Privacy Policy

Last updated: August 13, 2026

Washington residents: RepQuest also maintains a separate Consumer Health Data Privacy Policy, required under Washington's My Health My Data Act — jump to it directly, or find it linked from the homepage footer too.

What data RepQuest collects

• Workout data you log manually, or — with your explicit permission — read from Apple Health / Google Health Connect (type, duration, intensity). RepQuest only reads this data; it does not write anything back beyond what you log in-app.
• Gameplay data: level, XP, Reward Points, unlocked cosmetics.
• An anonymous account identifier created automatically on first launch. If you link Sign in with Apple/Google, we receive only the minimal identifier those services provide — no password is ever created or stored.

How this data is used

Your recent workout history is sent to our AI quest-generation service (built on OpenAI's API, called through our own secured server — your data is never sent directly to OpenAI from your device) so it can write a quest that reacts to your real training pattern.

What we do NOT do

• We do not use Health/Health Connect data for advertising or ad targeting, on any tier.
• We do not sell your data to data brokers, advertisers, or any third party.
• We do not share Health data with any third party beyond the minimum necessary to generate your quest text, and never in a form that identifies you personally.

Your rights, by region

EU/UK (GDPR): access, correction, erasure, portability, and objection. India (DPDP Act): access, correction, erasure, and easy consent withdrawal. Australia/NZ (Privacy Act regimes): access and correction. Japan (APPI): disclosure, correction, and deletion. UAE (PDPL): access, correction, deletion, and objection to direct marketing. Everywhere else: the same practical rights apply as a baseline. Since most accounts are anonymous by design, verifying identity for a request is intentionally lightweight.

Your controls

Revoke Health/Health Connect access anytime from your device Settings — RepQuest falls back to manual logging. Request account deletion anytime by emailing the address below; we delete within 30 days.

Security

The AI provider's API key lives only as an encrypted secret on our server infrastructure — never in the app, never on your device. All traffic between the app and our backend uses HTTPS/TLS. No advertising code has access to Health data, ever — this is enforced architecturally, not just promised.

International data transfers

Our backend providers operate globally, which can mean data is processed outside your country, including the United States. Appropriate safeguards apply where required; this section is finalized ahead of a full public launch.

Advertising

RepQuest shows ads based on general, non-health data only. Any future personalized advertising would require your explicit platform-level permission first (e.g. Apple's App Tracking Transparency).

Children's privacy

RepQuest is not directed at children and does not knowingly collect data from anyone under the applicable minimum age in their jurisdiction.

Data retention

Workout and gameplay data is kept for as long as your account is active, so your character and history stay intact. If you request deletion, everything tied to your account is removed within 30 days. Anonymous, aggregated figures (like the community charity pool total) are not personal data and are retained after individual account deletion.

Third-party service providers

RepQuest runs on a small set of infrastructure providers: Supabase (database and authentication), Cloudflare (backend API), and OpenAI (quest text generation, called only through our own server — never directly from your device). Each processes only the minimum data needed to do its job, under its own security and privacy commitments.

Consumer Health Data Privacy Policy

A separate policy, required under Washington State's My Health My Data Act (MHMDA) for apps handling "consumer health data" — kept distinct from the general Privacy Policy above, not just a section buried inside it. Last updated: August 13, 2026.

This document is written to satisfy MHMDA's requirements as precisely as we can manage in-house, but is not a substitute for review by a Washington-licensed attorney ahead of a public launch — MHMDA carries a private right of action, so Washington residents can sue directly, not only via the state Attorney General.

1. What counts as "consumer health data" here

Under MHMDA, "consumer health data" is defined broadly enough to include fitness and exercise information, not just clinical health records. In RepQuest, this covers:

• Workout data you log manually (type, duration, intensity, notes).
• Any Apple HealthKit / Google Health Connect data you've authorized RepQuest to read (currently: step count and workout history), to the extent it reflects your physical activity.
• Any inference RepQuest's AI derives from the above (e.g., a generated quest referencing a training pattern), since MHMDA treats data derived from health information the same as the underlying data itself.

2. What RepQuest does with this data

• Used to calculate in-app XP, gameplay progress, and to generate AI quest/recap text personalized to your recent activity.
• Read-only: RepQuest never writes anything back to Apple Health or Google Health Connect.
• Never used to build an advertising profile, never used to target ads, and never sold to any third party, under any circumstance, on any tier (free or paid).
• Shared only with the specific sub-processors needed to operate the feature itself, each under its own data processing agreement: Supabase (database storage), Cloudflare (the server that relays requests, so your device never talks to the AI provider directly), and OpenAI (quest-text generation only — receives the workout summary needed to write that one quest, nothing else). No sub-processor is permitted to use this data for its own purposes.
• Never shared with data brokers, and never used for any purpose beyond making the in-app features you're actively using work.

3. Your consent

RepQuest asks for your explicit, separate consent to this policy before reading any Health/Health Connect data — this happens on first launch via a dedicated consent screen with its own checkbox (distinct from the general age-eligibility checkbox and distinct from accepting the Terms & Conditions). This consent is not bundled into or implied by onboarding, general Terms & Conditions acceptance, or continued use of the app.

RepQuest treats collection and sharing of this data as two separate things, not one bundled event: your consent screen covers RepQuest collecting Health/Health Connect data from your device. Separately, RepQuest shares a workout summary with Supabase, Cloudflare, and OpenAI as processors acting on RepQuest's behalf, under signed data processing agreements with each — this is what lets that sharing happen under the collection consent you already gave, rather than requiring a second consent screen, and it's limited strictly to what those processors need to do their job.

You can withdraw consent at any time by:

• Revoking RepQuest's Health/Health Connect access in your device's Settings app, and/or
• Deleting your account and data entirely via Profile → Delete My Data.

Withdrawing consent stops future collection; it does not retroactively undo processing that already occurred, though you can also request deletion of previously collected data (see Section 5).

4. Retention

Workout summaries sent to generate a quest or recap are used transiently to produce that response and are not retained by RepQuest's backend beyond what's needed to serve the request. Gameplay data derived from your activity (level, XP, RP) is retained only for as long as your account is active.

5. Your rights

Regardless of where you live, you have the right to:

• Confirm whether RepQuest is processing your consumer health data.
• Access the consumer health data RepQuest has collected about you — on request, we'll also provide the specific list of third parties and affiliates that received it (in practice: Supabase, Cloudflare, and OpenAI, as described in Section 2 above — that list doesn't change person to person).
• Withdraw consent to collection or sharing of this data (see Section 3).
• Request deletion of your consumer health data — via Profile → Delete My Data (immediate, in-app, no need to email support), or by emailing the address in Section 7.
• Appeal a denial of any of the above rights, by replying to RepQuest's response to your original request; RepQuest will respond to an appeal in writing, with the reason for the denial, within a reasonable time.

RepQuest does not charge a fee for exercising these rights and does not require you to create an account you don't already have in order to exercise them.

6. No geofencing around health facilities

RepQuest does not use geofencing (or any other location-based targeting) around mental health facilities, reproductive or sexual health facilities, or any other health care facility, for any purpose — including advertising, identifying, or tracking consumers. RepQuest does not collect precise location data at all (see Section 1 of the main Privacy Policy above).

7. Contact

support@repquestapp.com — for any question about this policy, or to exercise any right described in Section 5.

8. Changes to this policy

Material changes will update the "Last updated" date above. If a change would expand how consumer health data is used or shared beyond what's described here, RepQuest will seek fresh, affirmative consent before the change takes effect, not simply update this document silently.

This Consumer Health Data Privacy Policy is designed to be read together with, and does not replace, RepQuest's main Privacy Policy above and Terms & Conditions. Where the two differ on consumer health data specifically, this policy controls.

Changes to the main Privacy Policy

If this policy changes in a material way, the "Last updated" date above will change and, where required, we'll let you know in-app before the change takes effect.

Contact

Questions, data requests, or anything else — visit the Contact page or email support@repquestapp.com directly.

This policy accurately describes RepQuest's actual data practices but is not a substitute for jurisdiction-specific legal advice.