Effective date: October 13, 2026
RepRats is a workout log for iPhone that suggests weights and reps for your next session. It is made by Denys Nazarenko, an individual in Ontario, Canada, operating as Four Eights ("we", "us"). We are responsible for the personal information described here. Questions or requests: support@reprats.app.
This policy says what we collect, why, who else handles it, how long we keep it, and what you can do about it. It covers the RepRats app and the web pages that host this policy, our Terms of Use and our Consumer Health Data Privacy Policy. If you live in Washington State or Nevada, also read the Consumer Health Data Privacy Policy.
This is fitness information. RepRats does not ask for health information. If you type health details into a note, we store them only as part of your workout log. We use your training data only to run the app and its coaching, never to advertise to you, and we never sell it.
If you import a Strong or Hevy export, the file is read on your phone and then deleted; we store only the workouts, effort ratings and notes it contains, which app it came from, and how you matched its exercise names.
If you buy RepRats Pro, Apple takes the payment. We never receive your card or Apple Account details. Our subscription provider, RevenueCat, receives your user ID, your purchase and subscription status (product, dates, trial status, renewal and cancellation state, receipt data, store and country) and technical data that comes with any request, such as your IP address. RevenueCat tells the app whether Pro is active.
When the app crashes or hits an error, it sends a report to Sentry. A report contains the error and stack trace; the device model, operating system, app version and which app update is running; the state of the device at the time, such as free memory and storage, language and time zone; a random identifier Sentry creates for this installation of the app; and a short trail of recent events: screens visited, buttons tapped, app log messages, the web addresses the app contacted, import steps (counts only), and events such as a paywall page opening or a rest notification arriving late. Sentry also receives standard network data such as your IP address, which we set Sentry not to store. We do not attach your user ID, email or name to these reports, and the app does not send screenshots or session recordings.
We use PostHog, hosted in the EU (Frankfurt), to see how the app is used so we can fix what is confusing and improve onboarding and the free trial. Before you sign in, events carry a random identifier PostHog creates on your device. Once you sign in, they are tied to your RepRats user ID. The identifier is reset when you sign out or delete your account.
The events are: the app opening (the first time ever, then each time it starts from closed, and when you come back to it on a new day), the sign-in screen being shown, a completed sign-in (the method and whether it was a new account), onboarding steps viewed, a program saved (preset or custom), each workout logged (whether the coach was used and whether it came from a program), the paywall being shown, its pages viewed and it being closed, a purchase started, completed or failed, the outcome of a restore, opening the code redemption screen, and, after a workout, totals of how many coach suggestions you kept or changed. Two of these, each workout logged and the coach suggestion totals, are sent only if you chose Share when the app asked, or turned Share usage data on yourself in Settings; while usage data is on only by default, they are not sent. When the app starts from closed, an event also records how long it took to start and whether it stopped waiting. Each event also carries your plan (Free or Pro), the app's release channel, and device details the analytics library adds: device type and model, operating system and version, app version and build, language, time zone and screen size.
Events never include your email, name, weights, reps, exercise or program names, notes or any other text you type. We do not use automatic event capture or session recordings, and we do not use the iOS advertising identifier. PostHog receives your IP address with each request; we set it not to store the address and not to use it to work out your location.
Your choice. The setting is Share usage data in Settings. It applies to this device. Each time the app starts, it asks iOS, on your phone, which country the App Store account on the device is set to. The app uses the answer only to make this choice and does not send it to us. If your App Store account is set to Canada (or to a country in the European Economic Area, the United Kingdom or Switzerland), or the app cannot tell, usage data stays off until you answer a one-time "Share usage data?" question: Share turns it on, Don't share keeps it off. For every other country it is on by default. Either way you can change it at any time in Settings. Until usage data is on, events are held only in the app's memory on your phone and nothing is sent. If you choose Share, the events it is holding are sent too. If usage data stays off, they are discarded, and they are lost anyway when the app closes. Turning it off stops new events from being sent. Events sent earlier are kept as described in section 5, and those linked to your account are deleted when you delete your account.
We send two kinds of message, both because you asked: a password reset link and an email-address verification link. They are sent through Resend. Resend receives your email address and the message. We do not send marketing email.
If you write to support@reprats.app, we keep your message and our replies so we can help you.
When you share a workout card, the image goes to the iOS share sheet. If you tap Save Image there, iOS adds the card to your photo library. RepRats has add-only access for that and cannot see or read any photo in your library. Nothing is sent to us.
Rest-timer alerts (iOS notifications, or alarms through Apple's AlarmKit if you choose alarms in the app) and the trial reminder are scheduled on your phone. We do not use push notifications and we do not collect a push token. You can turn notifications and alarms off in iOS Settings. The Live Activity for your active workout is also produced on your phone.
Location, contacts, camera or microphone data, access to read your photos, Apple Health data, the advertising identifier (IDFA), or payment card details. The app does not track you across other companies' apps or websites.
When you open this policy or our other legal pages in a browser, the hosting provider records standard server logs such as your IP address and browser type. These pages use no cookies, analytics or tracking scripts.
RepRats is not offered in App Store countries in the European Economic Area, the United Kingdom or Switzerland. If European or UK data protection law applies to how we handle your information, the table shows the legal basis we rely on.
| Purpose | Data | Basis (GDPR / UK GDPR) |
|---|---|---|
| Create your account, sign you in, sync your data across devices | Account data, workout data | Contract |
| Log workouts, calculate records and progress, suggest weights, reps and swaps | Workout and training data | Contract |
| Show the training safety notice and keep a record that you acknowledged it | Acknowledgement date, user ID | Contract; legitimate interests (a record that you saw the notice) |
| Provide and check Pro access, restore purchases | Subscription data, user ID | Contract |
| Send password reset and verification emails, prevent abuse (rate limits) | Email, user ID | Contract; legitimate interests (security) |
| Find and fix crashes | Diagnostic data | Legitimate interests (a working, stable app) |
| Improve the app and its onboarding | Usage analytics events, user ID | Legitimate interests (you can switch it off in Settings) |
| Answer support requests, comply with law, defend legal claims | Your messages, relevant account data | Legitimate interests; legal obligation |
In Canada we rely on your consent, given when you create an account and use the features above, and on what Canadian privacy law allows without it. For usage analytics, if your App Store account is set to Canada we ask first and send nothing to our analytics provider until you choose Share. You can withdraw consent by turning off Share usage data or deleting your account.
We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not use automated decisions that have legal or similarly significant effects: the weight suggestions are arithmetic on your own history and settings.
Our service providers process data on our behalf under contracts that require them to protect it at least as well as this policy does and to use it only to provide their service to us. Apple and Google, when you sign in or buy through them, handle your information under their own privacy policies, and Google does the same for our support inbox (Gmail).
| Provider | What for | What it receives |
|---|---|---|
| Google Firebase (Authentication, Cloud Firestore, Cloud Functions, App Check) | Accounts, your stored data, server functions, abuse protection | Account data, workout and training data, user ID, device attestation tokens |
| Apple (Sign in with Apple, App Store, App Attest) | Sign-in, purchases and subscriptions, confirming the app is genuine | Whatever you share with Apple; purchases are between you and Apple |
| Google (Sign-In) | Optional sign-in | Your Google account sign-in; we receive your name, email and photo link |
| RevenueCat | Subscription status and entitlements | User ID, purchase data, IP address |
| Sentry | Crash reports | Diagnostic data described above; your IP address, which we set Sentry not to store |
| Resend | Sending reset and verification emails | Your email address and the message |
| Cloudflare | Routes every request to our server functions (password reset and verification emails, Sign in with Apple, account deletion) and filters abuse; receives email sent to support@reprats.app and forwards it to our support inbox (Cloudflare Email Routing) | Request data, including IP address, your sign-in token (which contains your user ID and email address) and the email address you type into the password reset form; support emails you send |
| Google (Gmail) | Hosts our support inbox | Support emails you send and our replies |
| Expo (EAS Update) | Delivers app updates | A random installation identifier, app version and platform, standard network data |
| PostHog (EU, Frankfurt) | Usage analytics, if Share usage data is on | User ID, a device-level random identifier, and the events described above (IP address not stored) |
| Netlify | Hosts this policy and our other legal pages | Standard web server logs |
We may also disclose information when the law requires it or to protect someone's safety or our legal rights. If RepRats is sold or transferred, including to a company the owner sets up, your information may pass to the new owner under this policy, and we will tell you before that happens.
When you use the share button, the image goes to the app or action you pick in the iOS share sheet, including Save Image to Photos. That is your choice, and we do not receive it.
Your workout and profile data is stored in Google Cloud Firestore in Toronto, Canada. Other parts of the service run in the United States: Firebase Authentication and Cloud Functions, Google Sign-In, Gmail, RevenueCat, Sentry, Resend, Cloudflare, Expo and Netlify. Usage analytics are processed in the EU (Frankfurt). Using RepRats therefore means your information is transferred to and processed in countries whose privacy laws can differ from yours, where courts, law enforcement and other authorities may be able to access it.
Before any personal information leaves Quebec or Canada, we assess that it will be adequately protected.
If European or UK data protection law applies to you: the European Commission and the UK recognise Canada as giving adequate protection, and for transfers to the United States we rely on the EU-US Data Privacy Framework (and its UK Extension) where the provider is certified, or on standard contractual clauses. Ask us for details.
Deleting your account does not cancel an Apple subscription. Cancel it in your Apple Account settings first, or you will keep being billed by Apple. After the second deletion pass, a subscription renewal can create a new customer record at RevenueCat, and another device that is still signed in to your account can send new analytics events. Cancel your subscription and sign out of RepRats on your other devices before you delete your account.
In the app (Settings): edit your display name, turn Share usage data on or off, change weight units, turn Sign in with Face ID on or off, bring in a Strong or Hevy export (Import workout history) or remove it again (Remove imported history), read the training safety notice again (Training safety), open our Consumer Health Data Privacy Policy (Consumer health data), sign out, and Delete account (permanently deletes your account and data). You can delete individual workouts, programs and custom exercises.
By email: write to support@reprats.app to ask for a copy of your data in a machine-readable format, to correct it, or to delete it if you cannot use the app. We answer within 30 days; if the law allows more time and we need it, we tell you why. We may need to confirm it is you.
Depending on where you live, you may also have the right to:
We do not charge for using these rights.
Do Not Track: the app and these pages do not track you across other companies' apps or websites, so they do not respond differently to browser Do Not Track signals.
Data is encrypted in transit (TLS) and at rest by our providers. Database rules limit access so each signed-in user can read and write only their own data. Sign-in with email uses Firebase Authentication. Server functions that send email require a genuine app instance and are rate-limited. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and the regulators as the law requires.
RepRats is not directed to children. You must be at least 13, and at least the age at which you can consent to online services on your own in your country or province (for example 14 in Quebec, and up to 16 in parts of Europe). If you are under 18, a parent or guardian must agree to our Terms of Use and supervise your use of RepRats. We do not knowingly collect information from children below these ages. If you believe a child has given us information, write to support@reprats.app and we will delete it.
If we change this policy in a way that matters, such as a new provider or a new use of your data, we will update the effective date and tell you by email or in the app at least 30 days before it takes effect. Older versions are available on request.
Denys Nazarenko, operating as Four Eights, Ontario, Canada
Email: support@reprats.app
Privacy officer (person in charge of the protection of personal information): Denys Nazarenko, support@reprats.app.
Complaints: if you have a complaint about how we handle your personal information, write to the privacy officer at support@reprats.app. We investigate every complaint and answer within 30 days. If you are not satisfied, you can complain to the regulators listed in section 6.