Privacy Policy

Camera & pose data

Pose detection (rep counting, form scoring) runs entirely inside your browser using on-device WASM — your video frames and body-position data never leave your device for scoring, and REPPED's servers never receive them. During a live battle, your video streams peer-to-peer (WebRTC) directly to your opponent only; our servers relay connection signaling, never the video stream itself. Nothing is recorded or stored by us. Only the final numeric result (score, rep count, exercise) reaches our database.

What we collect

Registered users: email address, chosen username, password (hashed, via Supabase Auth), Elo, match history (scores, reps, exercise, results), and unlocked rewards.

Guests:stats live only in your browser's localStorage and never reach a server — clearing your browser data erases them completely.

Automatically, for anyone: standard server logs (IP address, user agent) used for basic rate limiting and abuse prevention, retained briefly and not linked to your gameplay data.

Cookies & advertising

REPPED uses Google AdSense to display ads (never during the 30-second battle). Google, as a third-party vendor, uses cookies — including the DoubleClick/advertising cookie — to serve ads based on your visits to this and other sites. You can opt out of personalized advertising by visiting Google Ads Settings, or generally at aboutads.info/choices. We also use a strictly necessary cookie for signed-in sessions (Supabase Auth). See our Cookies Policy for the full list.

Who we share data with

We use third-party infrastructure providers to run REPPED: Supabase (database and authentication), Vercel (hosting), and Google AdSense (advertising). Each processes data on our behalf under their own security and privacy terms; we do not sell your personal data to anyone.

Your rights (GDPR & similar laws)

If applicable in your region, you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact privacy@repped.fun. Guests can simply clear their browser's localStorage for immediate, complete deletion — no request needed since we never received that data in the first place.

Data retention

We keep registered-user account and match data for as long as your account is active. If you delete your account, associated personal data is removed from our production database (some data may briefly persist in backups before rotating out).

International transfers

Our infrastructure providers (Supabase, Vercel, Google) may process data on servers outside your country, including outside the EU/EEA. Where required, such transfers rely on those providers' standard contractual clauses or equivalent safeguards.

Children

REPPED is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we'll remove it.

Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected by updating the "Last updated" date above.

Contact

Questions about this policy or your data? privacy@repped.fun