Privacy Policy

1. Who is responsible

RepContext is operated by FJORD HEALTH LTD, registered in England and Wales with company number 15072260. Our registered office and correspondence address is 17 Poplar Place, Newcastle Upon Tyne, NE3 1DR, United Kingdom.

FJORD HEALTH LTD is the controller of personal information used to operate RepContext. Contact us at support@repcontext.com or the address above about privacy or your information.

This policy covers our website, account service and connected training tools. RepContext is intended for UK residents aged 18 or over. ChatGPT is our only supported AI service and workout interface; the website handles accounts, subscriptions, settings and support.

2. Information we receive and keep

• Account and sign-in information: your account identifier, email and identity information supplied through Google sign-in, which can include your name and profile image. Accounts with a RepContext password can also sign in by email and password. Supabase verifies passwords and handles identity and session records; our website passes sign-in credentials securely to Supabase and does not store plaintext passwords in the training database. We never ask for your Google password.
• Subscription information: Stripe customer, subscription and price identifiers, payment/access status, billing dates, cancellation status and billing-event records. Stripe collects payment details through hosted checkout and its billing portal. RepContext’s database does not store full card numbers or card security codes.
• Training information: goals, experience, equipment, available time, ordinary preferences and constraints, unit preferences, exercises, programmes, schedules and suggested targets you choose to save.
• Workout and progress information: dates, sets, repetitions, loads, durations, recorded effort and its source, technique feedback, ratings, notes and bodyweight measurements you choose to log. This also includes saved session reviews, next-session recommendations and review-delivery status. Earlier plans, scheduling changes, corrections and unticked sets can remain in revision or change history.
• Connection and technical information: client registrations, approved permissions, hashed authorization codes and refresh tokens, expiry/revocation records, authentication cookies and operational information such as request times, IP addresses, browser/device information and errors processed by our infrastructure providers.
• Support information: your email, correspondence, attachments and account details you send, and records needed to handle your request.

Sources include you, Google/Supabase sign-in, Stripe billing events and the specific requests ChatGPT sends when you use RepContext. Account identity is necessary to provide an account; subscription information is necessary for paid access. Optional measurements and notes are not required to create an account. Missing training information may limit features that depend on it.

3. Why we use information

• Providing your requested service: authenticating accounts, managing subscriptions and permissions, saving/retrieving training records and resolving service requests. Where necessary for this, our lawful basis is performance of our contract with you or steps you request before entering it.
• Meeting legal obligations: keeping required accounting records, responding to applicable data-rights requests and complaints, and complying with binding legal requirements.
• Security and administration: investigating failures, preventing misuse and unauthorized access, maintaining limited operational records and establishing or defending claims where necessary. Our basis is our legitimate interests in running a secure, reliable service and resolving disputes, subject to your rights and reasonable expectations.

OAuth approval permits ChatGPT to use the approved tools. It is not blanket consent for unrelated processing or medical-data storage. RepContext does not operate advertising or marketing analytics and does not sell personal information. Providers still process technical information to deliver, secure and troubleshoot their services.

ChatGPT generates training suggestions using the information available to it. RepContext supplies records and stores requested results; it does not run a separate AI model to generate your advice. We do not use RepContext data to make solely automated decisions with legal or similarly significant effects.

4. Fitness information and medical details

RepContext is a general fitness service, not a medical-record system. Do not ask it to save diagnoses, injuries, symptoms, treatment or rehabilitation details in notes, profile fields or support attachments. ChatGPT is instructed to keep medical explanations out of requests to RepContext and send only necessary training instructions or ordinary data you ask to log.

These instructions are not a technical filter. Free-text submissions can contain medical details, and bodyweight or other training information may reveal health information depending on context. Contact us to request removal of medical details saved unintentionally, including from relevant change history. OpenAI handles information retained by ChatGPT separately.

5. Providers and sharing

• Google and Supabase: Google provides sign-in; Supabase provides authentication and the database for account, connection and training records.
• Stripe: provides checkout, recurring payments and the billing portal. We send your account email and identifier to associate billing with you. Stripe also has its own payment, fraud-prevention and legal purposes under its privacy policy.
• Vercel and Railway: Vercel hosts the website and account/authorization functions; Railway hosts the connected training server. They process information passing through those services and associated operational records.
• Email delivery: Resend sends account confirmation, password-reset, deletion-verification, deletion-status and support messages. Cloudflare provides DNS and forwards incoming support email to our Google-hosted inbox. Sender and recipient details, message content and attachments pass through the relevant email services.
• Google Fonts: your browser requests website fonts from Google’s font services, sending connection information such as your IP address and browser headers.
• OpenAI/ChatGPT: when connected, ChatGPT can read and update training information covered by your approved permissions. RepContext receives specific tool arguments and returns requested records or results. It does not have general access to complete conversations or ChatGPT Memory.

OpenAI’s handling of conversations and returned information is governed by its privacy policy and your ChatGPT settings. We cannot control OpenAI’s retention or model-improvement settings. Deleting from RepContext does not remove copies already in conversations.

Hosting and database providers process service data on our behalf. Some providers, including Google, Stripe and OpenAI, also have independent responsibilities for their own services. We may share limited information with professional advisers or authorities where necessary for legal obligations or establishing, exercising or defending legal claims.

6. Where information is processed

Our primary Supabase database is in London. Website functions, connected-service hosting, email and provider infrastructure or support may process information outside the UK, including in the United States.

Our providers’ standard data-processing terms include transfer provisions, such as standard contractual clauses and the UK addendum where applicable. Ask us about the safeguards applicable to your data and how to obtain a copy. Provider terms are available from Supabase, Stripe, Vercel, Railway and Cloudflare.

7. Cookies and browser requests

Necessary authentication and security cookies keep you signed in and protect account connection. Supabase manages and refreshes sign-in/session cookies; the library sets a cookie lifetime of up to 400 days, although session and token validity are controlled separately. The temporary RepContext connection-consent cookie expires after ten minutes or is cleared when the request completes. Blocking necessary cookies can prevent sign-in or connection.

We do not set advertising or marketing-analytics cookies. Google sign-in, Stripe’s hosted pages and ChatGPT use their own technologies under their notices. Google Fonts makes external requests even before sign-in. Manage cookies in your browser and through the relevant provider’s controls.

8. Retention and deletion

• Account and training records: while subscribed, then up to 12 months after access ends, unless you request deletion sooner. Never-subscribed accounts are kept up to 12 months after creation. This includes plans, schedules and change history.
• Deletion request records: we keep a minimal restricted record of verification, processing, provider references and retention exceptions, normally for up to twelve months after closure. Recovery instructions remain available while relevant recoverable copies exist. Necessary billing evidence supports the one-time first-purchase guarantee; we do not retain training histories for this purpose.
• Ordinary support correspondence: up to 12 months after closure. Where a record is needed for a legal obligation or ongoing dispute, we retain only what is necessary for that purpose.
• Required accounting records: generally six years from the end of the company financial year they relate to, or longer where legally required. This does not justify retaining full training histories.
• RepContext-owned backups and temporary exports: no more than 30 days after creation. Expired/revoked OAuth records are kept no more than 30 days after expiry or revocation. Exports are removed sooner when no longer needed.

Hosted backups and provider operational logs have separate retention arrangements. Supabase currently provides daily backups with a recent seven-day recovery window. Deletion from the active database does not immediately rewrite backups. Recovery copies are restricted to recovery use; completed deletions must be reapplied before a restored service resumes. Contact us for information about provider-held copies relevant to your request.

In Settings, “Clear training data” permanently removes your workouts, programmes, measurements, custom exercises, schedules and training profile after verification and confirmation. It keeps your account, subscription and ChatGPT connection. Necessary reset receipts are retained for up to twelve months, with the same backup and legal exceptions described above.

You can request account deletion from website Settings when self-service is enabled, or contact support. After identity verification and explicit confirmation, we immediately block RepContext access, request billing cancellation and begin permanent deletion. Active records, refunds and remaining provider or backup actions are tracked separately, including retries and necessary exceptions. Ordinary subscription cancellation and disconnecting ChatGPT do not delete your account or training history.

9. Your controls and rights

Change supported training information through ChatGPT and unit preferences through account settings. Unticking or correcting a set may retain earlier values in change history; contact support to request removal of the underlying history.

You can disconnect RepContext in ChatGPT. This does not cancel billing or erase records. When a connection token is revoked, an already-issued access token may remain valid until expiry, for up to one hour. Ordinary subscription cancellation is separate from account deletion. Confirmed account deletion blocks existing RepContext access tokens immediately, revokes connection credentials and includes billing cancellation; deleting your account does not remove conversations in ChatGPT.

UK data-protection law gives rights, subject to applicable conditions and exceptions, to access and receive copies, correct inaccuracies, request erasure or restriction, and receive eligible data in a portable format.

Your right to object: you can object to legitimate-interests processing for reasons relating to your situation. We must stop unless overriding lawful grounds or the need for legal claims justify continuing.

Send requests to support@repcontext.com with your account email and what you need, not passwords, card details or sign-in codes. You can clear training data or delete your account in Settings. Exports and other privacy requests are handled through support. We may need proportionate identity evidence. We normally respond within one month, subject to permitted identity checks, clarification and extensions, and explain any applicable extension or refusal. Requests are normally free.

Raise privacy complaints at the same address. We acknowledge them within 30 days, investigate and communicate the outcome without undue delay. You can also complain to the Information Commissioner’s Office.

10. Security and changes

RepContext uses authenticated access, per-account database queries and restricted access to service records. No online service guarantees absolute security. Protect your Google account and any RepContext password, and contact support if you suspect unauthorized access.

We update this policy when practices change and show the effective date above. We bring material changes to your attention through the service or an appropriate direct notice before they take effect where required. See the Terms of Service for subscription terms.