1. Controller
The party responsible for data processing in this app under the GDPR:
Wayil Ziane, c/o flexdienst – #22205, Kurt-Schumacher-Straße 74, 67663 Kaiserslautern — kontakt@wayil-dev.de
2. In short
Repborne is built so that as little data as possible leaves your device. The camera feed, your body data from the assessment and your body weight stay on your iPhone only — we never see them. To play you need an account (Repborne is for ages 16 and up). For it we store a small online profile (player name, trophies, friendships, duels) so that the leaderboard and duels can work, a private backup of your game progress so you get it back on a new device, and — only if you pick one — a scaled-down, automatically checked copy of your own profile photo that other players can see (section 5). There are no ads, no tracking and no analytics services.
3. Data on your device
The app stores the following locally on your device (in the app’s own storage). Your assessment, body weight and settings never leave the device. A profile photo of your own only leaves it if you choose one for your player profile (see section 5). The app additionally backs up your game progress and training history (without calorie estimate and body weight) to your account — see section 5. On the device:
Assessment from onboarding: age, height, body weight, gender, current complaints (shoulder, wrist, knee, ankle, back), training experience, training days per week, motivation, goal, self-assessment, the result of the camera test (number of repetitions) and the range of motion measured during it. From this the app only derives how many repetitions a level costs you and roughly how many calories a set burns. These entries — especially weight, height and complaints — are health data under Art. 9 GDPR. They are processed locally only and never transmitted.
Training history: repetitions per day, streak, calorie estimate, the body weight set in the options for the calorie formula, personal records and your match history (date, result, repetitions, opponent name).
Game progress: experience, level, coins, gems, items, skills, stars, trophies (RP), achievements, titles, purchased frames, tutorial progress.
Settings: language, volume, vibration, camera side, reminder time, subscription status (cache).
Profile photo: if you pick a photo from your library, the app scales it down to 256 × 256 pixels and stores it locally. The app also uploads a 160 × 160 pixel copy so other players can see it — details in section 5.
The time of your camera consent during onboarding (as a record, locally).
Via Settings → Data → “Delete all data” you can remove all of this at any time, including any stored sign-in session and — if present — the save backup and your profile picture in your account. Note: like other app data, these entries may be part of your iCloud or computer backup; you control that in iOS Settings, not us.
4. Camera & motion detection
To count push-ups, the app analyses the camera feed directly on your device. The body-point model (MediaPipe Pose Landmarker) ships inside the app and is not downloaded from the internet. Nothing is recorded, stored or sent to a server — no images, no video, no detected body points. When you leave the workout screen, the image is gone. The microphone is never requested.
The camera is used only after your consent during onboarding; you can revoke access at any time in iOS Settings. Without camera access, repetitions cannot be counted; every other part of the app remains usable.
The legal basis for this local processing is your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR).
5. Account
You need an account for Repborne — it keeps your progress, rank and Premium safe, on every device. Sign-in runs via “Sign in with Apple” or “Sign in with Google”; there is no separate password with us. We receive from Apple or Google a unique user identifier, your email address (with Apple, optionally an anonymised relay address) and, if you share it, your name. These details live in our user management (Supabase Auth) and are not shown anywhere in the app.
In our database we store for your account: a random user ID, your chosen player name, the date of your last name change (names can be changed every 30 days), your trophy count (RP), the creation date, the date of your last ranked match, your public player profile (see below), your friendships (requests, confirmations), your duels (opponent, duration, both sides’ repetitions, result) and — only while searching — an entry in the ranked queue (user ID and RP) that is deleted after the match.
Save backup: the app keeps a copy of your game progress in your account so you get it back after reinstalling or on a new device. It contains: experience, level, coins, gems, items, outfits, frames, titles, skills, stars, achievements, missions, adventure-mode settings, repetitions per day, streak, personal records, your match history (date, result, repetitions, opponent name) and your avatar choice. Not included — this data never leaves your device: the onboarding assessment including complaints, your body weight, locally created friend names and your settings. Your own photo is not part of the backup either (for the profile picture shown to other players, see below). Only you can read the backup; other players never see it. The app updates it while you play and when you leave the app. The legal basis is the contract of use (Art. 6(1)(b) GDPR).
Player name and trophy count are public: they appear on the leaderboard and in friend search and can also be retrieved by users of the app who are not signed in. Signed-in players can also open your player profile. It shows: your own profile picture if you uploaded one (see below), otherwise your chosen avatar (an in-game artwork), profile frame and title, trophies, best trophy count and rank, ranked record (wins, losses, streak, the last five results), your best 60-second score and lifetime push-up total, your adventure progress (world, stars, bosses), up to three achievements you select, the month you joined, whether you played a ranked match in the last seven days, and — visible only to that viewer — the score of your duels against each other. Players you have blocked, or who have blocked you, cannot see your profile. Do not choose a name that identifies you if you do not want that. Requested player names are checked locally in the app against a list of unwanted terms before being saved.
Your own profile picture: if you pick your own photo, the app sends a scaled-down copy (160 × 160 pixels, JPEG) to our server. Before it is stored, an automated service (Sightengine, see section 9) checks whether it shows nudity, sexual content, violence, gore, weapons, hate symbols, self-harm or drugs. If the check fails, the photo is not stored and the app tells you why. Accepted photos can be seen by all signed-in players — in your player profile, in friends lists and in live duels. Players you have blocked, or who have blocked you, do not see it. If a photo is reported, we hide it until we have reviewed it; if a breach of the profile picture rules is confirmed (see the support page), it stays removed. In both cases you see the reason in the app and can appeal by e-mail. When you switch back to a hero, remove the photo, use “Delete all data” or delete your account, the copy is deleted from the server. For the daily limit of ten checks we only store the times of your checks, for at most two days. Legal bases: showing the photo to perform the contract of use (Art. 6(1)(b) GDPR); the automated check and handling of reports protect other players and fulfil our obligations as a provider (Art. 6(1)(c) and (f) GDPR). The check does not identify people and does not analyse biometric features. Uploading is voluntary — everything works the same without your own photo.
To protect the leaderboard from manipulation we store, for each reported ranked result, the time, the day, win or loss, the trophy change and, where applicable, the duel ID. This way every duel counts only once and bot matches can be limited per day. The app also sends the timing of your individual reps; the server only uses it to check that the result is plausible and does not store it. These entries are deleted automatically after 30 days (legitimate interest in fair competition, Art. 6(1)(f) GDPR).
Weekly leaderboard: from these entries we calculate how many trophies each player has won since Monday. Player name, weekly gain and number of wins appear publicly on the app’s weekly leaderboard — like the regular leaderboard, also for users who are not signed in.
Daily challenge: we store your result for the day (completed yes/no, time needed, reps, time of play). Here too the server checks the timing of your reps without storing it. Player name and result appear publicly on the app’s daily leaderboard, and your friends also see you in their friends view. The entries are deleted automatically after 14 days.
While the app is open and you are signed in, it reports your online status (user ID and timestamp) to our server so friends can see who is around. The status is not stored and disappears when you close the app.
Reporting and blocking: if you block a player, we store that block (both user IDs) so you no longer see each other on the leaderboard, in profiles or in friend search; any existing friendship is removed. You can undo blocks at any time in the options. If you report a player for an inappropriate name, harassment, suspected cheating or another reason, we store your user ID and theirs, the reason you chose and an optional free-text note (up to 500 characters) so we can follow up. This report and block data is visible only to us for moderation; it never appears publicly in the app. The legal basis is our legitimate interest in an abuse-free community and in protecting other users (Art. 6(1)(f) GDPR).
The legal basis is performance of the usage contract for these online features (Art. 6(1)(b) GDPR). Repborne — and therefore an account — is for ages 16 and up (Art. 8 GDPR); when signing in you confirm that you are at least 16.
6. Live duels, duel codes and sharing
In a live duel the app transmits your current repetition count to your opponent in real time during the match (through our server, without storing the stream); the final result is stored with the duel. No camera image or body points are transmitted.
If you share a duel via the iOS share sheet or the clipboard, the code contains your player name plus the number and timing of your repetitions. You decide who receives it; we receive nothing.
Tournaments: when a player creates a tournament we store their user ID as organiser, the tournament code, the participants (user IDs), the draw and, per match, both sides' rep counts and the winner. Participants and the organiser can see this data for the duration of the tournament; tournaments are deleted automatically two days after creation. If the organiser makes a tournament public, the tournament name they chose, their player name and the number of waiting players are visible to all users of the app until the tournament starts.
7. Premium subscription (in-app purchase)
You buy Premium through the Apple App Store. Payment data (card, invoice, Apple ID) is processed solely by Apple as an independent controller; we never see it.
To check whether your subscription is active we use RevenueCat (RevenueCat, Inc., 400 Concar Dr, San Mateo, CA 94402, USA). For this RevenueCat receives: a pseudonymous user ID (your account ID; before signing in a random app identifier), the purchase receipt issued by Apple, product, price, currency, purchase and expiry dates, device type, iOS and app version, language and, for technical reasons, your IP address. RevenueCat is our processor (Art. 28 GDPR); the transfer to the USA relies on the EU-US Data Privacy Framework and/or the EU Commission’s standard contractual clauses. The app also caches the subscription status locally.
The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Manage or cancel: iOS Settings → Apple Account → Subscriptions.
8. Reminders
If you wish, the app reminds you to train daily at a time you choose. These are local notifications scheduled by the iPhone itself; there is no push server and no device token. The text may mention your current streak. iOS asks for permission only when you switch the reminder on; you can withdraw it any time in iOS Settings.
9. Recipients and processors
Supabase (Supabase, Inc., 970 Toa Payoh North #07-04, Singapore) hosts user management, database and realtime connections for the online features in sections 5 and 6. The data is stored in the EU (Frankfurt, Deutschland) region. Supabase is a processor (Art. 28 GDPR) under a data processing agreement including standard contractual clauses.
RevenueCat, Inc. (USA) for subscription verification, see section 7.
Sightengine (Kozelo SAS, 16 bis rue d'Odessa, 75014 Paris, France) automatically checks uploaded profile pictures for prohibited content (see section 5). Only the scaled-down photo is sent, without name or user ID; Sightengine deletes it after the check. The check may run on servers in the EU, Canada or the USA; transfers outside the EU are based on the European Commission’s standard contractual clauses in the data processing agreement with Sightengine (Art. 28, 46 GDPR).
Apple Inc. for “Sign in with Apple”, the App Store, in-app purchases and TestFlight, and Google LLC for “Sign in with Google” — both as independent controllers under their own privacy policies. When you sign in, Apple or Google learn that you use this app.
The website repborne.netlify.app with this policy, the imprint and the support page is served by Netlify, Inc. (512 2nd Street, San Francisco, CA 94107, USA). When you open the website, Netlify necessarily processes your IP address, time, requested page and browser identifier in server logs (legitimate interest in secure delivery, Art. 6(1)(f) GDPR; transfer to the USA based on the EU-US Data Privacy Framework and/or standard contractual clauses). The app itself loads nothing from this website at runtime.
We use no other recipients. There are no ad networks, no analytics or crash-reporting services, no content delivery network at runtime and no location or advertising identifiers.
10. Technical connection data
When the app talks to our servers (for account features, when loading the leaderboard and public tournaments, when checking whether a desired player name is still available, and for subscription checks), Supabase and RevenueCat necessarily process your IP address, the time and type of the request in server logs for security and troubleshooting (legitimate interest, Art. 6(1)(f) GDPR). These logs are deleted after a short time; we do not evaluate them on a personal basis.
11. Retention & deletion
Local data stays until you delete it or remove the app. We keep account data for as long as your account exists. You can delete your account any time directly in the app (Settings → Account → “Delete account”). This immediately and permanently removes account, sign-in data, profile, profile picture, trophy count, save backup, friendships, duels, queue entries and your blocks from our database; the app then also deletes all local data. If you signed in with Apple, you confirm the deletion once with Apple and we additionally revoke the sign-in with Apple — Repborne is then no longer linked to your Apple ID. Reports you have filed about other players are handled separately: when you delete your account we remove your identifier from those reports; the reported matter itself (reported ID, reason, note) may be kept for as long as needed to process it and prevent abuse, and is then deleted. Purchase records remain with Apple and RevenueCat for as long as subscription management and statutory retention duties require; we cannot delete them.
12. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time with effect for the future. Contact the address above to exercise them. You may also lodge a complaint with a data protection authority, for example the state authority responsible for your place of residence.
13. Changes
When the app changes, this policy changes with it. The current version is available here in the app and at the address listed in the App Store; the date of the last change is shown below.