Privacy Policy

1. Who we are

REP (getrep.app and the REP mobile app) is a coaching platform where coaches and athletes create workout plans, track training, and communicate. It is operated by Moonbase Digital OÜ, a private limited company registered in Estonia (registry code 17165709), Kuldnoka tn 15-17, 10619 Tallinn, Estonia ("Moonbase Digital", "we", "us").

Moonbase Digital OÜ is the data controller for the personal data described in this policy. For any privacy question or request, contact us at privacy@getrep.app.

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

2. Data we collect

Account and profile data:

• Name, email address, date of birth, and gender, provided when you create an account. If you sign in with Apple or Google, we receive the name and email associated with that account.
• An optional profile photo.
• For athletes: height and a history of body-weight entries.
• For coaches: your public coach profile, including your name, description, certifications, services, and locations.

Health and wellbeing data (special-category data under Article 9 GDPR):

• Your answers to the athlete onboarding questionnaire: training experience and habits, injuries or physical limitations, sleep, stress and how you cope with it, fitness self-assessments, and training goals.
• Pre-workout check-ins: self-reported mood, sleep, energy, eating, and motivation.
• Post-workout feedback: muscle and joint pain ratings and free-text comments.

Training data: workout plans, sessions, exercises, sets, weights, reps, effort ratings, completion times and timezone, and notes and comments written by you or your coach.

Messages and media: chat messages and attachments you exchange with your coach or athletes, and images or videos you upload.

Billing data (for paying customers): billing name and contact details, address, company registration and VAT numbers where applicable, invoice and payment history, and card metadata (brand, last four digits, expiry). Your full card number never reaches our servers — it is collected and stored directly by Stripe.

Device and notification data: push notification tokens, device platform and app version, and a log of notifications we have sent you, which can include chat message previews.

Usage data: analytics events about how the product is used (pages viewed, features used, device and browser type), error and performance reports, and technical logs including IP addresses.

AI interaction data: your conversations with Coach G, our AI assistant, including the questions you ask and the answers you receive.

3. Why we process your data, and on what legal basis

• To provide the service — storing your training data, syncing it between you and your coach, delivering messages and notifications, and processing payments. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• To process health and wellbeing data and to use it in AI-assisted planning — legal basis: your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR), which you give in the onboarding questionnaire and can withdraw at any time.
• To keep the service secure and reliable — monitoring for errors, abuse, and outages. Legal basis: our legitimate interest in operating a secure service (Article 6(1)(f) GDPR).
• To understand and improve the product — usage analytics. Legal basis: our legitimate interest in improving REP, and consent where required for cookies and similar technologies.
• To meet legal obligations — in particular keeping accounting records such as invoices, as required by the Estonian Accounting Act. Legal basis: legal obligation (Article 6(1)(c) GDPR).

We do not sell your personal data, and we do not use your data for third-party advertising.

4. AI features (Coach G)

REP includes AI-assisted features: draft training plans, weekly insights for coaches, and the Coach G chat assistant. These features are powered by OpenAI, acting as our data processor.

When you or your coach use an AI feature, we send OpenAI the context it needs to produce a useful result. Depending on the feature, this can include your first name, your training plan and workout history (exercises, sets, weights, reps, effort ratings), your notes and workout comments, your wellbeing check-ins and pain ratings, and — only if you have given explicit consent in the onboarding questionnaire — your onboarding answers, including injury and health information.

AI outputs are suggestions. Training plans proposed by AI are reviewed and approved by a human coach before they reach you. Under our agreement with OpenAI, data sent through its API is not used to train OpenAI models.

You can use REP without the AI features, and you can withdraw your AI consent at any time in the app or by contacting us.

5. Who can see your data inside REP

REP is a coaching platform, so sharing between connected users is core to the service: your coach can see your profile, training data, wellbeing check-ins, workout feedback, and messages you send them; your athletes can see the plans, notes, and messages you share with them.

Coach profiles (name, description, certifications, services, locations) are visible to users browsing for a coach.

A small number of Moonbase Digital administrators can access data where necessary to operate the service and provide support.

6. Service providers (data processors)

We use a small number of service providers to run REP. They process personal data only on our instructions and under data processing agreements:

• Hetzner Online GmbH (Germany) — application hosting and databases, located in Helsinki, Finland (EU).
• Cloudflare, Inc. (US) — content delivery, DNS, web hosting, and media storage; uploaded media is stored in Western Europe.
• Stream.io, Inc. (US) — in-app chat infrastructure; chat messages and attachments are stored by Stream.
• Stripe Payments Europe, Ltd. (Ireland) — payment processing and card storage.
• Merit Aktiva (Merit Software OÜ, Estonia) — invoicing and accounting; Merit also delivers invoices to your billing email.
• OpenAI (US/Ireland) — AI features, as described in section 4.
• Resend (US) — transactional email, such as invites and billing notices.
• Functional Software, Inc. (Sentry, US) — error and performance monitoring, using EU-based data ingestion.
• Google (US/Ireland) — Google Analytics for web analytics, Firebase Cloud Messaging for Android push notifications, and Google Fonts.
• Apple Inc. (US) — iOS push notifications.
• Giphy (US) — GIF search in chat, used only when you search for a GIF.

7. International transfers

Your data is primarily stored in the EU (Finland and Western Europe). Some of the providers listed above are based in the United States or process data there. Where personal data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

8. How long we keep your data

We keep your personal data while your account is active.

When you delete your account (available in the app) or ask us to delete it, we delete your sign-in identity, name, email address, and profile photo, and disconnect your identity from the account. Training records connected to your former coach or athletes are retained in de-identified form, and messages you sent may remain visible to the people you exchanged them with, as is usual for messaging services.

Invoices and related billing records are kept for seven years after the end of the financial year, as required by the Estonian Accounting Act.

Encrypted database backups are kept for up to 30 days, after which deleted data also disappears from backups.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Correct inaccurate or incomplete data.
• Have your data deleted ("right to be forgotten").
• Restrict or object to processing based on our legitimate interests.
• Receive the data you provided in a portable, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, email privacy@getrep.app. We respond within one month.

If you believe we have mishandled your data, you can lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or with the supervisory authority in your own EU member state.

10. Cookies and similar technologies

We use first-party cookies and browser storage that are strictly necessary for the service: authentication session cookies set by our sign-in service (auth.getrep.app), a cookie that remembers that you are signed in, and cookies and local storage that remember interface preferences.

With your consent where required, we also use analytics cookies and identifiers from Google Analytics to understand how REP is used. Stripe sets cookies needed for secure payment processing when you use billing features.

You can remove cookies at any time through your browser settings.

11. Security

All data is encrypted in transit using TLS. Access to production systems is restricted to authorized personnel over a private network, databases are not exposed to the public internet, and backups are stored in the EU. No online service can guarantee absolute security, but we work to protect your data with appropriate technical and organizational measures.

12. Children

REP is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child under 16 has created an account, contact us and we will delete it.

13. Changes to this policy

We may update this policy as REP evolves. If we make material changes, we will notify you in the app or by email before they take effect. The date at the top shows when this policy was last revised.

14. Contact

Moonbase Digital OÜ, registry code 17165709, Kuldnoka tn 15-17, 10619 Tallinn, Estonia.

Privacy questions and requests: privacy@getrep.app. General support: support@getrep.app.