OnRep
Privacy Policy
OnRep publishes this Privacy Policy to explain how we collect, use, store, protect, and dispose of personal information while providing the OnRep service.
Effective date: April 1, 2026 · Last updated: June 20, 2026 · Version 1.1
Privacy Policy
- 1. Personal information we collect
- 2. Purposes of collection and use
- 3. Retention period
- 4. Third-party sharing and processors
- 5. International transfer
- 6. Destruction of personal information
- 7. User rights and requests
- 8. Security measures
- 9. Automatic collection tools
- 10. Children's privacy
- 11. Privacy contact
- 12. Changes to this policy
- 13. Governing privacy laws
1. Personal information we collect
Required account information
| Item | When collected | Purpose |
|---|---|---|
| ItemEmail address | When collectedSign-up | PurposeAccount creation, authentication, password reset, service notices |
| ItemNickname or display name | When collectedSign-up or profile setup | PurposeUser identification inside the service |
| ItemPassword | When collectedSign-up | PurposeEncrypted authentication credential |
Information generated while using the service
| Item | When collected | Purpose |
|---|---|---|
| ItemWorkout records | When collectedWhen a workout is logged | PurposeWorkout history, analytics, and progress comparison |
| ItemRunning GPS route data | When collectedWhen Running is used | PurposeRoute coordinates are encrypted and saved to the server to show maps and running analysis. The device keeps an AES-256-GCM encrypted fallback only until upload succeeds, and raw GPS/HR/cadence samples are never included in analytics. |
| ItemHealth Connect / Apple Health data | When collectedOnly when you connect Health Connect or Apple Health and grant permission | PurposeUsed to read workout heart rate and power context, body weight, sleep, HRV, and resting heart rate for personal fitness tracking, relative-strength context, and Pro condition score. User-saved workouts, running distance, route, and workout heart-rate records can be written back when permission is granted. Raw Health Connect / Apple Health values are not used for advertising or third-party marketing. |
| ItemDevice information | When collectedWhen the app runs | PurposeCompatibility checks and bug fixes |
| ItemCrash and error logs | When collectedWhen an error occurs | PurposeService stability improvement |
| ItemUsage events | When collectedDuring app use | PurposeProduct improvement and UX optimization |
| ItemPurchase and subscription records | When collectedAt payment | PurposeSubscription and payment management |
Optional information
| Item | When collected | Purpose |
|---|---|---|
| ItemApple ID email | When collectedWhen Sign in with Apple is selected | PurposeSocial login authentication |
| ItemGoogle email | When collectedWhen Google sign-in is selected | PurposeSocial login authentication |
Information we do not collect for unnecessary profiling
- Contacts
- Government-issued identifiers such as resident registration or passport numbers
- Sensitive profiling data for external marketing
2. Purposes of collection and use
| Purpose | Details |
|---|---|
| PurposeAccount management | DetailsSign-up, identity confirmation, authentication, password reset |
| PurposeService delivery | DetailsWorkout storage, progress analytics, weekly and monthly comparisons, 1RM estimates, data sync |
| PurposeProduct improvement | DetailsUX improvement and feature planning based on usage patterns |
| PurposeReliability | DetailsCrash and error tracking, incident response |
| PurposeCustomer support | DetailsInquiry handling and complaint resolution |
| PurposePayment management | DetailsPaid subscription processing, subscription state management, refund handling |
| PurposeNotices | DetailsService changes, maintenance, and important security notices |
OnRep does not use collected personal information for third-party marketing, external targeting, or unnecessary profiling.
3. Retention period
Personal information is destroyed without delay once the purpose of collection and use has been fulfilled, unless retention is required by law.
| Item | Retention period | Basis |
|---|---|---|
| ItemAccount information | Retention periodUntil account deletion | BasisService use |
| ItemWorkout records | Retention periodUntil account deletion | BasisService use |
| ItemCrash and error logs | Retention period90 days from collection | BasisService stability |
| ItemPayment and subscription records | Retention period5 years from transaction | BasisE-commerce records retention |
| ItemService usage logs | Retention period3 months from collection | BasisCommunications records retention |
| ItemDeleted account information | Retention period30 days after deletion | BasisAbuse prevention and dispute handling |
4. Third-party sharing and processors
OnRep does not sell or share personal information with third parties except where the user has consented, where law requires disclosure, or where processors are needed to operate the service.
| Processor | Role | Data processed | Server location |
|---|---|---|---|
| ProcessorSupabase Inc. | RoleAuthentication, database hosting, data sync | Data processedEmail, nickname, workout records | Server locationUnited States |
| ProcessorSentry | RoleCrash/error tracking and performance monitoring | Data processedDevice information and error data | Server locationUnited States |
| ProcessorRevenueCat, Inc. | RoleSubscription management and receipt validation | Data processedPurchase records, subscription status, anonymous user ID | Server locationUnited States |
| ProcessorApple Inc. | RoleApple sign-in and App Store payments | Data processedApple ID email and payment data | Server locationUnited States |
| ProcessorGoogle LLC | RoleGoogle sign-in and Play Store payments | Data processedGoogle email and payment data | Server locationUnited States |
5. International transfer
Some information may be transferred internationally to cloud, authentication, monitoring, and payment providers required for service operations.
| Recipient | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| RecipientSupabase Inc. | CountryUnited States | ItemsEmail, nickname, workout records | PurposeDatabase hosting and authentication | RetentionUntil account deletion |
| RecipientSentry | CountryUnited States | ItemsDevice information, crash logs | PurposeError tracking | Retention90 days |
| RecipientRevenueCat, Inc. | CountryUnited States | ItemsPurchase records, subscription status | PurposeSubscription management | Retention1 year after subscription ends |
6. Destruction of personal information
When retention periods expire or processing purposes are fulfilled, personal information is destroyed without delay. Legally retained data is separated and destroyed after the required period.
| Type | Method |
|---|---|
| TypeElectronic files | MethodDeleted using technical measures that prevent recovery |
| TypePaper documents | MethodShredded or incinerated |
| TypeBackups | MethodOverwritten or deleted according to the backup cycle |
7. User rights and requests
| Right | Description | How to exercise |
|---|---|---|
| RightAccess | DescriptionRequest access to personal information collected about you | How to exerciseIn-app settings or email |
| RightCorrection | DescriptionRequest correction of inaccurate information | How to exerciseProfile edit or email |
| RightDeletion | DescriptionRequest deletion of personal information | How to exerciseAccount deletion or email |
| RightRestriction | DescriptionRequest suspension of processing | How to exerciseEmail |
| RightWithdrawal of consent | DescriptionWithdraw consent to collection and use | How to exerciseAccount deletion |
| RightPortability | DescriptionRequest export or transfer of your information | How to exerciseEmail or CSV export where available |
- Profile edits and account deletion are available in app settings.
- Email requests can be sent to onrepforbty@gmail.com.
- A representative may submit a request with proof of authorization.
- Access, correction, deletion, and restriction requests are handled within 10 days of receipt where legally possible.
8. Security measures
| Measure | Details |
|---|---|
| MeasureEncryption | DetailsPassword hashing and TLS for data in transit |
| MeasureAccess control | DetailsDatabase Row Level Security policies |
| MeasureAuthentication security | DetailsJWT-based authentication and session expiry management |
| MeasureOffline data | DetailsTemporarily stored in the device app sandbox until server save succeeds |
| MeasureRunning route files | DetailsThe encrypted server route is canonical. A local route file is kept encrypted with AES-256-GCM only as retry insurance before server save succeeds, then deleted after successful upload or session deletion. |
| MeasureLeast privilege | DetailsSeparated operational access and personal data access |
| MeasureRegular review | DetailsSecurity reviews and patching |
9. Automatic collection tools
| Tool | Purpose | Data |
|---|---|---|
| ToolSentry SDK | PurposeCrash and error tracking | DataDevice information and stack traces |
| ToolFirebase Analytics | PurposeUsage analytics | DataScreen visits and anonymized events |
- You can limit analytics sharing in device settings.
- On iOS, app analytics sharing can be disabled in privacy settings.
- On Android, Google settings can limit personalization and analytics sharing.
10. Children's privacy
OnRep does not knowingly collect personal information from children under 14. If we learn that such information has been collected, we will delete it without delay.
11. Privacy contact
| Item | Details |
|---|---|
| ItemName | DetailsWonwoo Kim |
| ItemRole | DetailsCEO / Privacy Officer |
| ItemEmail | Detailsonrepforbty@gmail.com |
| ItemGeneral support | Detailsonrepforbty@gmail.com |
For privacy infringement reports or counseling, users may contact the relevant public privacy, dispute resolution, prosecutor, or police cybercrime agencies in their jurisdiction.
12. Changes to this policy
This Privacy Policy may be revised due to changes in law or service operations. Material changes will be announced in app and by email at least 7 days before the effective date.
| Version | Effective date | Changes |
|---|---|---|
| Version1.0 | Effective date2026-04-01 | ChangesInitial publication |
13. Governing privacy laws
This policy is operated in accordance with applicable Korean privacy, information network, and e-commerce consumer protection laws.
Privacy Inquiries
For data access, correction, deletion, or processing suspension requests, please contact us at the email below.
Contact: onrepforbty@gmail.com