RepVault Privacy Policy

Status: DRAFT — not reviewed by counsel. The facts in this policy are now complete and accurate; what remains is a legal review of the wording.

Effective date: September 4, 2026

This policy describes what RepVault ("the app") does with your information. It covers the iOS app and the RepVault API that the app talks to. The Share Extension is disabled in this release and receives nothing.

Summary

RepVault stores your workouts, your training history, and your onboarding answers on your device. It does not have a user database and does not build a profile of you on our servers.

Three things do leave your device:

1. Sign in with Apple. Required before any generated or server-parsed workout works.
2. Workout generation and text parsing. The training preferences and free-text notes you enter, and workout text you type or paste in that the app cannot read on your device, are sent to our API and from there to a third-party AI model provider.
3. Unrecognised movement names. A movement name the app does not know can be reported back so the exercise catalogue can be improved.

Everything else — your saved workouts, your logged sets, your history — stays on your device.

Identity: Sign in with Apple

RepVault requires an account for the features that call our API. Signing in happens the first time you generate a workout or have text parsed on the server, and can also happen during onboarding.

• RepVault requests no scopes from Apple. We do not ask for, and Apple does not give us, your name or your email address — not even a private relay address.
• What we receive is the Apple user identifier: an opaque string Apple generates for you specifically for RepVault. It is stable for you across your devices, and it is different from the identifier any other app receives.
• The app sends the signed Apple identity token to our API. Our server verifies that token's signature directly with Apple (appleid.apple.com), which means Apple can see that a verification took place.
• On success our server issues a 15-minute session token and returns it to the app. The session token is signed, not stored — there is no server-side session table. The app keeps it in the iOS Keychain.
• We also derive a pseudonymous purchase identifier from your Apple user identifier (a one-way SHA-256 derivation) and attach it to your App Store purchase, so a subscription can be matched to the account that is asking. It is stored in the Keychain on your device.

Subscriptions and payments

RepVault's generation and server-parsing features require an active auto-renewing subscription.

• Purchases are handled entirely by Apple's App Store / StoreKit. RepVault never sees or handles your payment details, card, or billing address.
• With each such request, the app sends the App Store's signed transaction record for your subscription to our API, so the server can confirm the subscription is real, current, and yours. The server verifies that record's signature against Apple's root certificates, which it fetches from apple.com.
• Apple's own handling of your purchase is governed by Apple's privacy policy, not this one.

What is sent when a workout is generated

When you tap to generate a workout in the Build a Workout sheet, the app sends to our API:

• your goal, session length, selected equipment, experience level, and training days per week;
• the free-text notes you typed (up to 500 characters);
• your App Store transaction record and your session token.

Our server then sends your goal, session length, equipment, experience, training days, and your notes to a third-party AI model provider, reached through the Vercel AI Gateway, so it can compose the workout.Please do not put anything you would not want processed by a third party into the notes field.

Before anything is sent to the model, the server screens your notes for health-related words (injury, pain, pregnancy, rehab, surgery). If one matches, the request is rejected and nothing is sent to the model provider — RepVault will not generate exercise guidance around a health condition.

What is sent when you type or paste in a workout

You can type or paste a workout in as plain text. RepVault tries the cheapest path first and only escalates:

1. On-device parsing. The app first tries to read the workout out of the text itself. This is entirely on your device and involves no network call.
2. Server parsing (paid fallback). If the on-device parser cannot find a workout, the app sends that text (up to 4,000 characters) to our API. Our server sends it to the third-party AI model provider to extract a structured workout. Please do not paste in anything you would not want processed by a third party.

Saving a workout from a TikTok, Instagram or YouTube link is not part of this release. The app does not fetch link previews, does not transcribe video, and its Share Extension is disabled, so no link, video or audio is sent anywhere. If that changes, this policy will be updated before the version that changes it is released.

What is stored on our servers, and for how long

RepVault has no user database. We do not store your account, your workouts, your history, your notes, or the workout text you paste in. Generation inputs are held only in memory for the single request that sent them.

Two short-lived items are written to Upstash Redis:

The daily counter is what enforces the per-account daily generation limit. It means your Apple user identifier is briefly present in our rate-limiting store; it is not linked to any workout content, and nothing about what you generated is stored with it. Upstash's own usage analytics are disabled for this data.

Session tokens are not stored on our servers at all.

Logs

• Our API writes a structured log line per request containing only: a request ID, the route, the HTTP status, a short response code, and aone-way hash of your Apple user identifier.
• Your Apple identity token, your RepVault session token, your App Store transaction record, your generation notes, and the workout text you type or paste in are never logged. There is deliberately no field for them.
• Each response carries an x-request-id header so a specific request can be discussed in support without identifying you.
• Separately, Vercel, which hosts the API, keeps its own platform request logs (including IP addresses and request metadata) under its own retention policy, as any web host does.
• The app prints onboarding and workout milestone events to the local iOS device console for debugging. These stay on your device. RepVault uses no analytics SDK, no advertising SDK, no crash-reporting SDK, and no tracking of any kind.

What stays on your device only

• Every workout you build, paste in, or generate, and every exercise in it.
• Your entire training history: completed sessions, dates, durations, and per-set reps and weights.
• Your onboarding answers (goal, experience, kettlebell setup, days per week, session length), stored in app preferences.
• Your RepVault session token and pseudonymous purchase identifier, in the iOS Keychain.
• Any workout text you type or paste in that the on-device parser can read without help.

This data is stored locally by the app. RepVault does not enable iCloud sync for it, so it is included in your iPhone backups only to the extent Apple's own device backup covers app data. Deleting the app deletes it.

Who receives your data

We do not sell your data, share it for advertising, or use it to train any model. Each provider above processes this data on our behalf under its own standard terms and data-processing terms — Apple's Developer Program agreements, and the published data-processing addenda of Vercel, OpenAI and Upstash. We have not negotiated bespoke agreements with any of them. OpenAI is reached through the Vercel AI Gateway on OpenAI's API platform, where inputs are not used to train models by default. These providers process data in the United States, so using RepVault involves an international transfer of the data described above.

Children

RepVault is not directed at children under 13 and we do not knowingly collect information from them. If you believe a child under 13 has given us information, email us and we will delete it. Where local law sets a higher age for consent to data processing, that higher age applies.

Your choices and rights

• Stop sending data to the model provider: do not use workout generation, and do not use the server fallback when you paste a workout in. Building a workout by hand, on-device parsing, and every other feature keep working.
• Delete everything on your device: delete the app.
• Delete your identity link: revoke RepVault in Settings > [your name]

  Sign In & Security > Sign in with Apple. The short-lived rate-limit and subscription-cache entries described above expire on their own within a day.

• Manage or cancel your subscription: Settings > [your name] > Subscriptions.
• Requests about your data: contact us atmatthew.alunni@gmail.com. We answer within 30 days.

Your rights under privacy law

Because RepVault keeps your workouts, history and onboarding answers on your device rather than in a user database, most of what these laws govern is information we never hold. We cannot produce, correct or delete data we do not have — deleting the app deletes it. The rights below apply to what we do receive: the items in the table above.

Health and fitness information. Your onboarding answers include your experience level, training frequency and any injuries or physical constraints you choose to describe, and these are sent to the model provider when you generate a workout. Some laws treat this as health data deserving extra protection. We ask for it only to compose your workout, we do not require it — the constraints field can be left empty — and we do not use it for anything else.

If you are in the UK or EEA (UK GDPR / GDPR), you have the right to access, correct, delete, restrict or object to our processing, and to data portability. Our legal bases are: performance of a contract for generating workouts and verifying your subscription; legitimate interests for rate limiting and security; and your explicit consent for any health-related detail you choose to enter, which you may withdraw at any time by not using generation. You may complain to your local supervisory authority. We do not currently have an EU or UK representative under Article 27.

If you are in California (CCPA/CPRA), you have the right to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we have not in the past 12 months. We will not discriminate against you for exercising these rights.

If you are in Canada (PIPEDA), you may access the personal information we hold about you and challenge its accuracy, and you may complain to the Office of the Privacy Commissioner of Canada.

To exercise any of these, email the address above. We may need to confirm your Apple identifier to locate the short-lived records tied to it.

Changes to this policy

If a future version of RepVault changes these practices, this policy will be updated before that version is released.

Contact and legal

• Controller / publisher: Matthew Alunni, operating as RepVault (sole proprietor)
• Postal address: [PLACEHOLDER — postal address; deferred by the CEO 2026-09-04. GDPR Art. 13(1)(a) expects a controller address, so this is a known gap, not an oversight.]
• Contact: matthew.alunni@gmail.com
• Governing law and jurisdiction: the laws of the Province of Ontario and the federal laws of Canada applicable in it, with the courts of Ontario having jurisdiction. This does not remove any protection you have under the mandatory law of your own country of residence.