Privacy Policy
Last updated: 10 September 2026
1. Who is responsible
The data controller for RepLens is , . Contact for anything about your data: .
EU representative (GDPR Art. 27): .
2. The short version
- Training stays on your phone. Camera video, rep analysis, history, reviews, goals, steps and your local bodyweight are stored in your browser on your device. We never receive them unless you turn on backup, and a backup is encrypted so we can't read it.
- The competition is optional. If you join, your display name, photo, titles, counts and city-level place are public.
- No ads, no tracking, no analytics, no selling of data.
3. Data that stays on your device
The camera image is analysed on your phone by an on-device pose model. Video is never uploaded, except when you choose to send a clip to dispute a count (section 4). Sets, scores, events, notes, reviews, goals, steps, macros and settings are kept in your browser's storage (IndexedDB / localStorage). This storage is strictly necessary for the app to work, so no consent banner is needed. Clearing site data or uninstalling deletes it.
4. Data we process when you use optional features
| Feature | Data | Why / legal basis | Kept |
|---|---|---|---|
| Competition account | Display name, title wording, court (King's/Queen's), language, a hash of your device key, extra device sessions, optional Google account ID (not your email or Google name), optional profile photo | To run the competition you joined: contract (Art. 6(1)(b)). Photo: your consent (Art. 6(1)(a)), which you can withdraw by removing it. | Until you delete your account |
| Competition sets | Exercise, date/time, official and phone counts, form scores, rep timings, self-reported weight, and a pose track: body keypoint coordinates per frame, with no image, video or face picture. Also a coarse place (city, province, region, country). | Rankings and fair play, which is part of the service and our legitimate interest in preventing cheating (Art. 6(1)(b), (f)). | Until you delete your account |
| Location | When you allow it, your position is rounded to about 1 km and sent with the set. Our server rounds it to about 2 km and looks up city, province, region and country via OpenStreetMap Nominatim. Coordinates are not stored. Without location, only your country (from the network) is used. | Your device permission (consent) and the competition service. | Only the place names, with the set |
| Bodyweight (optional) | The bodyweight you type into the competition settings, and a copy saved with each weighted-row set | Can be health data: your explicit consent (Art. 9(2)(a)). Used only for the Royalty Club ×bodyweight standards and never shown to others. | Until you clear it or delete your account |
| Public display | Name, photo, titles, records and counts, city-level places, and club tiers are visible to everyone using RepLens | This is the purpose of the competition you join (contract). | While your account exists |
| Disputes and moderation | A contest video you upload, your claimed count and note, reports you make or receive, reviewer decisions and reasons | Fair play and our legal duties as a platform (EU Digital Services Act): Art. 6(1)(c), (f) | Contest videos are deleted when the decision is made. Records of decisions are kept while your account exists. |
| Crown alerts | Your browser's push subscription (a web address from Apple, Google or Mozilla's push service) and the alerts about crowns you lost | Your consent (the notification permission). Turn it off any time. | Until you turn alerts off or delete your account |
| Automatic backup | An end-to-end encrypted file (encrypted on your phone; the key never leaves it), its size and time, a hash of an access token, and a daily-changing hash of your IP address to limit abuse | The backup service you turned on (contract). We cannot read the content. | Until you turn backup off. The server copy is deleted immediately. |
| Moving to the home-screen app | A one-time encrypted package protected by the 8-character code shown on your screen | The transfer you asked for (contract) | Deleted on first download or after 24 hours |
| Technical data | IP address and request data processed by our host to deliver and protect the service | Legitimate interest in security (Art. 6(1)(f)) | Short-term host logs |
5. Who else receives data
- Cloudflare, Inc. hosts the app, database and file storage as our processor, under its data processing addendum and the EU Standard Contractual Clauses / EU–US Data Privacy Framework.
- Google, only if you use Google sign-in. Google's script loads only after you tap the Google button.
- OpenStreetMap Foundation (Nominatim) receives rounded coordinates from our server, not from your phone and without your IP address.
- OpenFreeMap serves the map tiles your browser loads on the Map tab, so it sees your IP address.
- Push services (Apple, Google, Mozilla) deliver notifications if you turn alerts on. Push messages contain no personal data.
- Reviewers we authorise, who see contest videos and reports only to decide them.
We don't sell data or share it for advertising.
6. International transfers
Our host may process data outside the EU/EEA, including in the United States, under the safeguards above. If the operator named in section 1 is established outside the EU, data is also accessed from there under the same safeguards.
7. Automated counting
Reps are counted automatically on your phone and recounted by our server under fixed rules. This decides rankings but has no legal or similarly significant effect on you. Every count can still be contested with a video and decided by a human.
8. Your rights
You can access, correct, delete, export, restrict or object to the processing of your data, and withdraw consent at any time. You can do most of this in the app:
- Settings → Competition → Download my data / Delete my account (immediate).
- Clear bodyweight, remove photo, turn off alerts or backup.
For anything else, write to . We reply within one month. You can also complain to a data protection authority. In Italy that's the Garante per la protezione dei dati personali; elsewhere, your local authority.
9. Age
The competition is for people aged 16 and over.
10. Security
Encrypted connections (HTTPS), keys stored only as hashes, end-to-end encrypted backups, and access-controlled review tools. No system is perfect. If a breach affects you, we'll tell you and the authority as the law requires.
11. Changes
We'll update the date above and tell you in the app about important changes.