REP LEAGUE Privacy Policy

DRAFT – NOT LEGAL ADVICE. This is a working draft prepared for Tyson Miller's review. It must be reviewed and finalized by a qualified lawyer before it is published or relied on. Items in [brackets] are placeholders or open decisions.

Effective date: [Effective date] Last updated: [Last updated date]

1. The short version

We collect what we need to run REP LEAGUE: your account, your bib (profile), the results and proof you post, and some device and usage data.
Other users can see your name/handle, city, results, points, and the photos/videos on your posts.
We never show your exact location. Others only see your city and a rounded distance, never an exact mile count. Precise location is optional, only used with your permission, and you can turn it off anytime.
We don't sell your personal data.
You can access, fix, download, or delete your data, including deleting your account right in the app.

2. Who we are

REP LEAGUE is operated by [Company legal name] ("we," "us"), [Mailing address]. Contact: [Contact email]. For GDPR purposes, we are the "controller" of your personal data. [EU/UK representative, if required: [Name and address]]

This policy covers the REP LEAGUE website (currently https://olive-cherry-bay-plaza.grok.me) and our iOS and Android apps (the "Service").

3. What we collect

Account information

Email address and password (stored in hashed form), or basic profile info from Google or X if you sign in with them (such as name, email, and account ID). We don't get your Google or X password.

Your bib (profile)

Name, handle, city, region, bio, and any profile photo.

Results and content

Results you post (event type, weight, reps, times, distances, counts), rep counter data, points, streaks, leagues you join or create, and photos or short videos (up to about 1 minute; longer/HD for Pro) you attach as proof.
Reports and blocks you make, and messages you send us.

Location

Approximate location: your city/region (which you enter), and approximate location that may be inferred from your IP address.
Precise device location (optional): only if you turn on "Use my location" and allow it in your device or browser. We use it to calculate distances for the Nearby board. You can turn it off anytime in the app or your device settings. We never show your coordinates to other users — only your city and a rounded distance (for example about 10 miles or about 25 miles), never an exact mile count. Nearby can be limited to any distance from 1 to 1000 miles. Only athletes who chose to share a location are included in that distance.

Subscription and payment information

Your plan, trial status, Founding tester pass status (including when your personal 30-day Founding Pro period started and ends), Lifetime Pro status, and purchase history. Payments are handled by RevenueCat with Stripe (web) and by Apple or Google (apps). We don't receive or store your full card number.

Device and usage data

Device type, operating system, browser, app version, IP address, language, crash and error logs, and how you use features (for example, pages viewed and buttons tapped).

Cookies and similar technologies

We use essential cookies and local storage to keep you signed in and secure your session. [DECISION FOR TYSON: list any analytics or other non-essential cookies/SDKs, if used; if used in the EU/UK, a consent banner may be needed.]

4. Health and fitness data — please read

Your results (lifts, run times, reps, etc.) are fitness performance data. Some laws may treat certain fitness information as sensitive or health-related. We collect it because you choose to post it to a public leaderboard. Please don't post information you don't want others to see, and don't include medical details (diagnoses, injuries, medications) in your bio or posts.

REP LEAGUE is not a medical service and does not provide medical advice. Our metrics are not a substitute for professional advice. [DECISION FOR TYSON: if Apple HealthKit, Google Health Connect, or wearables are ever integrated, this section must be updated and those data must not be used for advertising.]

Location

This section explains precise and approximate location in one place.

What we collect

The city and region you type on your bib.
Approximate device location, only after you tap Allow location and allow it in your browser or device. We receive a latitude and longitude so we can measure distance. We do not collect a history of where you have been. [DECISION FOR TYSON: confirm we store only the latest saved pin and no location trail.]

Why

To find nearby athletes and leagues, and to show distance on the Nearby board. City boards, leagues, and posting all work if you skip this.

How it is displayed

Other people never see your exact coordinates or an exact mile count. They may see your city and a rounded distance (for example about 10 miles or about 25 miles). Distances under a mile show as under 1 mile. From 1 to 10 miles the distance is rounded to the nearest mile, then to the nearest 5, 10, or 25 miles as it grows.

How long we keep it

If you save a location on your bib, we keep that latest pin until you clear it or delete your account. The time you tapped Allow location is kept with your bib until the account is deleted. [DECISION FOR TYSON: retention of the consent timestamp after the pin is cleared.]

How to withdraw consent or delete it

On your Bib, open Location. Turn location sharing off, and use Clear saved location to delete the stored pin. You can also deny location in your browser or device settings. Nearby will not ask the device for a fix until you tap Allow location again. Questions: [Contact email].

5. How we use your data

Run the Service: create your account, show your bib, post results, calculate points, streaks, and rankings, run leaderboards, leagues, Nearby, "Rising this week," and My Metrics.
Subscriptions: manage Free/Pro access, trials, the Founding tester pass countdown, founding pricing, and Lifetime Pro, and send required billing notices (like trial reminders).
Safety and fair play: review reports, moderate content (including reviewing photos/videos), detect cheating, spam, and abuse, and enforce our Terms.
Support and communication: answer questions and send service messages (security alerts, policy changes). [Optional: marketing emails only with your consent where required; you can unsubscribe anytime.]
Improve the Service: fix bugs, understand which features are used, and build new ones.
Legal: comply with law, respond to lawful requests, and protect rights and safety.

Legal bases (EU/UK users): performance of our contract with you (running the Service), your consent (precise location, optional cookies, marketing — you can withdraw it anytime), our legitimate interests (safety, fraud prevention, improving the Service), and legal obligations.

6. What other users can see

Public: name/handle, city, region, bio, results, points, rankings, streak count, league memberships in public leagues, and photos/videos on your posts.
Approximate distance: on the Nearby board, others may see a rounded distance — never your exact location and never an exact mile count. Athletes who have not opted in to location sharing are not placed by distance.
Not public: your email, password, precise location, payment details, and private My Metrics history.

Content you make public can be seen, screenshotted, or shared by others, so think before you post.

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under California law).

We share data only as needed with:

Hosting and infrastructure: Grok Build / xAI hosting, and Neon (Postgres database).
Sign-in providers: Google and X, when you choose to sign in with them.
Payments: RevenueCat, Stripe, Apple App Store, and Google Play.
Other service providers that help us with email, storage, analytics, crash reporting, or moderation: [List any additional providers].
Other users, for content you make public (see Section 6).
Legal and safety: law enforcement or others when required by law, or to protect people's safety, our rights, or the Service.
Business transfers: if we're involved in a merger, acquisition, or sale of assets, with notice to you.

Our service providers may only use your data to provide services to us.

8. How long we keep data

Account and profile: while your account is active.
Posts, results, and media: until you delete them or your account. Downgrading from Pro to Free doesn't delete anything.
After account deletion: we delete or anonymize your personal data within [30] days, except copies in backups (overwritten within [X] days), and data we must keep for legal, tax, fraud-prevention, or dispute reasons (for example, transaction records for [7] years).
Precise location: we use it to calculate distance and [DECISION FOR TYSON: store only the latest location / do not store history / retain for X days]. Turning off location stops new collection.
Moderation records: reports and enforcement records may be kept for [X] months to prevent repeat abuse.

9. Your choices and rights

Everyone can:

Access and update your profile and posts in the app.
Delete posts at any time.
Turn off location in the app or your device settings.
Delete your account in the app (Settings → [Delete account]) or by web request at [Account deletion URL] or [Contact email]. (Canceling an App Store or Google Play subscription must be done separately in that store.)
Request a copy of your data or correction of inaccurate data by emailing [Contact email].
Block and report other users.

We'll verify your identity before acting on requests and respond within the time the law requires (generally 30–45 days).

California residents (CCPA/CPRA)

You have the right to:

Know what personal information we collect, use, and disclose, and get a copy of it.
Delete personal information, subject to exceptions.
Correct inaccurate personal information.
Opt out of sale or sharing — we don't sell or share personal information, so there's nothing to opt out of.
Limit use of sensitive personal information — we use precise location only to provide the Nearby feature you request.
Not be discriminated against for exercising your rights.

Categories collected in the last 12 months: identifiers (name, email, handle, IP), customer records, commercial information (subscription history), internet/device activity, approximate and precise geolocation (with permission), audio/visual content (photos/videos you post), and inferences (rankings/metrics). Sources: you, your device, and sign-in/payment providers. Purposes and recipients are described in Sections 5 and 7. You can use an authorized agent to make a request. Contact: [Contact email].

You have the right to access, correct, delete, restrict, or object to processing of your data, to data portability, and to withdraw consent at any time (this doesn't affect past processing). You can also complain to your local data protection authority. We don't make decisions that have legal or similarly significant effects on you based solely on automated processing; leaderboard rankings are automated but are for game purposes only.

Other U.S. states and countries

Residents of other states and countries with privacy laws may have similar rights. Contact us at [Contact email] and we'll honor them as the law requires.

10. Children

REP LEAGUE is for people 13 and older and is not directed to children under 13. We don't knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact [Contact email] and we'll delete it. Where local law requires a higher age or parental consent (for example, up to 16 in parts of the EU), those rules apply.

11. Security

We use reasonable safeguards, including encrypted connections (HTTPS), hashed passwords, and access controls. No system is 100% secure. Use a strong, unique password and tell us right away if you suspect unauthorized access. We'll notify you of a data breach as required by law.

12. International transfers

We and our providers may process data in the United States and other countries whose privacy laws may differ from yours. When we transfer EU/UK personal data, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses or other lawful transfer mechanisms.

13. Changes to this policy

We may update this policy. If changes are significant, we'll notify you in the app or by email before they take effect. The "Last updated" date shows the latest version.

14. Contact

[Company legal name] [Mailing address] Email: [Contact email] [Privacy contact / Data Protection Officer, if applicable]