Privacy Policy

Effective date: November 6, 2026

This policy says what RepStreak collects, how we use it, and how you can get a copy or delete it. RepStreak is a home-workout fitness app with a free plan and a Pro plan. It is available on the web at repstreakapp.com and as an Android app on Google Play. This policy covers both.

Who we are

RepStreak is operated by Mako Media. This policy is governed by the laws of Florida, USA.

What we collect

We collect the account, settings, fitness activity, purchase, and security information below. An account is optional: in guest mode your log stays on your device, as described at the end of this section.

Account. If you create an account, we store:

• Your email address
• Your display name
• An optional bio
• Your password, stored only as a salted hash
• Optional passkeys. We store the public key credential only. Fingerprint, face and other biometrics never leave your device.
• Your RepStreak account ID
• Your plan (free or Pro), where it came from, and when a subscription period ends
• The date the account was created

Settings. We store:

• The goal and level you chose in onboarding
• Your equipment list
• Your units
• Your reminder time and notification preference
• A device push token, if you use the Android app signed in, so we can send streak and challenge alerts. You can turn these off in Profile > Notifications
• Help and tour flags, which record whether you have seen that help and tour
• Saved workouts and Today ordering

Fitness activity. Your workout log is fitness information. We store:

• Exercises, routines, and daily goals
• Rep logs by day, and rest days
• Guided workout sessions and logs
• Challenges you join or host, and challenge logs
• Badges

If you host or join a challenge, other members of that challenge can see your display name and your progress in it.

Purchases (Android). If you subscribe to RepStreak Pro in the Android app, Google Play processes the payment. We use RevenueCat (RevenueCat, Inc.) to confirm and manage your subscription. RevenueCat receives:

• Your RepStreak account ID (you must be signed in to subscribe)
• Purchase details from Google Play: the product (RepStreak Pro monthly or yearly), purchase date, expiry, renewal and trial status, price and currency, country, and the purchase token
• Basic device and app information, such as OS version, app version and language

We and RevenueCat never receive your full card number or bank details. Google handles those under the Google Payments Privacy Notice. RevenueCat's privacy policy: https://www.revenuecat.com/privacy

Android app.

• Permissions. The Android app uses Internet access to sync your log. It uses notifications (POST_NOTIFICATIONS) for your daily reminder and for optional streak and challenge alerts, if you allow them. "Run at startup" and wake lock are used to keep the daily reminder scheduled after a restart. SCHEDULE_EXACT_ALARM is used so the daily reminder can fire at the time you pick when the system allows exact alarms. Google Play Billing is used for Pro subscriptions.
• The daily reminder is a local notification scheduled on your phone by the app. Streak-at-risk and challenge alerts are push notifications sent through Firebase Cloud Messaging (Google). We store a device push token for that. You can turn push alerts off in Profile > Notifications, and you can turn the daily reminder off there as well.
• The app does not request location, contacts, camera, microphone, photos, files or Health Connect data.

Security and cookies. We store:

• A session cookie. It is HttpOnly and lasts about 180 days.
• A remember-me token cookie. We store only a hash of the token.
• Your IP address, used briefly for sign-in and password-reset rate limiting, in short-lived attempt records
• Email-change, email-confirmation and password-reset tokens

Guest mode. You can use RepStreak without an account. In guest mode, your log is stored only on your device (in the browser's or app's local storage). It is not sent to our servers unless you create an account and the guest data is moved to it. Clearing browser or app data, or uninstalling the app, deletes it.

How we use it

We use this information only to run RepStreak:

• To create your account and sign you in with the session cookie, the remember-me cookie, or a passkey
• To save your settings, reminder time, notification preference, saved workouts and Today order
• To keep your exercises, routines, goals, rep logs, rest days, guided workout sessions, challenges and badges, and to calculate your streaks and stats
• To show your display name and progress to other members of a challenge you host or join
• To schedule your daily reminder on your phone (Android app, local)
• To store a device push token and send optional streak-at-risk and challenge alerts through Firebase Cloud Messaging. You can turn these off in the app
• To unlock Pro when Google Play and RevenueCat confirm an active subscription, to switch you back to Free when it ends, and to restore it on a new phone
• To rate-limit sign-in and password-reset attempts, using your IP address briefly
• To send account emails: email confirmation, password reset, and email-change confirmation and notices

Sharing and third parties

We do not sell your information or share it for advertising. We use these service providers, and we share only what each one needs:

• Challenge members. If you host or join a challenge, other members of that challenge can see your display name and your progress in it.
• Google Play. Google processes Android purchases and refunds under its own terms and privacy notice. Google also gives us aggregated crash and performance reports through Google Play Console. These contain no account data.
• RevenueCat. RevenueCat manages subscription status for us, as described under Purchases. It acts as our service provider.
• Firebase Cloud Messaging (Google). If you use the Android app signed in and leave push alerts on, we send your device push token to Google so the alert can be delivered. Google's privacy policy: https://policies.google.com/privacy
• Google Fonts. The web app and the Android app load fonts from fonts.googleapis.com and fonts.gstatic.com. When the fonts load, Google receives your IP address and browser or device information.
• Email delivery. Account emails are sent through our email delivery provider, which receives your email address and the message.
• Exercise videos and images. These are hosted on our own server at repstreakapp.com.
• Hosting. The app and its database are hosted on Amazon Web Services (AWS) in the United States.
• Payments on the web. We do not take payment on the website. Pro is sold in the Android app through Google Play.

No ads, analytics, or selling

We do not show ads. We do not use analytics or tracking pixels. The Android app contains no advertising SDKs, no third-party analytics SDKs and no crash-reporting SDKs. We do not sell your information.

Email

Email is transactional only: email confirmation, password reset, and email-change confirmation and notices. We do not send marketing email.

Retention

• We keep your account, settings and fitness activity while your account exists. Deleting the account permanently deletes that data.
• The session cookie lasts about 180 days. Sign-in attempt records with your IP address are kept only as long as needed for rate limiting. Confirmation and reset tokens expire after use.
• Subscription records are kept while your subscription is active, and afterwards as required for tax, accounting and fraud prevention, generally up to 7 years. Google Play keeps its own records under its policies.
• Guest-mode data and local reminders stay on your device until you clear the log, turn reminders off, clear browser or app data, uninstall the app, or create an account and move the data there.

Your rights

• Access. Anyone can ask for a copy of their data by email.
• Export. Pro users can export their reps as CSV in the app. Anyone can also ask by email for a copy.
• Correction. Email us and tell us what is wrong. You can ask us to correct inaccurate information we hold.
• Deletion. See Account deletion below. In guest mode you can clear the device log in the app.
• How to request. Email support@repstreakapp.com from the email on your account, and say whether you want a copy, a correction, or deletion.

Account deletion

You can delete your account at any time:

• In the app or on the web: Profile > Delete account, then type DELETE to confirm. This immediately and permanently deletes your account and its data, including your logs, routines, hosted challenges, passkeys and sign-in tokens. We also delete your subscriber record at RevenueCat. Details: https://repstreakapp.com/delete-account.html
• By email: if you can't sign in, email support@repstreakapp.com from your account email with the subject "Delete my account". We confirm and delete within 30 days.

Deleting your account does not cancel a Google Play subscription. Cancel it in Google Play > Payments & subscriptions first, so that you aren't charged again. Google keeps its own purchase records.

Age requirement

RepStreak is intended for adults aged 18 and over. It is not directed to children, and we do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.

Security

All data is encrypted in transit with HTTPS. Passwords are stored only as a salted hash. Passkeys are stored as a public key credential only, and biometrics never leave your device. The session cookie is HttpOnly, and remember-me tokens are stored only as a hash.

International users

Data is stored in the United States, where Amazon Web Services hosts the app. If you use RepStreak from outside the United States, your information is transferred to and stored in the United States.

Changes

We may update this policy. We will post the new version on this page and change the effective date at the top.

Contact

Email support@repstreakapp.com. The operator is Mako Media. This policy is governed by the laws of Florida, USA.