Replaro Privacy Policy
Last updated: September 6, 2026
Data controller: Süleyman Çakar, Gemlik / Bursa, Türkiye, destek@replaro.app
Draft. Fill in the bracketed fields and have it reviewed by a privacy professional before publishing (see
docs/legal/README.md).
Replaro is a mobile app for workout tracking and training programs. This policy explains what data we process, why, where, for how long, and what your rights are.
1. Data we collect
| Data | Source | Purpose | Required |
|---|---|---|---|
| Email address, password (hashed by Firebase only) | Sign-up | Account, sign-in, password reset | Yes |
| Display name | Profile | Greeting in the app | No |
| Training preferences (goal, level, environment, weekly frequency, unit system) | Onboarding / Profile | Program recommendation, display | Yes (goal/level/environment/frequency) |
| Workout templates, sessions, sets (reps, weight, duration, distance, RIR/RPE, notes) | Use | Tracking, progression suggestions, records | By use |
| XP, level, streak, badges, credit ledger | Derived on the server | Gamification | By use |
| Weight records, body measurements, progress photos, target weight, height | Progress tab | Progress tracking and comparison | No — explicit consent only |
| Nutrition logs, water intake, personal food library | Progress tab | Nutrition/hydration tracking | No |
| Excluded exercises, favorites | Use | Personalization | No |
| Premium status, purchase information | RevenueCat / store | Access to premium content | If you purchase |
| Language and theme preference | Device | Stored on device only | No |
We do not collect: location, contacts, advertising ID, device-ID tracking, third-party analytics, crash reports. The app does not track you across apps or websites.
2. Health data and explicit consent
Weight, body measurements and progress photos may qualify as special-category (health) data (GDPR Art. 9; Turkish KVKK Art. 6). They are processed only if you give a separate explicit consent in the app. Without it the Progress tab stays off and workout tracking is unaffected. You can withdraw consent anytime under Profile → Privacy & data; screens close, existing data is not deleted (export it or delete your account if you wish).
Health data is never used for advertising, marketing or profiling; no automated body analysis is run on photos.
3. Where data is stored; international transfer
Data is stored on Google LLC's Firebase infrastructure (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions). The Firestore location is europe-west1 (Belgium, EU). Your data is therefore processed on servers that may be outside your country. Legal basis for transfer: your explicit consent (in-app statement) and Google's standard contractual clauses / adequacy decisions. Data is encrypted in transit and at rest.
4. Third parties
| Party | Role | Data shared |
|---|---|---|
| Google Firebase (Google LLC) | Hosting, auth, database, file storage, server functions | All data in Section 1 |
| RevenueCat, Inc. | Subscription/purchase management | Anonymous user id, purchase status |
| Google Play / Apple App Store | Payment processing | Payment details (never reach us) |
We do not sell your data or share it with ad networks.
5. Retention
Data is kept while your account exists. When you delete your account, the profile, all sub-records (workouts, progress, photos, gamification) and the authentication record are permanently deleted on the server; backups are purged within 30 days.
6. Your rights
Under GDPR Art. 15–22 (and KVKK Art. 11): access, rectification, erasure, restriction, portability and objection. In the app: - Export my data (Profile → Privacy & data): JSON copy of all your data - Delete my account: irreversible full deletion - Withdraw consent: stop health-data processing
Other requests: destek@replaro.app. We answer within 30 days. You may lodge a complaint with your local supervisory authority (in Türkiye: KVKK Board).
7. Children
Replaro is not intended for anyone under 16; we do not knowingly collect data from children under 16. Such accounts are deleted when identified.
8. Security
Access rules are enforced on the server (only the account owner can read their data), XP/credit/membership values cannot be modified by the client, transport is TLS-encrypted, passwords are stored hashed.
9. Medical notice
Replaro is not a medical device; it does not diagnose, treat, or replace medical advice. Consult your doctor before starting an exercise program.
10. Changes
Changes are announced in the app and the "last updated" date is revised; material changes require renewed acceptance.
Contact: destek@replaro.app