We collect the data needed to provide REPCIR: account and identity details, profile fields, workouts, sets, goals, limitations, personal records, circle memberships, messages, posts, uploaded media, support requests, subscription state, and product telemetry.
Health and training data
Training, recovery, body-composition, and wearable metrics can reveal information about your health. We treat that data as sensitive and use it to provide the features you ask for: coaching, readiness, workout recommendations, progress tracking, and accountability. We do not sell health data or use it for advertising.
If you connect a wearable or health provider, like the watch or ring you already wear, REPCIR ingests only the metrics you authorize. You can disconnect providers and delete your account from app settings.
AI processing
REPCIR uses AI model providers (currently OpenAI, called directly through the OpenAI API) to generate coaching responses and training recommendations. We send the model your prompt plus the context needed for that response, such as your goals, recent training, limitations, and coach memory. We use the OpenAI API under terms that do not permit your prompts or coaching conversations to be used to train public models. To keep context across a conversation, conversation state may be retained by OpenAI; we never send raw wearable data.
Data from connected wearables is handled differently. Raw device health metrics are processed only inside REPCIR’s own systems and are never sent to any third-party AI provider; only REPCIR-computed signals (such as a readiness score) inform the coach. See Garmin Connect and other wearables below. AI output can be wrong and is not medical advice.
Garmin Connect and other wearables
If you connect Garmin Connect, REPCIR reads only the health and activity data you authorize through Garmin’s official API — for example sleep, resting heart rate, heart-rate variability, stress, Body Battery, steps, and activity summaries. We use this data to compute your readiness and to tailor your workouts, goals, and progress tracking.
Garmin device-sourced data is collected, used, processed, and stored only within infrastructure that REPCIR owns and controls (our database and our own servers). It is never sold, never used for advertising, and it is never shared with, sent to, or processed by any third-party AI or external data-processing service, including OpenAI. Our AI coach is grounded only in REPCIR-computed signals derived from this data, never in your raw Garmin metrics.
Wherever Garmin data, or insights derived in part from it, appear in REPCIR, we identify the Garmin device as the data source. You can disconnect Garmin at any time from app settings, which deregisters REPCIR with Garmin and stops further collection. If you remove REPCIR from your Garmin account, Garmin notifies us and we stop processing your Garmin data. You can delete your stored data and your account at any time.
Oura and other connected wearables
If you connect Oura, REPCIR reads only the health and activity data you authorize through Oura’s official API — for example sleep, readiness, heart-rate variability, resting heart rate, and activity summaries. The same handling described above for Garmin applies to every wearable you connect.
Wearable device-sourced data is collected, used, processed, and stored only within infrastructure that REPCIR owns and controls. It is never sold, never used for advertising, and never shared with, sent to, or processed by any third-party AI or external data-processing service, including OpenAI. Our AI coach is grounded only in REPCIR-computed signals derived from this data, never in your raw device metrics. Wherever the data, or insights derived in part from it, appear in REPCIR, we identify the device as the source. You can disconnect any provider at any time from app settings, which stops further collection; on disconnect we delete the data stored from that provider.
How we use data
- Operate, secure, and maintain REPCIR.
- Generate personalized coaching, workouts, and progress insights.
- Power circles, messages, posts, public profiles, and visibility controls.
- Process subscriptions, billing, support, and account notices.
- Detect abuse, investigate security issues, and improve the product.
Legal bases (EEA and UK)
If you are in the EEA, the UK, or Switzerland, we rely on the following legal bases to process your personal data. Performance of a contract, to provide the REPCIR features you signed up for. Your consent, for wearable connections, marketing, analytics cookies, and the processing of sensitive health data. Our legitimate interests, to keep REPCIR secure, prevent abuse, and improve the product, balanced against your rights. And compliance with our legal obligations. You can withdraw consent at any time, which does not affect processing that already happened.
Cookies and analytics consent
REPCIR uses a small number of cookies and similar technologies. Strictly necessary cookies keep you signed in, secure the service, and remember core preferences, and these are always on because REPCIR cannot function without them. Analytics and marketing cookies, which help us understand how features are used and measure our campaigns, are set only with your consent.
You can give or withdraw analytics and marketing consent at any time, and manage these choices through your browser settings, your notification preferences, and the analytics and marketing controls in the REPCIR app. Withdrawing consent does not affect strictly necessary processing.
Sharing
We do not sell personal data and do not share it for cross-context behavioral advertising. We disclose data only to users you choose to share with, service providers operating REPCIR for us, legal and safety recipients when required, and successors in a business transfer subject to this policy.
Subprocessors
REPCIR uses vendors for authentication, database hosting, app hosting, AI inference, payments, email, analytics, error monitoring, background jobs, media storage, content moderation, and wearable ingestion. Current providers include Clerk, Neon, Vercel, OpenAI, Upstash, Stripe, Resend, PostHog, Sentry, Inngest, Cloudflare R2 or Vercel Blob, Garmin, and Oura. We provide more detail on request.
International data transfers
We and our subprocessors may process data in the United States and other countries. When we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission Standard Contractual Clauses together with the UK Addendum, or other lawful transfer mechanisms. You can ask us for more detail about these safeguards by emailing privacy@repcir.com.
Your rights and choices
- Access, correct, export, or delete your data where required by law.
- Edit profile, goals, limitations, gallery media, and coach memory in the app.
- Disconnect wearable providers and manage notification preferences.
- Request privacy help by emailing privacy@repcir.com.
US state privacy rights
If you live in California or another US state with a comprehensive privacy law, you have rights to access, correct, delete, and obtain a portable copy of your personal data, and the right not to be treated differently for exercising them. Under California law (CPRA), we do not sell your personal data and do not share it for cross-context behavioral advertising, so there is no such activity to opt out of. We also do not use sensitive personal information for purposes that would require a separate opt-out beyond providing REPCIR. You can exercise your access and deletion rights as described above, or by emailing privacy@repcir.com.
Security and retention
We use encryption in transit and at rest, access-controlled storage, signed media URLs, scoped database access, rate limiting, and monitoring. We keep personal data while your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, or maintain security records.
Children
REPCIR is not directed to children under 13. In the EEA or UK, users must be at least 16 or the local age of digital consent.
Contact
Privacy questions and requests are handled by Quiet Victory Labs at privacy@repcir.com.