Privacy policy

1. Controller

Manuel Jindra, reachable at info@reprivals.at. Further details are in the legal notice.

RepRivals is intended for people aged 18 and over and is not directed at children.

2. Where your data is stored

Your workouts, plans, exercises, weights, calories and analyses are stored on your device, on iPhone as on Android. If your iPhone backs up app data to iCloud, Apple’s privacy terms apply to that backup; on Android the same applies to the backup via your Google account if you have turned it on (Google’s terms apply). A backup file that you export yourself or have saved automatically is stored wherever you save it.

Backup in your account (optional). If you turn on “Back up to my account” in the settings, the app stores a backup file of your data on the RepRivals server (see below) – after a workout and when you leave the app, if something has changed. It contains the same as an export (workouts, plans, body weight, nutrition, settings), but no values from Apple Health or Health Connect. The file is encrypted on your device already; the key is known to the app – this is not end-to-end encryption with a password of your own. Only your account can read, replace or delete it. You can turn it off and delete it at any time in the settings, and “Delete account” removes it too. The legal basis is your consent (Art. 6(1)(a) GDPR and, for health details such as your body weight, Art. 9(2)(a) GDPR), which you can withdraw at any time.

As soon as you use Rivals or friends, the app needs an account and a server: so that a group sees the same leaderboard and friends can find each other, what you share there is stored on the RepRivals server. It is operated by Supabase in a data centre in Frankfurt am Main, Germany. The controller named in section 1 is responsible for this data under data protection law; Supabase processes it on his behalf (see 9.).

Training, plan and body data only reach the server if you explicitly share them (see 4.).

3. Your account and what is stored on the server

Sign-in. For Rivals and friends you sign in: on iPhone with “Sign in with Apple”, on Android with “Sign in with Google” or “Sign in with Apple”. There is no password. With Apple, RepRivals receives an identifier that belongs to your Apple ID and this app, and an email address – either your real one or Apple’s private relay address. With Google, RepRivals receives an identifier of your Google account, your email address and, depending on your Google settings, your name and a link to your profile picture; the sign-in service stores these details with your sign-in, and RepRivals uses only the identifier and the email address. While you are signed in, the sign-in service stores the time, IP address and device type of your sign-in; this is removed when you sign out or delete your account.

Stored on the server:

• your account identifier, the email address from sign-in and the device token for notifications (see 6.),
• your friend code, your display name, your avatar colour and your friends’ codes,
• open requests to you (friend requests, group and sharing invitations), the codes you have blocked, and a short-lived marker while your QR code is open on screen,
• for each group: name, members with display name, avatar, role and last activity, each week’s points, the history (names of workout days and exercises, new records), the weekly result and invitation codes,
• your in-app balance (coins, titles, discoveries, the start of a trial, your preferred figure per avatar family),
• an unlock of Rivals Pro if you received one, and the status of your subscription if you bought one (see 8.),
• the app version you last checked in with, including origin (store or test build) and time (see 8.),
• what you share with individual friends (see 4.),
• your backup file, if you have turned on “Back up to my account” (see 2.).

Who sees what. Anyone who knows your friend code sees your display name and avatar colour – that is how people find you. Nobody but you sees your open requests and blocked codes. Group data is visible only to the group’s members; an invitation code only opens the group far enough to join it.

The legal basis is Art. 6(1)(b) GDPR: groups and friends cannot be offered without this data. It is kept as long as you use these features; how to delete it is described in section 10. The server cleans up some things by itself: group feed entries after 35 days, invitations never redeemed after 14 days, former members’ read access after 60 days, and device tokens not renewed for 120 days. Weekly points and weekly results remain – they make up the history, also on a new device.

For technical reasons the server logs access with time and IP address; Supabase deletes these logs after seven days. The legal basis is Art. 6(1)(f) GDPR (secure and stable operation).

4. What you share in a group and with friends

In a group, the other members see your display name, your avatar, your role, when you were last active, your five scores for the current week, whether a training break takes you out of the scoring, and in the history the names of your workout days and exercises. This belongs to the group and cannot be switched off individually – you decide by joining or leaving.

With friends you always share: display name, avatar, your streak, your sessions this week and your unit of weight. Everything else is off by default and shared by you individually – training plans, past workouts, exercises & weights, body weight, and calories & protein, for everyone or per friend under Settings → Sharing.

This data is stored on the RepRivals server and can only be read by the people concerned: group data by the group’s members, a shared profile only by the one friend you share it with. The legal basis is Art. 6(1)(b) GDPR; where health data is concerned (body weight, calories, protein), sharing is additionally based on your explicit consent under Art. 9(2)(a) GDPR, which you give with the respective switch and can withdraw at any time. Values that come from Apple Health or Health Connect are excluded and never shared (see 5.). If you remove a friendship, withdraw a share or leave a group, access ends immediately; shared profile data is then deleted from the server.

5. Apple Health and Health Connect

With your explicit permission, RepRivals reads body weight, calories, protein, carbohydrates and fat from Apple Health (iPhone) or Health Connect (Android) to add them to your log. You grant permission in the system dialog and can withdraw it there at any time – on iPhone under Settings → Health → Data Access, on Android in Health Connect under app permissions (in RepRivals: Settings → Health Connect → Manage in Health Connect). RepRivals reads only these five values and writes nothing back.

Values taken from Apple Health or Health Connect always stay on your device. They are never transferred to the server and never shared with friends – not even if you have turned on sharing for body weight or calories. Only what you entered in RepRivals yourself is shared. Health data is not used for advertising and not passed on to third parties. The use of data from Health Connect complies with the Health Connect permissions policy, including the Limited Use requirements. The legal basis is your consent under Art. 9(2)(a) GDPR.

6. Notifications

If you allow notifications on iPhone, your device registers with Apple’s push service, which assigns a device identifier. If you are signed in to Rivals or friends, the RepRivals server stores this identifier with your account, together with the app language and which notifications you have turned on in the settings. When something that concerns you changes – a request, a new score in your group – the server sends a silent signal via Apple’s push service, and the app syncs in the background; whatever is new, it shows you as a notification. The silent signal contains no personal data.

Notifications from the server. Some notifications are sent by the server itself so that they arrive even when the app is closed: your group’s weekly result, when someone overtakes you, and – only if your app has not shown a request itself within two minutes – friend requests and group invitations. These notifications contain the other person’s display name and, where applicable, the group name; they go through Apple’s push service. Until they are sent, they wait in a queue on the server and are deleted after one day at the latest. The server sends news and offers only if you have explicitly turned them on in Settings → Notifications; you can turn them off there too. The legal basis is Art. 6(1)(b) GDPR, and for news and offers your consent (Art. 6(1)(a) GDPR).

Android. On Android, the app schedules its notifications itself on the device, for example reminders and the running clock during a workout. There are currently no notifications from the server there, and no device identifier is stored for them.

If you sign out or delete your account, the device identifier is deleted. You can turn off notifications at any time in your device settings.

7. When you report someone

Display names, group names and avatars are chosen by the users themselves. With “Report” you pick a reason and can add a few words; the report goes to the RepRivals server and contains your account, the reported account (if known), its display name and code, the group name where applicable, the reason and your text. The controller sees the report in an administration view and can reset the reported name (it is then blocked for that account) or suspend the account from groups, friends and profiles. The server deletes completed reports after 30 days. Without a sign-in or connection, the app instead opens an email draft to info@reprivals.at with the same details – it is only sent by you. In addition, the server checks every newly set name against a word list to catch obviously offensive names. The legal basis is Art. 6(1)(f) GDPR (interest in a platform without offensive content). Independently of this, you can block anyone in the app.

8. Rivals Pro and administration

What the app asks at start-up. When it starts and when you return to it – at most once a minute – the app asks the server whether Rivals Pro is currently free for everyone, which app version groups and friends need at minimum and, if you are signed in, whether Rivals Pro is unlocked for your account. In doing so it sends its version number and whether it comes from a store or a test build. Without sign-in, none of this is stored.

Minimum version. So that everyone in a group calculates by the same rules and no old version overwrites group data, the controller can set a minimum version. If your app is older, Rivals and friends only work again after an update; your training and deleting your account keep working. If you are signed in, the server stores only the last reported version number with origin and time for your account – so it is visible before raising the minimum how many people still use an older version. The legal basis is Art. 6(1)(f) GDPR (uniform rules in groups and stable operation).

Unlocks. The controller can unlock Rivals Pro for individual accounts, for a limited time or until revoked. The start, end and a short note are stored for this.

Notices and promotions in the app. The server can show notices as a window on opening or as a banner on the home screen, for example about new features or offers. Whether a notice fits you (for example “without Pro”) is checked by the app on your device; what it has shown is remembered only there. The server only counts in total how often a notice was shown, tapped or dismissed – without any link to an account or device. If a promotion gifts Rivals Pro, the account records that it received the gift and until when. The legal basis is Art. 6(1)(f) GDPR (information about the app and its offers).

Statistics. From data that is available anyway (registration, last use from the version report or sign-in, groups, subscriptions), the server counts daily totals every hour – for example how many accounts were active or how many groups are playing. These daily figures contain no account identifiers. The legal basis is Art. 6(1)(f) GDPR (operating and improving the app).

Subscriptions. If you buy Rivals Pro on the App Store, payment is handled by Apple; RepRivals never sees payment details. So that your subscription can be linked to your account, the app passes your account identifier to Apple at purchase, and Apple then reports purchase, renewal, cancellation, expiry and refund to the RepRivals server. In addition, the app presents the purchase confirmation signed by Apple when you are signed in. Stored for this: which subscription (month or year), until when it runs, whether it renews, whether it was refunded, whether it was a test purchase, and Apple’s identifier of the subscription. The start of your trial is also stored with your in-app balance (see 3.). The legal basis is Art. 6(1)(b) GDPR (the subscription applies on all your devices) and, for support and evaluation, Art. 6(1)(f) GDPR.

Subscriptions on Android. On Android, purchases are made via Google Play; RepRivals never sees payment details there either. The app passes your account identifier to Google at purchase and then presents the purchase token to the RepRivals server. With it, the server asks Google which subscription is running, until when, whether it renews and whether it was a test purchase, and stores this as above, with Google’s identifier of the purchase. Legal bases as above.

Administration view. For support, against abuse and for such unlocks, the controller sees per account in an administration view: account identifier, email address from sign-in, display name, friend code, the names of your groups, the number of your friends and signed-in devices, the times of registration, last sign-in and last activity, your subscription and trial, the last reported app version, any unlock, as well as reports about the account and any suspension. Training, plan and body data do not appear there. Every change in the administration is logged with its time. The controller accesses other data on the server only when necessary for operation, for example to fix a fault. The legal basis is Art. 6(1)(b) GDPR and, for support and preventing abuse, Art. 6(1)(f) GDPR.

9. No third-party advertising, no tracking, processors

RepRivals contains no third-party advertising and no analytics tools. There is no cross-device tracking, no advertising identifier and no sharing or selling of your data. Notices about the app’s own features and offers are described in section 8.

Libraries. The iPhone app uses no third-party libraries and talks to the server directly. The Android app uses Google libraries for “Sign in with Google”, for the QR code scanner (Google Play services; the image is analysed on the device) and for Health Connect, plus open-source libraries for the user interface. Technical data may be sent to Google for sign-in and Google Play services; the Google privacy policy applies to that.

Processors and partners. Supabase Pte. Ltd., Singapore, acts as processor (server for Rivals and friends, data centre in Frankfurt am Main); a data processing agreement is in place with Supabase. For sign-in, backups, notifications and the stores, RepRivals works with Apple (Apple privacy policy) and Google (Google privacy policy), who are themselves responsible for their own services.

Countries outside the EU. Where Apple, Google, Supabase or their sub-processors process data outside the EU, mainly in the USA and in Singapore, this is based on an adequacy decision of the European Commission (for certified companies in the USA, the EU-US Data Privacy Framework) or on the EU standard contractual clauses. This also applies to users in Switzerland and the United Kingdom.

10. Deleting and taking your data with you

Delete your account: Settings → Account → Delete account. This immediately deletes your account and everything listed in section 3 – including a backup in your account – from the server: you leave every group (leadership passes to the next member), your friends lose you from their list, and your friend code, mailbox, shares, unlock, reported app version, device identifier, waiting notifications, suspensions and gift records disappear. In reports you wrote or that concern you, the account is removed; like all reports, they are deleted no later than 30 days after being completed. Your workouts on the device remain. The server’s daily backups still contain deleted data for up to seven days; after that it is gone there too.

Reset the app (Settings → Reset app) deletes all data on the device, leaves every group, ends every friendship and deletes your friend code, mailbox and in-app balance from the server. The account itself remains until you delete it.

Sign out (Settings → Account) pauses Rivals and friends on this device; everything stays on the server until you sign in again or delete the account.

Withdrawing individual items: you turn off a share under Settings → Sharing, end a friendship in the friend’s profile, and leave a group in the group view. The others’ access ends immediately.

Taking your data with you: Settings → Export data creates a complete backup file of your local data (Art. 20 GDPR).

Already deleted the app? A message to info@reprivals.at is enough – if possible with your friend code or the email address from sign-in, so that the account can be identified. See also Delete your account.

11. Hosting and server log files

The website and email inbox are hosted by helloly GmbH, Rainerstrasse 25, 4020 Linz, Austria. With every visit, the web server automatically records server log files: IP address, date and time, page visited, browser type and version, operating system and referrer URL.

This data is used to deliver the website, detect faults and for IT security, and it is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

12. No cookies, no tracking

This website sets no cookies and uses no analytics, marketing or tracking tools. There is no contact form and no newsletter sign-up; no usage profiles are created.

Only your language choice (German or English) is remembered in your browser’s storage (localStorage), so the site starts in the same language on your next visit. It stays on your device and is not transmitted.

13. No external resources

This website loads no resources from third-party servers. The fonts (Big Shoulders Display, Hanken Grotesk, JetBrains Mono – SIL Open Font License) and the QR code library are stored on the same server as the site itself. Your IP address is therefore transmitted to no one except the host named in section 11.

14. Invitation links

Links of the form reprivals.at/einladung.html?gruppe=… or ?freund=… contain an invitation or friend code. If the app is installed, it opens the link directly; otherwise this page shows the code. It only reads it in your browser; the web server logs the visit like any other (see 11.).

15. App Store and Google Play

Via the store buttons, the QR code or reprivals.at/app you get to Apple’s App Store or to Google Play. reprivals.at/app detects from your browser’s details whether you use an iPhone or an Android device and stores none of it. As soon as you open a store, you leave this website – the Apple privacy policy or the Google privacy policy applies.

16. Contact by email

If you write to info@reprivals.at, your email address and your request are stored to handle it (Art. 6(1)(f) GDPR) and deleted as soon as they are no longer needed.

The same applies to exercise requests and ideas from the app (“Suggest an exercise”, “Share an idea”): the app opens a prepared email draft in your mail program which, besides your text, contains only the app version and the operating system version. It is only sent by you.

17. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). To exercise them, contact info@reprivals.at.

For the data in the app, several of these rights can be exercised directly in the app – access and portability via the export, erasure via “Delete account” and “Reset app”, withdrawal of consent via the sharing settings and the health permission in iOS or Health Connect. Section 10 describes each of these routes.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna; you can also contact the authority in your country of residence.