Privacy policy

Repcord logs your workouts on your phone and keeps a copy on a server so you do not lose them. This page says what is collected, why, where it is kept, how long for, and how to remove it.

Last updated: 26 September 2026

Summary

• Repcord collects your account details, the training data you log, any photos and video you attach, and a small amount of technical data. Nothing else.
• Body measurements and the reminders you write are health-related information. Both are optional and need your consent.
• No advertising, no analytics, no tracking. Nothing is sold or shared for marketing.
• Your data stays in the EU — stored there, backed up there, and never sent outside it.
• Deleting your account deletes everything, with or without the app installed.

Who is responsible

Leo André, an individual developer in Sweden, is the data controller. Contact: support@repcord.app.

Repcord is operated from Sweden, so the GDPR applies to your data wherever you live. Your location affects only which authority you can complain to.

What is collected

Account

• Email address. Identifies the account, signs you in, and receives confirmation and password-reset codes. Required — there is no account without it.
• Password. Kept hashed, so it cannot be recovered — only reset.
• Google account identifier. If you sign in with Google: that identifier and the address Google returns.
• Dates the account was created and its address confirmed.

Profile

Your name, training goal, experience level, units, and display and notification settings. These shape what the app shows you — a goal, a chart axis, a plate increment. Everything except units is optional. Body measurements, including your weight, are not part of your profile: they are kept as a list of check-ins, under health-related information.

Training data

Sessions, the exercises in them and every set you log, including weight, reps, tags and how the session felt. Plans and scheduled workouts, goals, reminders, favourites, dashboard layout and any custom exercises you create. This is what you installed the app to keep.

Your body measurements and the reminders you write are covered under health-related information below.

Photos and video

If you attach a photo or a clip to a set, an exercise or a session, the file is stored on a server in the EU and kept until you delete it or your account, or until three months after your Pro subscription ends. You will be emailed before that happens. Nothing is taken automatically: a file exists only because you chose to add it, and Repcord does not read your camera roll.

Each file can only be opened through a link that is issued to your account and expires within minutes. Files are not encrypted in a way that hides them from us, so as the operator we are technically able to view them; we do not, and they are never analysed, shared or sold.

Technical

• App version and last-seen time. The version your device last sent and when it last connected, used to plan minimum-version requirements. No history of either is kept.
• Server logs. IP address, time, path and browser or app identifier, for the API and this website. Used to diagnose faults and spot abuse.
• Unreadable sync rows. If your device sends something the server cannot interpret, that row is kept so nothing you logged is lost.
• Crash reports. Includes details about the errors in the app. Used to diagnose and fix bugs in the app.

Health-related information

Two things are treated as health-related, which makes them special category data under the GDPR and consumer health data in the United States:

• body measurements — each one you log, such as your weight, with the date;
• reminders you write yourself — their name, icon and schedule.

Reminders are covered as a whole because Repcord cannot tell which of them are about your health. A reminder saying "Creatine, 9am" and one saying "Stretch, 9am" are the same kind of record to the app, so it treats them all as if they were the first. Workout reminders are different and are not covered: those are settings about the sessions you have planned, not something you write.

Both are optional, and Repcord asks for your consent before collecting either — a separate question during signup, which you can decline. Declining costs you those two things and nothing else: your account, workouts, plans, history and workout reminders all work as normal.

You can withdraw at any time. Preferences → Privacy has one control that withdraws consent and deletes both; a single measurement or reminder can also be removed on its own. Withdrawal applies immediately on the device and at the next sync on the server, and does not affect what was lawfully done before.

This information is never analysed, shared or sold. In Washington and Nevada, the consumer health data policy sets out further rights.

What is not collected

No advertising or tracking identifiers, analytics, location, contacts, biometric data, browsing history from outside the app, or anything about your work or education. Your camera roll and files are not read; the only photos or video Repcord holds are the ones you attached yourself. Nothing is read from Apple Health, Google Fit or any other health service. Repcord contains no advertising and no third-party trackers.

Where it is stored

• Your device. Every set is written locally as you log it, and stays there until you delete your account or the app.
• A server in the EU. The app uploads what you have logged when it has a connection, so a lost or replaced phone does not mean lost training history.
• Encrypted backups, in the EU, taken nightly. Each is encrypted on the server before upload, so the storage provider holds a file it cannot read.
• Crash reports in the EU, in the reporting service's European region.

Your data stays in Europe

All of it. Your account, your profile, everything you log, the backups and the crash reports are stored and processed in the EU, by Repcord and by every service it uses. Nothing is sent outside it.

How it is protected

• Every connection to the app and this site uses HTTPS.
• Passwords are hashed and never stored in readable form.
• Confirmation and reset codes are hashed, single-use and short-lived.
• Resetting your password signs you out on every device within the hour.
• Backups are encrypted before they leave the server.
• Access to the production database is limited to the people who operate the service.

If a breach affects your data, Repcord will report it to the Swedish Authority for Privacy Protection within 72 hours of becoming aware, and will email you directly where the risk to you is high.

How long it is kept

• Account, profile and training data: until you delete them.
• Photos and video: until you delete them, or three months after Pro ends.
• Server logs: deleted automatically within 30 days.
• Unreadable sync rows: deleted automatically within 90 days.
• Backups: deleted automatically within 30 days.
• Crash reports: deleted automatically within 30 days.

Deleting your account

Deleting your account can be done from the app or by mailing our support which is answered normally within 30 days. Once the delete has gone through, the data will be gone from our server and all traces of your data will be gone once all backups have been rotated (30 days).

Who else receives it

• A backup storage provider in the EU — encrypted backups, which it cannot read.
• A file storage provider in the EU — the photos and video you attach. Unlike the backups, these are not encrypted in a way that hides them from the provider.
• An email delivery service in the EU — confirmation and password-reset messages.
• An error-reporting service in the EU — crash reports.

Each acts on Repcord's instructions under a written agreement, is not paid in data, cannot use anything for its own purposes, and is required to protect your data to at least the standard set out on this page. Write to the contact address if you want to know which companies they currently are.

Nothing is sold, and nothing is shared for cross-context behavioural or targeted advertising. Data may be disclosed where the law requires it, and for no other reason.

If Repcord is transferred to someone else, your data goes with it only under this policy and you will be emailed beforehand. If Repcord shuts down, accounts are deleted rather than sold.

Legal basis

• Contract — your account, and the profile and training data that is not health-related. You are not obliged to provide any of it, but there is no account without an email address and a password.
• Explicit consent — health-related information, asked separately during signup. Repcord records that you gave it and when, so it can show the consent was properly obtained.
• Legitimate interests — crash reports, server logs, rate limiting and unreadable sync rows, to keep the service working, prevent abuse, and avoid losing your data.
• Consent — notifications, which you can turn off in the app or your device settings.
• Legal obligation — where a law requires something kept or disclosed.

You can withdraw any consent at any time, as easily as you gave it. Withdrawing does not make what was already done unlawful.

Automated decisions

There are none. Repcord makes no automated decision about you, does not profile you, does not score you, and does not use your data to train any model. The charts and suggestions in the app are arithmetic over your own logged workouts, shown only to you.

Your rights

Wherever you are, you can ask Repcord to:

• tell you what it holds and give you a copy;
• correct anything wrong;
• delete your data;
• provide it in a portable form;
• restrict or stop processing based on legitimate interests;
• honour a withdrawn consent;
• tell you who it has been disclosed to.

Most of this is in the app: your data is editable on your device, deletion takes effect immediately, and Preferences → Privacy emails you everything on your account as a file — sent to the address on the account, so it goes nowhere you have not already given us. For anything else, write to the address above.

Requests are answered within the time the law allows — one month under the GDPR, and 45 days under United States state laws. Either can be extended once for a complicated request, and you will be told before the first period runs out. There is no charge. A request is verified by asking you to send it from the address on your account, and you may use an authorised agent. If a request is refused you will be told why and can appeal by replying; an appeal is answered within 45 days.

You will never be denied the app, charged differently, or given a worse version for exercising any of these rights.

You can complain to the Swedish Authority for Privacy Protection (IMY) wherever you live, or to your own authority: in the EU and EEA your national data protection authority, in the United Kingdom the Information Commissioner's Office, and in the United States your state attorney general.

Children

Repcord is for people aged 16 and over, and signup asks you to confirm that you are. Your answer gates the signup and is not stored — which is why it is not listed among what is collected, and why it does not appear in your data export. Sixteen is at or above the age every EU country sets for agreeing to an online service without a parent's permission. Repcord does not ask for your date of birth. If you believe an account belongs to someone younger, write to the contact address and it will be deleted.

Changes

If what Repcord collects changes, this page changes and the date at the top is updated. Where a change materially affects data already collected, you will be emailed before it takes effect. A change that widens what is done with health-related information will ask for your consent again.

Contact

support@repcord.app for any question about this policy, your data, or a request under any right above.