Privacy Notice

Who we are

RepGrab is operated by Barbara Szekely. We are the data controller for the personal data described here — we decide why and how it is processed. Contact us at repgrab1@gmail.com.

What we collect and why

• Account data — email address, login identifiers, and name or avatar if you sign in with Google or Apple. Used to create and secure your account (performance of our contract).
• Training content — links you submit, extracted workouts, saved workouts, schedules, logged sets, weights, notes, personal records and measurements. Used to provide the service and sync across devices (contract).
• Subscription status — your plan, renewal dates and entitlement records received from Paddle. Used to unlock paid features (contract).
• Usage and technical data — feature usage counts, device and browser type, IP address, error logs. Used for security, fraud prevention, reliability and product improvement (legitimate interests).
• Support messages — what you send us. Used to answer you (legitimate interests).
• Marketing emails — only if you opt in (consent). You can unsubscribe at any time.

We also process data where we must to comply with a legal obligation, such as accounting and tax records.

Who we share it with

• Paddle, our Merchant of Record, for the sale of subscriptions, subscription management, payments, invoicing, tax compliance and fraud checks. Paddle collects your billing details directly; we never see your full card number.
• Service providers — cloud hosting, database and authentication providers, and the AI processing service used to read the links you submit. They act on our instructions.
• Professional advisers — accountants and legal advisers where needed.
• Authorities — where we are required to by law.

We do not sell your personal data.

International transfers

Some of our providers process data outside the UK and EEA, including in the United States. Where that happens we rely on adequacy decisions or Standard Contractual Clauses together with appropriate technical safeguards.

How long we keep it

We keep your account and training data for as long as your account is active, and for up to 12 months after you close it so you can come back. Support messages are kept for 2 years and billing records for as long as tax law requires (typically 6–7 years). After that we delete or anonymise the data.

Security

We apply appropriate technical and organisational measures, including encryption in transit and at rest, per-user access rules on the database, and restricted administrative access. No system is perfectly secure, but we take this seriously.

Cookies and local storage

We use essential cookies and browser storage to keep you signed in and to remember your workouts, queue and preferences on your device. We do not use advertising cookies. You can clear or block them in your browser, though parts of the app will stop working.

Your rights

Subject to UK and EU data protection law you may request access to your data, correction, erasure, restriction of processing, portability, and object to processing based on legitimate interests. Where processing is based on consent you can withdraw it at any time. Email us and we will respond within one month. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

Changes

If we update this notice we will change the date at the top of this page and, for significant changes, let you know in the app.