1. The short version
Google Sign-In gives us four things: an account identifier, your name, your email address and a link to your profile picture. Everything else we hold is training you logged yourself. Two outside services are involved, and only two: Google, for the sign-in, and a privacy-first font CDN that serves the typeface.
There is no tracking here
No analytics. No tracking pixels. No advertising. No third-party trackers of any kind. No
payment data. No camera, microphone, photos, contacts, location or health-platform access.
Nothing stored in localStorage. This is not a promise about a
future version — it is a description of the code that is running.
2. Who is responsible for your data
RepDelve is operated by Exotecho, Inc., a company incorporated in Ontario, Canada, registration #1001404294, with its registered office at 145 ½ Church Street, Unit 5, Toronto, Ontario, M5B 1Y4, Canada. We are the data controller for the personal data described here. Reach us at contact@exotecho.com.
3. What we collect
This is the whole list, field by field, as it exists in the database today. If something is not named here, we do not hold it.
From Google, when you sign in
Google Sign-In is the only way into RepDelve. Google tells us four things about whoever approves the sign-in.
- Your Google account identifier, which is how we recognise you on the next visit.
- Your name, as it appears on your Google account.
- Your email address, which we record as verified at that moment because Google has already verified it.
- The web address of your Google profile picture.
Your account
Housekeeping the app needs in order to work at all.
- A password field exists in the database, but it is left empty for Google accounts. RepDelve has no password sign-in form.
- A "remember me" token, so you are not signed out between visits.
- When the account was created and last changed, and when you were last seen in the app.
- Your timezone, read once from your own browser setting during calibration and editable afterwards on your profile. It is what makes "today" mean your today.
Your training
This is the substance of the app, and almost all of it is numbers and fixed choices rather than free text.
- Your calibration max, the date your programme started, and when you finished onboarding.
- Running totals: total reps, total workouts, best single set, current streak, longest streak, and the date you last completed a session.
- The plan you are on and the date you started it.
- Your six onboarding quiz answers. One of them asks what the programme should work around — wrists and shoulders, knees and hips, a fragile lower back, or low energy and poor sleep — so that answer says something about your body. We treat it accordingly.
- The equipment you tell us you own, so sessions only prescribe machines you can reach.
- Your bodyweight in kilograms. This one is optional, you type it yourself, and it is used for exactly one thing: scaling the protein target. Leave it blank and the app falls back to a stated reference figure.
- Which movements you have marked as loved or disliked.
- Whether sound and haptics are switched on.
Each session you train
One row per run, and one row per set inside it.
- Per run: the date, the dungeon and tier, the boss, the target and actual reps, the final open set, your best set, how long it took, when it started and finished, the XP and gold it paid out, and the protein figure it showed you.
- Per set: which exercise, the target and the actual reps or seconds, whether it was a warm-up or the final open set, the rest between sets, how long it took, and when you completed it.
The game layer
Progress in the RPG shell that sits over the training.
- XP, gold, and the deepest dungeon tier you have reached.
- Every item you have looted — its slot, rarity, tier, name, power, affixes, and whether it is equipped.
- Which badges you have earned and when.
Moderation, which we set rather than you
Fields an administrator can write against an account.
- Whether the account is an administrator.
- Whether it is banned, when it was banned, and the reason recorded.
- A free-text private note an administrator can attach to the account.
Technical, per browsing session
Laravel stores sessions in the database, and those rows carry more than the session itself.
- Your IP address and your browser's user-agent string.
- The last page the session was on, which sits inside the stored session payload.
- A session row is written for signed-out visitors too — including for the visit in which you are reading this page.
4. What we do not collect
Absence is worth stating explicitly, because most apps in this category collect all of it.
- No analytics or tracking of any kind. There is no analytics package, no tracking pixel, no advertising network, no session replay, no A/B tooling, no fingerprinting and no third-party error tracker anywhere in the app.
- No payment data. RepDelve does not process payments at all. There is no card handling, no billing provider, and nothing in the app is for sale.
- No device sensors or platform health data. The app never asks for your camera, microphone, photos, contacts or location, and it does not connect to Apple Health or Google Fit. The nose-tap counter is a plain touch event on the screen: nothing is recorded or transmitted about how a tap was produced — no image, no sound, no motion.
- No browser storage beyond cookies. RepDelve uses no localStorage, no sessionStorage and no IndexedDB.
- No email. The app sends no email whatsoever — no marketing, no newsletters, no digests, and no notifications. There is nothing to unsubscribe from.
- No data bought, sold or rented. We do not buy information about you from anyone, and we do not sell, rent or share yours.
5. Why we hold it, and our lawful basis
- To run the service you asked for — building your programme, counting your reps, keeping your history, paying out the game economy. Lawful basis: performance of our contract with you.
- To keep it working and keep it safe — diagnosing faults, spotting abuse, moderating accounts, answering support requests. Lawful basis: our legitimate interests in a functioning, non-abused service.
- Health-adjacent details you volunteer — your optional bodyweight, and the quiz answer about what the programme should work around. Because those describe your body, we treat them as special category data and rely on your explicit consent, given by entering them. You can change the quiz answer by retaking the quiz and clear your bodyweight by emptying the field on your profile. The quiz has no “prefer not to say” option today; Nothing — go hard is the neutral answer.
We do not use any of it to profile you commercially, to advertise to you, or to make an automated decision with a legal effect. The only automation here is choosing your next set.
7. The two outside services
Google — sign-in only
Pressing Continue with Google hands you to Google, and you approve the sign-in there. Google then tells us your account identifier, name, email address and the address of your profile picture. We send Google nothing about your training — not a rep, not a session, not a plan. What Google does on its own side is governed by Google’s privacy policy.
One detail worth being exact about: your avatar is displayed from the address Google gave us rather than copied onto our server, so while you are signed in your browser fetches that image from Google each time it is shown.
fonts.bunny.net — the typeface
The interface font is served by fonts.bunny.net. It is used specifically instead of Google Fonts because it is a privacy-first, GDPR-compliant font CDN that does not log IP addresses and does not set cookies. Your browser does still make a request to it to fetch the font file, which is why it is named here rather than quietly omitted.
Not a recipient: game-icons.net
The item, boss and dungeon artwork comes from game-icons.net, but it is downloaded when the app is built and served from our own server. No request goes to them while you use RepDelve, and they receive nothing about you. They are named here only so you know they are not in the data path.
There is nobody else. No analytics vendor, no error-tracking service, no advertising network, no CRM, no email provider, no marketing tool.
8. Where it lives, and how long we keep it
Everything described in section 3 lives in a single database on the server that runs RepDelve. It is not copied to a third-party managed database, an analytics warehouse, or anywhere else.
Wherever the data sits, the protections in this policy follow it. They do not weaken because of which country a server happens to be in, and they bind anyone we use to keep the service running.
We keep your account and its training history for as long as the account exists. Ask us to delete it and it goes, along with every workout, set, item, badge and preference attached to it — that removal cascades in the database rather than leaving orphaned rows behind. Session rows expire on their own as sessions lapse, and an administrator can end them sooner.
Server backups are kept for no longer than 30 days and then overwritten on a rolling basis, so a deleted account may persist in a backup until that period has run. We do not restore a backup in order to bring a deleted account back.
9. Who can see your data
You can, obviously. Beyond you, the honest answer is that administrators of this installation can see and do a great deal, and you should know exactly what before you decide to sign up. An administrator can:
- See your name, email address, whether the email is verified, when you joined and when you were last active.
- See your training statistics and history, the plan you are on, your quiz answers, and your loot.
- Write a private note against your account that you do not see.
- Ban or unban your account, and record a reason for it.
- Reset your statistics, or reset statistics across every account.
- End your signed-in sessions, and delete your account outright.
- Download the account list as a CSV file. It carries, for every account: identifier, name, email address, administrator and ban status with the ban reason, whether verified, whether onboarded, plan, calibration max, level, XP, gold, deepest tier, total reps, total workouts, best set, both streaks, the date joined and when last seen.
- Sign in as you, to reproduce a problem you have reported. While doing so they see the app exactly as you do.
There is also a live “who is online” screen, which shows an administrator the IP address, a short device description and the last page visited for every active session — including sessions belonging to people who are not signed in.
Nobody outside that gets your data. We do not share it with advertisers, data brokers or partners. We would disclose it only where the law compelled us, and then only what was compelled.
10. Your rights
Wherever you live, you can ask us for a copy of your data, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw a consent you gave earlier. We do not make you prove which law you are relying on before we act.
Because we are Canadian, we rely on your consent under PIPEDA, which you may withdraw at any time; where Quebec’s Law 25 applies we identify the purpose at the point of collection. Where the EU or UK GDPR applies because of where you are, we rely on performing our agreement with you and on our legitimate interest in running and securing the service.
If our answer does not satisfy you, complain to a regulator. In Canada that is the Office of the Privacy Commissioner of Canada, or the Commission d’accès à l’information du Québec if you are in Quebec. In the EU or the UK it is your national data protection authority — in the UK, the Information Commissioner’s Office.
Some of that you can do yourself, right now, without asking us: your timezone, bodyweight, sound and haptics settings, equipment, plan and movement preferences are all editable in the app, and you can retake the quiz at any time. Your name, email address and avatar are not editable here, because they come from Google — change them in your Google account and they update on your next sign-in.
For anything else, email contact@exotecho.com. We will respond within one month. Exercising any of these rights costs you nothing, and we will not treat you differently for it.
11. If you are in California
In plain English, for California residents:
- We have never sold or shared your personal information, and we do not do so now. There is no “do not sell” link because there is nothing to opt out of.
- The categories we collect are: identifiers (name, email address, Google account identifier, IP address), internet activity (the last page a session visited, your user-agent string), and health-adjacent information you volunteer (bodyweight, the quiz answer about what the programme should work around).
- You can ask what we hold, ask for it to be corrected, and ask for it to be deleted. We will not deny you the service, charge you, or give you a worse experience for asking.
- There are no financial incentives, loyalty schemes or discounts tied to your data.
12. Getting a copy, and deleting your account
Being straight with you: there is no self-serve download button and no self-serve delete button in RepDelve today. We are not going to describe one that does not exist. Both requests are handled by a person, by email.
Email contact@exotecho.com from the address on your account and say which you want:
- A copy of your data. We will send you everything held against your account in a machine-readable file.
- Deletion. We delete the account together with every workout, set, item, badge and preference attached to it, and end any signed-in sessions. We will confirm when it is done. Consider taking a copy first, because it cannot be undone.
When self-serve export and deletion are built, this section will change to describe them. Until then, email is the route.
13. Children
RepDelve is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from under-16s. If you believe an account belongs to someone under 16, tell us at contact@exotecho.com and we will delete it.
14. Changes to this policy
If what we collect or what we do with it changes, this policy changes with it and the “last updated” date at the top moves. Where a change is material we will make it visible in the app.
RepDelve sends no email at all, so we cannot notify you that way — this page is the place to check.
15. Contact
Any question about this policy, any request about your data, and any complaint goes to contact@exotecho.com, or by post to 145 ½ Church Street, Unit 5, Toronto, Ontario, M5B 1Y4, Canada. There is no in-app contact form today.