Privacy policy

The short version

• We store your email address, your time zone and the training data you create. That is about it.
• We do not sell your data, show ads or use tracking or analytics cookies.
• We do not ask for medical or body data, and we ask you not to enter any.
• The AI apps you connect receive the repdot data you ask for in your chats. What they do with it is covered by their own privacy policies.
• You can delete your account at any time, which permanently deletes all your data.

Who is responsible

Ján Lipničan, an individual based in Slovakia ("we", "us"), runs repdot as a free, non-commercial project and is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Contact us at hello@repdot.app.

What we collect and why

• Account: your email address, your time zone (taken from your browser when you sign up), your plan (free) and the version of the terms you accepted and when. We need these to create your account, sign you in and show times correctly.
• Training data: the workout plans, exercises and sets you or your AI app record, with weights, repetitions and times.
• Activity log: a record of each change to your data: what changed, when, and whether you or a connected AI app made it.
• Connected AI apps: which apps you have allowed to use your account, and the access tokens that let them do so.
• Sign-in and security: a session that keeps you signed in, one-time sign-in codes (valid for 10 minutes), and counts of sign-in attempts per email address and IP address, which we use to stop abuse.
• Messages: anything you send us by email.

Our legal bases under the GDPR are: performing our contract with you (running your account and the service you asked for), our legitimate interests (keeping the service secure, preventing abuse, answering your messages) and legal obligations where they apply. We do not rely on consent, because we do nothing that needs it, and we make no automated decisions with legal effect on you.

What we do not collect

repdot is a general fitness product. It has no fields for medical history, conditions, injuries, medication, pregnancy, body measurements, heart rate, sleep or other biometric data. Text you enter, such as an exercise name, is stored as you wrote it, so please keep health details out of it. We have no advertising and no third-party analytics or trackers.

AI apps you connect

You use repdot through AI apps from other companies, such as ChatGPT (OpenAI), Claude (Anthropic), Copilot (Microsoft) or Grok (xAI). When you connect one and ask it something, we send it the repdot data needed to answer: for example your plan or your recent workouts. That company then handles the data, and everything else in your chat, under its own terms and privacy policy, as a separate controller. It may process data outside the EU. We do not see your chats; we only see the requests the app makes to repdot. You can disconnect an app at any time.

Who processes data for us

• Cloudflare hosts the service and the database. The database is located in Western Europe. Cloudflare handles every request to repdot, including your IP address.
• Resend sends our emails (sign-in codes and account notices), so it receives your email address.

We do not sell or rent your data, and we share it with nobody else, unless the law requires us to or you ask us to.

Transfers outside the EU

Your data is stored in Western Europe, but Cloudflare and Resend are US companies and may process some data outside the European Economic Area. Where that happens, the transfer is covered by safeguards the GDPR recognises, such as an adequacy decision or the European Commission's standard contractual clauses. Ask us if you want more detail.

Cookies

We set one essential cookie: the session cookie that keeps you signed in on repdot.app. It lasts 30 days and is renewed while you keep using the site. We set no analytics, advertising or other tracking cookies, which is why there is no cookie banner.

How long we keep data

• We keep your account and training data until you delete your account.
• Deleting your account permanently deletes every record we hold for it, ends your sessions and revokes access for all connected AI apps. This cannot be undone.
• Sign-in codes expire after 10 minutes. Sessions end after 30 days without use.
• Emails you send us are kept for as long as we need them to deal with your request.

Your rights

Under the GDPR you can:

• ask what data we hold about you and get a copy of it;
• get your data in a common, machine-readable format (export);
• have wrong data corrected;
• have your data deleted, which you can also do yourself on the account page;
• object to, or ask us to restrict, processing that rests on our legitimate interests.

Write to hello@repdot.app and we will answer within one month. You also have the right to complain to the data protection authority of the country where you live or work. Our lead authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk).

Children

repdot is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone younger. If you believe a child has created an account, tell us and we will delete it.

Security

Connections to repdot are encrypted. There are no passwords to leak: you sign in with a one-time code sent to your email. Each account's data is kept separate from every other account's. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Changes to this policy

If we change this policy, we will change the date at the top of this page. If a change matters, for example a new kind of data or a new company processing it, we will tell you by email or at sign-in before it takes effect.