Last updated 12 September 2026
This page lists every cookie RepCheck sets, everything it stores in your browser, and why. It covers the RepCheck app and the iOS app, which is the same site in a native shell.
Do we ask for cookie consent?
No, and here is the reasoning, so you can check it. Under Thailand's PDPA and the EU/UK ePrivacy rules, consent is required for storage that is not necessary to deliver the service you asked for — chiefly advertising and cross-site tracking. RepCheck sets none of that:
- There is no advertising anywhere in the app, and no advertising or marketing cookies.
- There is no third-party analytics — no Google Analytics, no Meta pixel, no Segment, Mixpanel, Amplitude, Hotjar or similar. Nothing on any page reports your behaviour to another company.
- We do not sell or share your data, and nothing here is used for profiling or automated decisions about you.
What is left is the strictly necessary cookies listed below, and some local storage that holds your own training data on your own device. Those are exempt from consent — but you are still entitled to know about them, which is what the rest of this page is for.
Cookies we set
Both first-party, both strictly necessary, and neither one tracks you across other websites.
session— signs you in and keeps you signed in. This is the cookie that makes your account yours; without it every page would ask you to log in again. It holds a signed reference to your account, not your password. SetHttpOnly(so page scripts cannot read it),SameSite=Lax(so it is not attached when another site quietly makes a request to us in the background; it is still sent if you click a link to RepCheck from elsewhere, which is what keeps you signed in) andSecure(so it is only ever sent over HTTPS). Lasts up to 3650 days, and refreshes while you keep using the app. Logging out clears it.apple_oauth_state— set only if you tap Continue with Apple, and only for the length of that sign-in. It carries a one-time random value that lets us confirm the login coming back from Apple is the one you started, which is what stops someone else's sign-in being replayed into your browser. Expires after 10 minutes and is deleted as soon as the sign-in finishes.
Data stored on your device
Most of what you log lives in your browser's local storage as well as on our servers, so the app still works when your connection drops. This is not a tracking mechanism — it is your training data, on your device, readable only by RepCheck. It includes your workout log, nutrition log, weight log, saved analyses, coaching profile and HYROX history, plus small preferences like your theme, language and units, and how far you got in the app tour.
Clearing your browser's site data for RepCheck, or deleting the iOS app, removes all of it from that device. Doing so does not delete your account — see the Privacy Policy for that.
Fonts and other page assets
The typefaces the app uses (Inter and Noto Sans Thai) are served from our own servers, not from Google's font CDN. That matters more than it sounds: loading them the usual way would make your browser contact Google on every page — including the sign-up page, before you had agreed to anything — and hand over your IP address to do it. They are local instead, so that request never happens.
A few files are not ours, and we would rather say so than leave you to find out:
- When you start a workout analysis or a challenge, the page downloads the pose-detection code from cdn.jsdelivr.net and the pose model itself from storage.googleapis.com (Google). Those requests happen only when you begin an analysis, never on an ordinary page load. Your video is not sent to them — the pose detection they power runs on your own device.
- One illustration on the HYROX training-space screen is hosted by images.unsplash.com.
Downloading a file from any of those reveals your IP address to them, in the ordinary way any download does. Nothing about your training, your account or your content goes with it.
Embedded videos
Exercise tutorial and HYROX demonstration videos are embedded from
YouTube. We use youtube-nocookie.com, YouTube's
privacy-enhanced mode, and the player is only loaded after you open
a video — not on page load. If you never open one, nothing is
requested from YouTube and nothing of YouTube's is stored. Once you do,
YouTube may store what it needs to play the video, under
Google's
privacy policy, which we do not control.
How to refuse or remove them
Every browser lets you block or delete cookies and site data in its
settings. Because the session cookie is what holds your login,
blocking cookies for RepCheck means you will not be able to stay signed in —
the app cannot work without it. If you would rather not have an account at
all, the honest answer is not to create one.
Changes
If we add or remove a cookie, this page changes with it and the date at the top moves.
Contact
Questions about anything on this page: phuttimatebenchanakatkul@gmail.com
See also our Privacy Policy, Terms of Service and Refund Policy.