Privacy Policy

Last updated 9 October 2026

RepCheck is a training app. This page explains what it collects, why, who it is shared with, and how to get rid of it.

Who we are

RepCheck is operated by Phuttimate Benchanakatkul, a sole trader based in Thailand. That means there is one person responsible for your data, and this is how you reach them:

• Data controller — Phuttimate Benchanakatkul (a sole trader, not an incorporated company, so there is no company registration number to quote).
• Contact for any privacy question or request — phuttimatebenchanakatkul@gmail.com

We are not large enough to be required to appoint a formal Data Protection Officer, and we have not appointed one. The address above reaches the person who makes these decisions.

What we collect

• Account details — your email address and display name. If you sign in with Google, we receive your email, name and profile picture from Google; we never receive your Google password. If you sign in with Apple, we receive your name and email, or Apple's relay address if you chose Hide My Email.
• Training data — workouts, sets, reps and weights, body weight, HYROX race times, streaks and challenge results.
• Nutrition data — the meals you log, including photos of food and scanned barcodes.
• Lift videos — the clips you upload for form analysis.
• Progress photos — the check-in photos of your body, if you choose to take them.
• Usage data — which pages you open and which features you use (for example "food photo scan" or "coach message"), and how often, used to understand what parts of the app are worth building on and to enforce daily limits. These are running counts stored against your account on our own servers; they are not a record of what you wrote or uploaded. There is no third-party analytics in RepCheck: no Google Analytics, no advertising pixel, and nothing that reports your behaviour to another company.
• Reports you send — if you report another user, or report an AI reply, we keep the report (and, for an AI reply, the text of that reply) until we have reviewed it.

We do not collect your contacts, your location, your device advertising identifier, or health data from Apple Health or any other app.

Health and body data

Body weight, progress photos and lift videos are health-related and are treated as the most sensitive data in the app. Under Thailand's PDPA this is sensitive personal data, and under the GDPR it is special category data. Either way it may only be processed with your explicit consent — which is what you give when you create an account and choose to upload these things, and which you can withdraw at any time by deleting the content or your account.

Progress photos are private to your account: every route that serves or deletes one checks it belongs to you first. They are never shown to other users, never used in leaderboards and never used for advertising.

Why we are allowed to process it

Our legal bases, so you can hold us to them:

• To provide the app you asked for (performance of our contract with you) — your account, your logs, your analyses. Without this there is no app.
• Your explicit consent — for health and body data, and, separately, for sending your content to our AI provider (Google Gemini) to generate a result. The app asks for the AI consent the first time you use an AI feature, before anything is sent, and you can withdraw it at any time in Settings → AI features.
• Our legitimate interests — keeping the service secure and working: rate limits, abuse and fraud prevention, and the usage counts described above. We have weighed this against your privacy and kept it to simple counts and security measures.
• Legal obligation — where the law requires us to keep or disclose something.

We do not sell your personal data, we do not share it for advertising, and we do not use it for profiling or for automated decisions that have a legal effect on you.

AI processing by a third party

RepCheck's AI features work by sending your content to Google's Gemini API. Nothing is sent until you have agreed: the app asks the first time you use an AI feature, and you can turn it off at any time in Settings → AI features. With it off, the AI features are unavailable and nothing is sent; the rest of the app keeps working. Only what the feature you are using needs is sent, and only when you use it:

• Food photo scan — the photo and any note you type, to estimate the food and its calories and macros.
• Lift form analysis — a trimmed clip of your video, plus the exercise you chose, to score your form and count reps. Pose detection for trimming runs on your own device.
• Daily challenge — your challenge video, to count reps.
• AI coach, workout chat and analysis chat — your messages and the conversation so far; for the workout chat, a summary of your logged sets, weights and reps; for the analysis chat, that analysis's scores and feedback.
• Weekly check-in — your progress photos for that week (if you took them), body weight entries, logged calories, gender and goal, to suggest a calorie adjustment.
• AI workout plan — the goal you type, your training days, gender, current and goal weight, and where you train.
• HYROX race analysis — your race segment times.

Google processes this content to return a result to us. We do not sell your data to anyone, and we do not use it for advertising or for building a profile of you.

Who else your data reaches

The full list of companies that can touch your data, and why:

• Render — hosts our servers and database.
• Google — Gemini, for the AI features above (only once you have agreed), and Google Sign-In if you use it.
• Apple — Apple Sign-In if you use it, and App Store distribution.
• FatSecret and Open Food Facts — looked up by barcode or food name to return nutrition figures. We send the barcode or the search term, not anything that identifies you.
• YouTube — only if you open an embedded tutorial video. See our Cookie Policy.
• jsDelivr and Google's model storage — when you start a workout analysis, your browser downloads the pose-detection code and model from cdn.jsdelivr.net and storage.googleapis.com. That download reveals your IP address to them. Your video is not sent there; the detection runs on your device.
• Unsplash — one illustration on the HYROX training-space screen is loaded from images.unsplash.com, which reveals your IP address to them.

Where it goes, and where it is stored

Your data is stored on our servers, hosted with Render. The providers above are largely based in the United States, so using RepCheck involves transferring your data outside Thailand and outside the EU and UK. Those transfers rely on your consent and on the contractual terms and standard data protection clauses those providers offer. If you are not comfortable with that, the AI features are the ones to avoid — the rest of the app does not depend on them.

How long we keep it

• Uploaded lift videos — the original upload is deleted right after analysis. The scores, feedback and the trimmed clip are kept in your analysis history so you can replay them, for your 20 most recent analyses; older ones are deleted automatically, and you can delete any of them yourself.
• Challenge videos — deleted right after the reps are counted. Only the rep count is kept.
• Your account and everything in it — kept while your account exists, then erased on the schedule below.
• Anything you delete yourself — a log, a photo, a saved analysis — goes when you delete it.
• Sign-in state — see the Cookie Policy for how long the session cookie lasts.

Deleting your account

You can delete your account at any time from Settings → Delete account, inside the app. Deletion is not instant: your account is scheduled for deletion and permanently erased after 30 days. During that window you can log back in and cancel it from the same screen. After the 30 days, your account and everything attached to it — training logs, nutrition logs, progress photos, saved analyses, custom foods and exercises, friends, challenges and race times — are permanently erased and cannot be recovered.

Your rights

You can view and correct your account details in Settings, and you can delete individual logs, photos and saved analyses at any time without deleting your whole account.

Beyond what the app lets you do directly, you have the right to ask us to: give you access to your data or a copy of it in a portable form; correct it; erase it; restrict or object to how we use it; and withdraw consent where we relied on it. These are your rights under Thailand's PDPA, and we extend the equivalent GDPR and UK GDPR rights to users in the EU and the UK.

Email phuttimatebenchanakatkul@gmail.com and we will answer within one month. Asking costs nothing, and we will not treat you differently for asking.

Complaints

If you think we have handled your data badly, please tell us first — it is the fastest way to get it fixed. You also have the right to complain to a regulator without going through us: in Thailand, the Office of the Personal Data Protection Committee (PDPC); in the EU or UK, your national data protection authority, which in the UK is the Information Commissioner's Office.

Security

Passwords are stored hashed, never in plain text. The site is served over HTTPS, the session cookie cannot be read by page scripts, and the login and AI endpoints are rate-limited. No system is perfect: if we discover a breach affecting your personal data, we will notify you and the regulator as the PDPA and GDPR require.

Children

RepCheck is not intended for children under 13, and we do not knowingly collect data from them. Because RepCheck handles health data, a young person old enough to use it but still a minor where they live — under 20 in Thailand, or under the age of digital consent in their EU or UK country — needs a parent or guardian's consent first. If you believe a child has given us data, email us and we will delete it.

Changes

If this policy changes materially, the updated date at the top of this page changes with it.

Contact

Questions about your data: phuttimatebenchanakatkul@gmail.com

See also our Terms of Service, Cookie Policy and Refund Policy.