The operator of Reppy (the “Service”) handles your personal information as follows.
- If you use only the app, your workout data stays on your device, and the operator does not collect any personal information.
- If you use AI connections, the account you sign in with on the web (Apple or Google) and your workout data are stored on a server in Korea and sent to the AI service you connect.
Using Only the App
The app has no sign-up or sign-in, and it includes no advertising, analytics, or crash reporting tools. The app does not send your workout data off your device, including to the operator’s servers.
- The workout plans, routines, and workout history (including notes) you enter are stored only on your device. The operator cannot see this information.
- If you have device backups (such as iCloud Backup or Google backup) turned on, this information is included in those backups. Backups are between you and Apple or Google, and the operator does not access them.
- Deleting the app also deletes the information stored on your device.
Apple Health and Health Connect
If you allow it, the app writes your finished workouts (type, start time, end time, duration, routine name, and plan name) to the Apple Health app on iPhone, or to Health Connect on Android. The app does not read any data from Apple Health or Health Connect.
- Information written there stays on your device. The app does not send it to the operator’s servers, use it for advertising, or share it with third parties.
- You can turn this off at any time: on iPhone in iOS Settings → Reppy or in the Health app, and on Android in the app’s settings or in Health Connect’s app permissions.
Information Collected When You Use AI Connections
When you connect Reppy from an AI app such as Claude, ChatGPT, or Gemini, you sign in on a web page with your Apple or Google account. The first time you sign in, a Reppy account is created, and the following information is stored on the server.
- Account information: your Apple or Google account identifier, email address (this may be an Apple “Hide My Email” address), your name and profile photo URL if Apple or Google provides them, sign-in times, and a token used to disconnect your Apple or Google sign-in when you delete your account
- Workout data: plans and routines created by the AI (names, exercises, reps and weight per set, rest time)
- Connection information: the name and address of each AI app you connect, the permissions you allowed, and the dates you connected, last used, and disconnected it
- Usage records: call counts (for rate limits), and server logs with the connection identifier, tool name, result type, and time
The app does not have sign-in or sync yet, so your workout history in the app is not uploaded to the server. Your AI conversations and the content that tools send and receive are not kept in server logs.
The connection pages use cookies to carry out sign-in and to keep you signed in (for up to one hour). There are no advertising or analytics cookies. If you block cookies in your browser, you cannot connect.
Purposes of Processing
- Verifying your account and signing you in
- Letting the AI apps you connect read your workout data and create plans and routines
- Managing connections, preventing excessive calls, and investigating errors
- Answering your inquiries
Retention and Destruction
- Account information and workout data: until you delete your account. They are deleted immediately when you do.
- Disconnected connections: deleted 30 days after you disconnect, or immediately when you delete your account.
- Connection tokens: deleted 30 days after they expire.
- Call counts: deleted after two days.
- Server logs: deleted after 30 days.
- Inquiry emails: kept in case of disputes, and deleted within one year after your inquiry is resolved.
Information whose retention period has passed, or that you ask us to delete, is deleted from the database. Server data is backed up daily and backups are kept for 4 days, so deleted information is also gone from backups within 4 days.
Sharing with AI Services (Third-Party Provision and Transfer Abroad)
Only if you consent, the operator sends the result to the AI service you connected each time that AI app calls a Reppy tool. Consent is asked on a consent screen each time you connect, separately from account sign-up.
- Recipients: Claude — Anthropic, PBC (United States); ChatGPT — OpenAI (United States); Gemini — Google LLC (United States). For other AI apps, the recipient shown on the consent screen
- Data: plans, routines and the selected routine; finished workouts (including exercise notes); per-exercise stats (last done, best set, volume). Your email and other account information are not sent.
- Purpose: planning workout routines and reviewing your history in AI conversations
- When and how: sent over the internet (HTTPS) each time the AI calls a tool
- Retention: governed by the recipient’s policy. Once you disconnect, the operator sends nothing more. Conversation content already sent must be deleted in that AI service.
- Your right to refuse: you may decline. If you do, the connection is not made, and you can keep using the app as before.
- How to disconnect: at any time at reppy-api.moseoh.com/connections or in the AI app’s connection settings. Once disconnected, that AI app immediately can no longer read or write.
Processors and Other Transfers Abroad
- Server operation: Oracle Cloud Infrastructure (Korea) — servers and database
- Delivery and security: Cloudflare, Inc. (United States and countries where Cloudflare has edge locations) — relays and protects requests to reppy.moseoh.com and reppy-api.moseoh.com. HTTPS connections end at the nearest edge location, so your IP address and request content pass through it in transit. This happens over the network each time you use the Service, and any retention (none, or short-lived logs) follows Cloudflare’s policy.
- Forwarding inquiry emails: Cloudflare, Inc. (United States) — forwards emails sent to reppy@moseoh.com (sender address and content) to the operator’s mailbox. They are transferred over the internet when you send an email.
- Storing inquiry emails: Google LLC (United States) — the operator’s mailbox (Gmail). Deleted within one year after your inquiry is resolved.
If You Use the Service Outside Korea
The server is located in Korea. If you use AI connections from outside Korea, the account information and workout data described above are transferred from your country to the server in Korea, where they are stored and processed. If you do not want this, do not use AI connections; you can keep using the app as before.
Children Under 14
Children under 14 may not use AI connections. If we learn that an account belongs to a child under 14, we will delete the account and its data. Using only the app collects no information, so anyone can use the app regardless of age.
Your Rights
- You can ask to access, correct, or delete your personal information, or to stop its processing. Email reppy@moseoh.com and you will get a reply within 10 days.
- If you ask to delete your account, your account information, workout data, and all AI connections are deleted, and your Apple or Google sign-in is disconnected.
- You can disconnect AI connections yourself as described in “How to disconnect” above.
Security Measures
- All communication with the server uses HTTPS only.
- Connection tokens are stored as hashes, not in their original form, and tokens used to disconnect Apple or Google sign-in are stored encrypted.
- An AI can see only the workout data allowed for its connection and cannot see account information. AI apps cannot delete plans, routines, or workouts.
- Excessive calls are limited.
Privacy Officer and Contact
Privacy officer: the Reppy operator (an individual developer) · reppy@moseoh.com
You can report or seek advice on privacy violations to the Personal Information Infringement Report Center of Korea (privacy.kisa.or.kr, 118 within Korea) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
Changes to This Policy
If this policy changes, the change will be announced on this page and the effective date updated. If features that send data from your device to the server, such as sign-in or sync, are added to the app, this policy will be revised before those features are released. The previous policy is available here.