RepDriver ("RepDriver", "we", "us") collects, how we use it, and the choices you have. It applies to the RepDriver website and services (the "Service"). Using the Service means you agree to this policy and to our Terms of Service.

• Account information — a username and email address; if you choose to set a password, we store only a secure hash. Sign-in is normally by a magic link emailed to you. Optionally a display name and avatar.
• Content you create — the workouts, routines, libraries, progress, and settings you build in the Service, including your workout history.
• Nutrition, body data and preferences — nutrition logs, custom foods, and calorie and macro targets; the body weight and body measurements you choose to log; the optional body stats (sex, age, height, weight) you enter for the calorie calculator; per-set effort ratings; and your reminder preferences and time zone.
• Training profile — the goal, experience, training schedule, equipment, and optional details (sex, birth year, height, injuries or limitations, notes for a coach) you save in Settings or through the routine wizard or a connected AI assistant.
• Connected apps — for each API token you create: its name, permissions, creation and last-used times (we store only a hash of the token itself); a daily count of AI requests per account; and any missing-exercise requests an assistant files on your behalf.
• Usage and device data — basic log information such as IP address, browser type, and pages or features used, collected to operate and secure the Service.
• Analytics — cookieless page-view statistics and, for a sample of visits, a session replay; see "Analytics" below.
• Local storage and cookies — see the next section.

Body weight, body measurements, calculator body stats, nutrition logs, and effort ratings can be health-related. You enter them only if you choose to; we use them solely to show your own data back to you (charts, targets, history), never for advertising, and they are masked in session replays. We do not collect payment-card data. The Service is free during early access; access by connected AI assistants includes a free daily allowance.

We store your sign-in tokens in your browser's local storage to keep you logged in, and set a small cadence.auth cookie that simply indicates whether a session exists (so the site can route you to the app). These are strictly necessary for the Service to work, so they don't require consent. We do not use advertising, analytics, or tracking cookies, which is why the site doesn't show a cookie banner. Cloudflare Turnstile, which protects the sign-in forms from bots, may set its own strictly necessary security cookies on those forms.

Workout videos are embedded from YouTube in its privacy-enhanced mode (youtube-nocookie.com): YouTube sets no tracking cookies until you press play, after which Google's privacy policy applies to that playback.

The free tools (meal planner, macro calculator, art-style preference, theme) save their inputs on your device in local storage; that data never leaves your browser unless you sign in and choose to import it. The one exception is a barcode scan: the camera image is decoded on your device, and only the barcode number is sent to our server to look the product up (see below).

We use Omega Analytics, a lightweight analytics tool we host ourselves, to understand which pages and features are used. It runs in cookieless mode: it sets no cookies, stores nothing in your browser, and the data is not sent to Google, Microsoft, or any other analytics or advertising company.

For each page you view it records the page address and title, the page you came from (and any campaign tags in the link), your browser, operating system, device type, screen size, language, and time zone, how long the page was visible, and a few simple checks used to filter out bots (such as whether any scrolling, clicking, or typing happened — never what you typed). It does not record your account, username, or email address.

For a sample of visits we also record a session replay: a reconstruction of what was on the page and how it was scrolled and clicked, so we can find confusing screens and bugs. Anything typed into a form is always masked and never recorded. Where the app shows your email address, username, or display name, your private calendar link, or the body-weight, measurement, calculator, and meal-planner numbers you enter, that text is masked too. No images, video, or audio are captured. Recordings are kept for 7 days and then deleted. One-time sign-in and password-reset links are removed from the address bar before any analytics runs, so they are never recorded.

Your IP address is used only while the request is handled: to look up your country, to look up the network it belongs to (so data-centre traffic can be flagged as likely bots), and to create an anonymous visitor ID. That ID is a one-way hash of your IP address, browser user agent, and a random value that is replaced every day and the old one deleted, so visits can't be linked across days or traced back to you. Your IP address itself is not stored by our analytics. Page-view statistics carry no account details and are kept without a fixed end date.

• to provide, maintain, and improve the Service;
• to generate your personal iCal calendar feed and, where you choose, public share links;
• to authenticate you and keep your account secure;
• to communicate with you about the Service, including important changes;
• to comply with legal obligations and enforce our Terms.

We do not sell your personal information. We share it only with service providers that host and operate the Service on our behalf (under confidentiality obligations), when you choose to make content public via a share link, when required by law, or to protect the rights and safety of users and the Service. Features that integrate with third parties — such as importing from YouTube or subscribing to a calendar app (Google, Apple, Outlook) — are governed by those providers' own privacy policies.

Our service providers include MailerSend (transactional email: sign-in links, password resets, and the workout reminders you opt into) and Cloudflare Turnstile (bot protection on the sign-in, signup, and forgot-password forms). Barcode lookups are resolved by our server against Open Food Facts and, where enabled, the USDA FoodData Central database — only the barcode number is sent, never your identity.

If you turn on push notifications, your browser hands us a delivery address at its own push service (Google, Mozilla, Apple, or Microsoft, depending on the browser), and reminder messages travel through that service. Turning notifications off, or deleting your account, deletes the address.

You can connect an AI assistant (such as Claude) or another app to your account by creating an API token in Settings → Connected apps. RepDriver does not send your data to any AI provider on its own. Only when an app you connected asks, we return the data its permissions cover — your training profile, workout history and schedule, body-weight trend, and nutrition log — and, if you allowed it, accept changes it makes on your behalf.

Once that data reaches the app, its provider's privacy policy governs how it is handled (for example, whether conversations are stored or used for model training). Review the provider's settings before connecting. A token cannot access your password, email settings, other tokens, or account deletion.

You can revoke a token at any time in Settings; access ends immediately. Deleting your account deletes your tokens, request counts, and training profile. Exercise requests you filed are kept without any link to you, because other users may have asked for the same exercise.

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it to meet legal obligations or resolve disputes.

You can access and update most of your information from within the app. In Settings → Account you can download a copy of your data (everything as JSON, plus your workout history as CSV) and permanently delete your account yourself; you can revoke any connected app's access in Settings → Connected apps; and you can also email [email protected]. Depending on where you live, you may have additional rights (such as access, correction, deletion, or objection) under laws like the GDPR or CCPA; contact us to exercise them.

We take reasonable technical and organizational measures to protect your data, including hashing passwords and restricting access. No method of transmission or storage is completely secure, however, so we cannot guarantee absolute security.

The Service is not directed to children and is intended for users 18 and older. We do not knowingly collect data from children. If you believe a child has provided us information, contact us and we will delete it.

We may process and store information in countries other than where you live. By using the Service you consent to such transfer, subject to appropriate safeguards where required by law.

We may update this policy from time to time. We will update the date above and, where appropriate, notify you of material changes. Continued use of the Service means you accept the updated policy.

Questions about your privacy? Email us at [email protected].