Privacy Policy

Effective: 2026-08-06 · Last updated: July 14, 2026

This Privacy Policy explains how RepRoute ("RepRoute", "we", "us", or "our") collects, uses, discloses, stores, and protects your personal data when you visit our website, create an account, or use our fitness planning web application (together, the "Service"). We are committed to handling your data lawfully, fairly, and transparently, in compliance with the Thailand Personal Data Protection Act B.E. 2562 (the "PDPA") and, where it applies to you, the EU General Data Protection Regulation (the "GDPR").

1. Definitions

• Personal data — any information relating to an identified or identifiable natural person.
• Sensitive / special-category data — data revealing health or other categories given heightened protection under GDPR Article 9 and PDPA section 26.
• Processing — any operation performed on personal data, such as collection, storage, use, disclosure, or erasure.
• Data controller — the party that determines the purposes and means of processing (that is us, for direct users).
• Data processor / sub-processor — a third party that processes personal data on our behalf and on our instructions.

2. Data Controller and Contact

The data controller responsible for your personal data is Jirawut Suwatcharakulthorn, operating as a sole proprietor in Thailand. For any privacy enquiry or to exercise your rights, you may contact our Data Protection Officer through our contact form.

EU representative (GDPR Article 27): RepRoute is established in Thailand. Before we actively offer the Service to data subjects in the EU/EEA, we will appoint a representative in the Union and publish their name and contact address here. This appointment is pending.

3. Data We Collect

We collect the categories of data below. Most of it you provide directly; some (such as security logs) is generated automatically when you use the Service.

3.1 Account data

• Email address
• Password (stored as a salted hash by Supabase Auth; we never see plaintext)
• Account creation date and last sign-in timestamp
• If you sign in with a third-party provider (for example Google), that provider shares your email and basic profile identifier with us so we can create or match your account

3.2 Profile data

• Display name and (optionally) username
• Age, height, weight (used to calibrate exercise intensity and load)
• Equipment availability, training goals, preferences, and schedule
• Display preferences such as language, theme, and units

3.3 Sensitive health data

Depending on which features you use, we hold the following health-related data about you:

• Injury flags — the body region (e.g. lower back, knee, shoulder), the affected side, and how severely it limits you
• Body-weight history — every weight you log, with its date
• Height, and either your age or your date of birth if you provide one
• Sex, where you choose to set it (used only to calculate energy and protein targets)
• Your estimated daily energy expenditure, which we derive from your weight history and food logs
• Readiness check-ins — how you rated your sleep, stress, soreness, and motivation before a session, the readiness score derived from those ratings, and any body areas you tell us are hurting that day
• Your nutrition diary — individual food entries, daily calorie, protein and water totals, and the targets set for each day
• Any health-relevant note you choose to enter (for example a limitation you describe in your own words)
• Photos you upload for a scan, where you use a photo feature

Some of this health data is sent outside RepRoute to generate your plans. When you generate an adaptive plan, we transmit your injury flags together with your body weight, height, age, and sex (where you have set them), plus your goal, experience level, equipment, and any context you typed, to our text inference providers — Groq and Cerebras, both based in the United States. When you ask for a life-context adjustment to an existing week, we send the affected injury regions, your equipment, and the situation you described, but not your weight, height, age, or sex. Photos you submit for a gym, food, or program scan are sent to Cloudflare Workers AI, which runs on a global edge network. These transfers happen only when you use one of these features, and only while your explicit consent for health-data processing is in force (see section 4). We do not send your name, email address, or account identifier with these requests.

3.4 Activity and usage data

• Workout completions, sets, reps, and weights you log
• Plans generated for you and adjustments you make
• The profile snapshot sent to generate an adaptive plan, and the notes returned with it, saved alongside the plan itself
• Optional content you submit, such as support messages, food entries, and photos you upload for a scan
• Service logs (rate-limit counters, error reports, feature usage)

3.5 Security audit data

For security, fraud prevention, and abuse investigation we record an audit trail of sign-in events, access to other users' data, and rate-limited requests. Each entry may include:

• IP address
• Browser user agent
• Event type and timestamp

These security audit logs are retained for a maximum of 2 years and then permanently deleted (see Retention Periods below).

3.6 Data we do not collect

We do not collect payment card numbers (these are handled directly by our payment processor), we do not buy personal data from data brokers, and we do not run advertising, analytics, or third-party tracking scripts. See our Cookie Disclosure for the complete list of cookies and storage we use.

4. Sensitive Health Data — Explicit Consent

5. How and Why We Use Your Data

We use personal data for the following purposes:

• To provide the Service — create your account, generate and adapt workout plans, store your logs and progress.
• To personalise plans — calibrate intensity, route around injuries, and respect your equipment and schedule.
• To keep the Service safe — authenticate you, enforce rate limits, detect abuse, and investigate security incidents.
• To communicate with you — send essential transactional emails (email confirmation, password reset, security and account notices) and, only if you opt in, product updates and weekly training summaries.
• To handle support requests — respond to messages you send through the contact form.
• To meet legal obligations — retain consent records and respond to lawful requests.
• To improve the Service — understand which features are used, using aggregated or de-identified data where possible.

6. Legal Basis for Processing

• Contract performance (GDPR Art. 6(1)(b) / PDPA s.24(3)): to deliver the workout planning service you signed up for.
• Explicit consent (GDPR Art. 6(1)(a) + Art. 9(2)(a) / PDPA s.26): for sensitive health data, adaptive plan generation, and marketing emails.
• Legitimate interest (GDPR Art. 6(1)(f)): for security, fraud prevention, rate-limit enforcement, and basic service improvement, balanced against your rights and freedoms.
• Legal obligation (GDPR Art. 6(1)(c)): for retaining consent records and complying with lawful requests.

7. Marketing Communications

We send marketing or product-update emails only if you opt in (for example by ticking the optional box at sign-up). Every marketing email includes an unsubscribe link, and you can change your preference at any time in Settings → Notifications. Essential transactional messages — such as email verification, password resets, and important security or account notices — are not marketing and are sent regardless of your marketing preference because they are necessary to operate your account.

8. Automated Plan Generation and Profiling

Some plans are produced with the help of automated reasoning systems that process the goals, equipment, and limitations you provide. This is a core part of the Service and is carried out with your consent and to perform our contract with you. These automated suggestions do not produce legal effects concerning you or similarly significant effects within the meaning of GDPR Article 22: they are recommendations you remain free to accept, modify, or ignore, and you can always reach a human by contacting us. We do not use your data for automated decisions about credit, employment, insurance, or any comparable consequential outcome.

9. Data Processors and Sub-processors

We engage the following processors. Each is bound by a data-processing agreement and processes your data only on our documented instructions. We share only the minimum data each processor needs for its function.

Two of these act as independent controllers for their own purposes as well as processing data for us. Stripe handles payments and is separately responsible for the card data you enter on its checkout page, for fraud prevention, and for its own financial record-keeping. Google is only involved if you choose "Continue with Google" to sign in; the sign-in itself is governed by Google's own privacy policy. If you never subscribe, no data reaches Stripe; if you never use Google sign-in, no data reaches Google.

We also use public third-party food databases (Open Food Facts and the USDA FoodData Central database) to look up nutrition information. When you search for a food, the search term is sent to these services; we do not send them any account identifier or health data.

10. When We Disclose Data

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We disclose personal data only:

• to the processors listed above, to operate the Service;
• where you direct us to (for example, making part of a profile public through a feature you choose to enable);
• to comply with a valid legal obligation, court order, or lawful request from a competent authority;
• to protect the rights, safety, and property of RepRoute, our users, or the public; and
• in connection with a merger, acquisition, or sale of assets, in which case we will notify you and any new owner will remain bound by this policy or a materially equivalent one.

11. International Data Transfers

Our primary database is hosted in Tokyo, Japan (Supabase ap-northeast-1). Some processors — in particular our text AI inference providers (Groq and Cerebras), our image AI provider for photo features (Cloudflare Workers AI), Resend, and, if you subscribe or use Google sign-in, Stripe and Google — are based in the United States or operate global edge networks. Where data leaves Thailand or the EEA we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and on the supplementary safeguards described in those agreements, as well as the transfer mechanisms required under the PDPA.

12. Retention Periods

• Account and profile data: kept until you delete your account, then irreversibly purged after a 30-day grace period during which deletion can be cancelled.
• Smart-feature usage log: a metering record only — which feature you used, which provider handled it, how many tokens it consumed and what that cost. It contains no prompt text and no generated content. Kept for 90 days, then automatically deleted.
• Inputs and notes stored with a generated plan: when a plan is generated we save the profile snapshot that produced it — your goal, training frequency, session length, experience level, equipment, injury flags, any context you typed for that week, and, where you have set them, your body weight, height, age, and sex — together with the plan notes, attached to the program record itself. This is not deleted after 90 days: it is kept for as long as you keep that program, so the plan remains explainable and reproducible, and it is removed when you delete the program or your account. It is included in your data export.
• Consent events: 7 years, as required for proof of consent under PDPA and GDPR. The IP address attached to a consent record is removed after 2 years.
• Security audit logs (sign-in events, data-access records, and rate-limit violations, including any IP address and user agent): permanently deleted after 2 years.
• Support messages: kept for up to 2 years for follow-up and record-keeping, then deleted. If you delete your account, the email address and name attached to your support messages are redacted when your account is purged.
• Programs you publish to the community library: these stay visible to other users for as long as your account exists. When your account is purged, the programs you published are deleted along with it and disappear from the library — we do not keep them as anonymous content. There is currently no self-service way to withdraw a published program on its own, so if you want one removed while keeping your account, ask us via the contact form.
• Workout history: your logged workouts are stored for the lifetime of your account, and you may export or delete them at any time. How far back you can view progress charts in the app depends on your plan (Free: recent weeks; Pro: up to 1 year; Elite: your full history) — this affects display only, not what we retain.

13. Your Rights

You have the following rights with respect to your personal data:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Restriction — ask us to limit how we process your data
• Withdraw consent — at any time, without affecting prior processing
• Lodge a complaint — with a competent supervisory authority

14. How to Exercise Your Rights

Most rights can be exercised in-app under Settings → Privacy, including data export and account deletion. For requests that cannot be self-served, use our contact form. We respond within 30 days as required by PDPA and GDPR; where a request is complex we may extend this and will tell you why. We do not charge for exercising your rights unless a request is manifestly unfounded or excessive. We may ask you to verify your identity before acting on a request.

15. Children

RepRoute is intended only for users aged 16 or older. You confirm at sign-up that you meet this minimum age. We set the threshold at 16 so that a single gate satisfies the highest digital-consent age applied across EU member states, as well as Thai PDPA expectations. We do not knowingly collect data from anyone below this age. If we learn that we have collected data from a person below this age without verifiable parental consent, we will delete it.

16. Security

We protect your data with row-level security on every database table, encrypted transport (TLS), encryption at rest by Supabase, JWT-based authentication, server-side rate limiting, and Cloudflare Turnstile bot protection. Service-role keys are held only in server runtime secrets and are never exposed to client code. Uploaded images are validated by file signature, and access to other users' data is logged. No method of transmission or storage is perfectly secure, but we work to protect your data using measures appropriate to its sensitivity.

Breach notification. If a personal-data breach is likely to affect your rights, we will notify the relevant supervisory authority — and, where the breach poses a high risk to you, affected users — without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by GDPR Articles 33–34 and PDPA section 37.

17. Cookies and Similar Technologies

We use only strictly necessary cookies and local-storage entries and run no advertising or analytics trackers, so we do not display a cookie consent banner. A full, itemised list is in our Cookie Disclosure. If we ever introduce a non-essential cookie, we will ask for your consent first.

18. Third-party Links

The Service may link to third-party websites or embed third-party content (for example exercise demonstration videos). We are not responsible for the privacy practices of those third parties, and this policy does not apply to them. Please review their own privacy policies.

19. Complaints and Supervisory Authorities

We would like the chance to address your concern first, so please consider contacting us before lodging a complaint. If you are in Thailand, you may lodge a complaint with the Personal Data Protection Committee (PDPC). If you are in the European Economic Area, you may complain to the data-protection authority of your country of residence, place of work, or place of the alleged infringement.

20. Changes to This Policy

We may update this policy from time to time. When we make a material change we will bump the effective date, notify you by email, and where required by law re-request your consent. Your continued use of the Service after an update takes effect means you accept the revised policy (except where renewed consent is required). The current version is 2026-08-06.