Privacy Policy
This policy explains what RepClash collects, why, who sees it, how long we keep it and how you control it. RepClash is offered to people in the United States and Canada (except the province of Quebec) and is not intended for use in other regions. RepClash is not currently offered to people in Quebec; if you are in Quebec, please do not use it.
Who we are
RepClash is operated by Sunnatillo Yusupov, an individual based in Tashkent, Uzbekistan ("we"). We are the organisation responsible for your personal data. Contact for everything in this policy: thesunnatilloyusupov@gmail.com.
- Person in charge of the protection of personal information (Canada): Sunnatillo Yusupov, same email address.
Your camera
When you start a set, your camera is used so the app can count your reps. The video is analysed on your device by a pose-detection model that runs in your browser. The video and images are never uploaded, recorded or stored by us. Only the final result (exercise, number of reps or seconds, how long the set took) is sent to our servers. The pose model finds body points to count movements; it does not identify you.
What we collect, why, and for how long
| Data | Why we use it | Your consent | How long we keep it |
|---|---|---|---|
| Profile: display name you choose, a random account ID, the time you confirmed your age and agreed to the terms | Create and run your account; show your name to people you play with | Needed to run the app | Until you delete your account. Guest accounts that never record a workout or join a club are removed after about 30 days. |
| Login (optional): email and password if you add them | Let you sign in on other devices and keep your progress. The password is stored hashed by our authentication provider. | Needed to run the app | Until you delete your account |
| Workout results: exercise, reps or seconds, duration, date, personal records and streaks. Exercise data can relate to health. | Count and save your sets, show your streak, run challenges and clubs, make share cards | Your explicit consent, given separately when you start. Withdraw any time in Profile (this deletes your workout results) or by deleting your account. | Until you delete your account |
| Challenges and clubs: challenges you create or answer, clubs you join, your daily check-ins, when you joined | Run challenges and clubs, rank members, show progress | Needed to run the app | Until you delete your account or leave the club (check-ins in that club are removed when you leave) |
| Technical data: IP address, device and browser type, timestamps in server logs and security signals (including, where we have switched it on, the Cloudflare Turnstile bot check) | Security, preventing abuse and bots, keeping the service running | Needed for security and reliability | Short periods set by our hosting providers (generally days to a few weeks) |
We do not collect payment data, precise location, contacts, microphone audio or health records from other sources, and we do not use advertising or analytics trackers. We do not make decisions about you by automated means that have legal or similarly significant effects.
Backups. Our database provider may keep routine backup copies. If it does, data you delete is overwritten or removed from them within about 35 days.
You do not have to give us this information, but we cannot provide the app without a name and your consent to save your workout results.
What other people can see
- Anyone with a challenge link can see the challenger's display name, the goal, and the names and results of people who answered.
- Anyone with a club link can see the club name, type and the ranked list of members' display names and progress. How long each member has been in the club is shown only to people who are in that club.
- Share cards are images you can post anywhere. They show display names, results and rankings. Cards are cached for a short time (up to about 10 minutes), so a change or deletion can take that long to show on a card. Copies of a card that someone already saved or shared can't be recalled by us.
Who processes data for us
- Supabase (database, authentication, file storage and the functions that draw share cards). Data region: East US (North Virginia), United States.
- Cloudflare: website hosting and delivery, short-term caching of share cards, and, where we have switched it on, the Turnstile bot check shown when you start as a guest or log in (it may look at technical signals such as your IP address and browser).
These providers act on our instructions. We do not sell your personal data and we do not share it for advertising. We may disclose data if the law or a valid legal request requires it, or to protect people from harm.
Where your data goes
Your data is stored in the United States and is accessed by us from Uzbekistan. If you are in Canada, this means your data is processed outside your country, where the law may protect it differently and authorities there may be able to access it.
Browser storage
We use your browser's local storage only to keep you signed in and remember basic settings. This is strictly necessary for the app to work. We do not use advertising or analytics cookies. We do not track you across other websites, and we do not respond differently to "Do Not Track" signals because we do not do cross-site tracking. We also honour the Global Privacy Control signal: it has nothing to switch off, because we neither sell nor share personal data.
Your choices and rights
- Download your data and delete your account and data: Profile → account section. Deleting your account removes all your data.
- Change your name: Profile. Withdraw your consent to storing workout results (this deletes your results, streaks, challenges you created and club check-ins, and keeps your account): Profile.
- You may have the right to: access your data and get a copy; correct it; delete it; withdraw consent at any time (without affecting what happened before); and to complain to a privacy regulator.
- Canada (PIPEDA and applicable provincial laws): the rights above, including access, correction and withdrawing consent. You can complain to the Office of the Privacy Commissioner of Canada.
- United States: where state laws such as the California CCPA/CPRA, Virginia, Colorado, Connecticut or Texas laws apply to us, you can know, access, correct, delete and port your data, and opt out of sale, sharing and targeted advertising. We do not sell or share personal data and we do not use sensitive data (such as login credentials or health-related workout data) for anything except running the app, so there is nothing to opt out of or limit. We do not discriminate against you for using your rights. If we refuse a request you may appeal by replying to our answer; if you are still unhappy you may contact your state attorney general. Washington residents: see also our Consumer Health Data Privacy Policy.
How to use a right: use the buttons in Profile or email us. We may need to confirm it is you. We answer within 30 days (up to 45 days where US law allows, and in any case within the time the law that applies to you sets).
Age
RepClash is for people 16 and older. We do not knowingly collect data from younger people and we do not direct RepClash to children. If you believe a younger person has used RepClash, contact us and we will delete the account.
Security and breaches
Data is encrypted in transit and access to it is restricted by database rules; No online service is perfectly secure. If a breach affects your data we will notify you and the authorities as the law requires (for example the Privacy Commissioner of Canada and US state authorities, where they apply).
Changes
If we change this policy in a meaningful way we will update the date above and, where the law requires, tell you in the app or ask for your consent again.
Contact and complaints
thesunnatilloyusupov@gmail.com. Please contact us first; we want to fix problems. You can always complain to the privacy regulator where you live.