Privacy Policy

Last updated: August 11, 2026

Code Works OOD ("we", "our", or "us"), a company registered in the Republic of Bulgaria, operates the RepXP mobile application ("the app"). This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have regarding your data.

By using RepXP, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the app.

1. Data Controller

The data controller responsible for your data is:

Code Works OOD
Sofia, Republic of Bulgaria
Email: support@repxp.app

2. Data We Collect

RepXP is designed with privacy at its core. We minimise data collection and do not operate our own servers for storing your personal data.

2.1 Data Stored Locally on Your Device

All of your workout data (including exercise history, sets, reps, weights, personal records, body measurements, and progress information) is stored locally on your device using Apple's secure data storage. We do not have access to this data.

2.2 Data Synced via iCloud

If you have iCloud enabled, your workout data syncs across your Apple devices through your personal iCloud account. This data is stored by Apple in your iCloud container. We do not have access to the contents of your iCloud data. iCloud sync is governed by Apple's iCloud Terms and Apple's Privacy Policy.

2.3 Apple HealthKit Data

If you grant permission, RepXP can read and write health-related data to Apple Health via the HealthKit framework. Reads include workouts, body measurements, and, for cardio heart rate zones, your heart rate and resting heart rate. Writes include completed workouts along with their active energy and distance. This data is stored on your device and in your iCloud Health data. We do not collect, transmit, or have access to your HealthKit data. HealthKit data is never used for advertising or shared with third parties. This data is governed by Apple's privacy policies.

2.4 Anonymous Analytics and Crash Data

We collect anonymous, non-personally-identifiable data through Google Firebase to help us understand how the app is used and to identify and fix bugs. This data includes:

  • Device type and model
  • Operating system version
  • App version
  • General usage patterns (e.g., which screens and features are used most frequently)
  • Crash logs, error reports, and performance traces
  • Anonymous session data (session duration, session start)

This data does not include your workout details, exercise names, weights, reps, body measurements, or any information that could personally identify you.

2.5 Push Notification Data

RepXP uses Firebase Cloud Messaging and Apple's Push Notification service to deliver optional announcements and rare critical service notices. When the app launches, these services can generate a registration token for that app installation and associate it with notification topics. The token is a pseudonymous technical identifier used only to route notifications. It does not contain your name, email address, workout history, exercise data, HealthKit data, or body measurements.

iOS controls whether notifications are displayed. You can deny or revoke notification permission in system settings, and you can turn regular RepXP announcements off in the app. Disabling regular announcements removes the installation from that topic. Uninstalling the app invalidates the installation's ability to receive notifications.

2.6 Data We Do Not Collect

We do not collect:

  • Your name, email address, or phone number (no account registration is required), unless you choose to send it to us, for example by emailing support or submitting an import request (see section 2.8)
  • Your location data
  • Your contacts, photos, or other personal files
  • Your workout history, exercise data, weights, reps, or personal records
  • Any HealthKit data beyond what you explicitly permit

2.7 Apple Ads Attribution Data

If you installed RepXP after seeing one of our ads on the App Store, Apple provides us with anonymous information about that ad, using Apple's own AdServices framework. This may include:

  • The campaign, ad group, keyword, and ad the install is attributed to
  • Where the ad appeared on the App Store
  • The country or region of the App Store account
  • Whether the install followed a tap or a view of the ad

We attach this campaign information to a small number of anonymous analytics events, such as completing your first workout or starting a subscription, so we can tell which ads bring us people who find RepXP useful. It is not linked to your identity, and the attribution token Apple issues is exchanged once and never stored or sent to Firebase.

This is Apple's standard, privacy-preserving attribution. It does not identify you, it does not follow you across other companies' apps or websites, and it therefore does not require an App Tracking Transparency prompt. If you did not arrive from one of our ads, no campaign information exists and none is collected.

2.8 Information You Send Us Directly

If you contact us by email (for example, our support address or the in-app "request an importer" option on the import screen), we receive whatever information you choose to send. This may include your email address and the contents of your message.

If you use the import request feature and choose to attach an export file from another app, that file may contain your workout history. Attaching a file is entirely optional, and the request is only sent when you send the email from your own mail app. We use this information solely to respond to you and, for import requests, to build or calibrate support for importing from the app you named. We do not use it for advertising or profiling, and we do not sell or share it. We keep this correspondence only as long as needed to handle your request, and we delete any attached export files once the relevant import work is complete.

3. How We Use Your Data

The limited analytics, diagnostics, attribution, and notification delivery data described above is used solely to:

  • Improve the app: Understand which features are used most and how the app can be improved.
  • Fix bugs: Identify crashes and errors so we can release fixes promptly.
  • Monitor performance: Ensure the app runs smoothly across different devices and OS versions.
  • Measure our own ads: Understand which of our App Store ads lead to people who actually use RepXP, using the anonymous campaign information described in section 2.7.
  • Deliver notifications: Route optional announcements and rare critical service notices to app installations through Firebase Cloud Messaging and Apple's Push Notification service.

Separately, if you voluntarily contact us or submit an import request, we use the information you send only to respond to you and to build or calibrate the relevant importer, as described in section 2.8.

We do not sell your data, share it with data brokers, or build advertising profiles about you, and we never use your workout data for advertising. The only advertising-related data we hold is the anonymous Apple Ads campaign information in section 2.7, and we use it solely to measure the effectiveness of our own ads.

4. Lawful Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we rely on the following lawful bases for processing data:

  • Legitimate Interest (Article 6(1)(f)): We process anonymous analytics and crash data to improve the app, fix bugs, and understand usage patterns. We also process a pseudonymous installation token to deliver the notification service described in section 2.5. This processing is limited to those purposes and does not include workout or HealthKit data.
  • Consent (Article 6(1)(a)): Where required by applicable law, we obtain your consent before processing. This also covers information you voluntarily send us, such as support messages and import requests, which you initiate and send from your own mail app. You can manage your device-level analytics and tracking preferences at any time through your device settings.
  • Contract Performance (Article 6(1)(b)): Processing necessary to provide the app's core features, including local data storage and iCloud synchronisation functionality.

5. Data Retention

We retain data only as long as necessary for the purposes described in this policy:

Data Type Retention Period
Local workout data Stored on your device until you delete it or uninstall the app
iCloud synced data Stored in your iCloud account until you delete it; governed by Apple's policies
HealthKit data Stored on your device and in iCloud Health; governed by Apple's policies
Support and import request emails Kept only as long as needed to resolve your request; any attached export files are deleted once the relevant import work is complete
Firebase Analytics data 14 months from collection, then automatically deleted by Google
Firebase Crashlytics data 90 days from collection, then automatically deleted by Google
Firebase Performance data 90 days from collection, then automatically deleted by Google
Push notification registration token Maintained by Firebase and Apple while the app installation is registered for push delivery; tokens can rotate or become invalid

6. Third-Party Services

RepXP uses the following third-party services. Each service has its own privacy policy governing how it handles data:

  • Google Firebase (Analytics, Crashlytics, Performance, Remote Config, Cloud Messaging): Used for anonymous usage analytics, crash reporting, performance monitoring, feature configuration, and push notification delivery. Cloud Messaging processes the pseudonymous installation token described in section 2.5. Data is processed by Google. See Google's Privacy Policy and Firebase Privacy Information.
  • Apple iCloud (CloudKit): Used for syncing workout data across your devices. Data is stored in your personal iCloud account and processed by Apple. See Apple's iCloud Terms.
  • Apple HealthKit: Used for reading and writing health data with your permission. Data is processed locally and by Apple. See Apple's Privacy Policy.

We are not responsible for the privacy practices of these third-party services. Any data stored, processed, or lost by these third-party services is governed by your agreement with those providers, not by this Privacy Policy. We encourage you to review their respective privacy policies.

7. International Data Transfers

Anonymous analytics, crash data, and the pseudonymous push registration token processed through Firebase may be transferred to and processed on Google's servers, which may be located outside the European Economic Area (EEA). Google maintains appropriate safeguards for such transfers, including the use of Standard Contractual Clauses (SCCs) approved by the European Commission. For more information, see Google's data transfer frameworks.

Your local workout data and iCloud data are handled by Apple in accordance with their own data transfer policies and safeguards.

8. Tracking Technologies

RepXP does not use cookies, web beacons, or browser-based tracking technologies within the app.

Firebase Analytics uses a unique, anonymous app instance identifier to associate events with a single app installation. This identifier:

  • Is not linked to your personal identity
  • Is not shared with other apps
  • Is reset if you uninstall and reinstall the app
  • Can be reset through your device settings

Firebase Cloud Messaging and Apple's Push Notification service use a registration token to route notifications to this app installation. RepXP does not use that token to track activity across apps or websites.

Where an install is attributed to one of our App Store ads, Apple's AdServices framework supplies the anonymous campaign information described in section 2.7. This is Apple's own attribution mechanism, it carries no cross-app identifier, and Apple does not classify it as tracking.

We respect Apple's App Tracking Transparency (ATT) framework. RepXP does not track you across other companies' apps or websites.

9. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR:

  • Right of Access (Article 15): You have the right to request information about whether we process your personal data and to obtain a copy of that data.
  • Right to Rectification (Article 16): You have the right to request correction of inaccurate personal data.
  • Right to Erasure (Article 17): You have the right to request deletion of your personal data, subject to applicable legal exceptions.
  • Right to Restriction of Processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances.
  • Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Object (Article 21): You have the right to object to our processing of your personal data based on legitimate interests.
  • Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Since we do not collect personal data on our own servers, most of these rights are already satisfied by design. Your workout data is stored locally on your device and in your personal iCloud account, and you have full control over it at all times. You can delete your data by using the app's data management features, clearing iCloud storage, or uninstalling the app.

Regarding analytics data: the analytics and diagnostics we collect through Firebase are not connected to an account or workout data. The push registration token is pseudonymous installation data rather than anonymous data, but we do not have an account or identity record that lets us connect it to you. To stop notification delivery, disable notifications in iOS and uninstall the app. To ask a question or exercise a right that may apply to Firebase data, contact us using the address below.

If you have any questions or concerns about your data rights, contact us at support@repxp.app. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. The relevant authority in Bulgaria is the Commission for Personal Data Protection (CPDP): www.cpdp.bg.

10. Your Rights Under CCPA

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • Right to Know: You have the right to know what personal information we collect, use, disclose, and sell.
  • Right to Delete: You have the right to request that we delete your personal information, subject to certain exceptions.
  • Right to Opt-Out of Sale: You have the right to opt out of the sale of your personal information.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

We do not sell, share, or rent your personal information to third parties. Firebase analytics and the push registration token are used only for the operational purposes described in this policy and are not sold or shared for cross-context behavioural advertising.

If you have questions about your CCPA rights, contact us at support@repxp.app.

11. Children's Privacy

RepXP is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, please do not use the app.

RepXP does not require account registration and does not collect age, names, email addresses, or workout data through Firebase. Firebase may process anonymous diagnostics and the pseudonymous installation token described in section 2.5. If you are a parent or guardian and have concerns, please contact us at support@repxp.app. We can advise on how to remove locally stored data and stop future Firebase processing from the device.

12. Data Security

We take the security of your data seriously. The measures in place include:

  • Local Storage: Your workout data is stored on your device using Apple's secure data storage frameworks, protected by your device's built-in encryption and passcode.
  • iCloud: Data synced via iCloud is encrypted in transit and at rest by Apple.
  • Firebase: Data transmitted to Firebase is encrypted in transit using HTTPS/TLS. Google applies its own security measures to data at rest.
  • No Server: We do not operate our own backend servers, which significantly reduces the attack surface for your data.

While we implement appropriate safeguards, no system is completely secure. We cannot guarantee the absolute security of your data.

13. Data Breach Notification

We do not store workout or HealthKit data on our own servers. Your workout data is stored locally on your device and optionally in your personal iCloud account. Firebase processes anonymous diagnostics and a pseudonymous installation token for push delivery.

We cannot identify users from an account because RepXP has no account system. If we become aware of a security incident affecting the Firebase data described in this policy, we will:

  • Notify the relevant supervisory authority (the Commission for Personal Data Protection in Bulgaria) within 72 hours, as required by GDPR Article 33, if the incident involves any data that may be considered personal data.
  • Publish a notice on our website and, where practicable, within the app to inform users of the incident and any recommended actions.
  • Document the incident, its effects, and the remedial actions taken.

A breach affecting your personal workout data would most likely originate from Apple's or Google's infrastructure, as those are the services that store and process your data. In such cases, those companies would be responsible for notification under their own legal obligations.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the app's functionality. When we make material changes, we will:

  • Update the "Last updated" date at the top of this page.
  • Where practicable, notify you through the app.

We encourage you to review this Privacy Policy periodically. Your continued use of the app after changes are posted constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the app.

15. Contact Us

If you have any questions about this Privacy Policy, want to exercise your data protection rights, or have a privacy-related concern, please contact us at:

support@repxp.app

Code Works OOD
Sofia, Republic of Bulgaria

We will respond to all privacy-related inquiries within 30 days.