Privacy Policy
Last updated October 29, 2026
Effective date: October 29, 2026
Who we are and what this covers
RepStar ("RepStar", "we", "us") is an app at repstar.app that personal trainers use to write workout programs, book sessions, track progress and message their clients. It is run by Ron Starr, doing business as RepStar, in Campbell, California.
This policy explains what we collect, why, who we share it with and the choices you have. It covers two kinds of users:
- Trainers, who create an account, add clients and run their business in RepStar.
- Clients, whose trainer adds them to RepStar and who may join with their own login.
Questions: support@repstar.app.
Information we collect
| What | Examples | Who provides it |
|---|---|---|
| Account details | Name, email, password (stored scrambled, never readable), role (trainer or client) | You |
| Trainer business details | Business name, gyms and equipment, packages and prices, invoices, public profile (bio, photo, certifications, contact links) | Trainers |
| Client profile | Name, email, birthday, sex, height, activity level, goals, injuries or limitations, trainer notes | Trainers and clients |
| Health and fitness data | Workouts logged, weights and reps, body measurements (weight, body fat, lean mass and similar), body-scan reports (DEXA, InBody), progress photos, food logs, nutrition goals and habits, meal photos | Trainers and clients |
| Scheduling and sessions | Booked sessions, check-ins, cancellations, sessions bought and remaining, payments recorded | Trainers |
| Messages | Messages, reactions and attachments (photos, videos, PDFs) between a trainer and a client | Trainers and clients |
| Things you ask Spot | Requests typed or dictated to Spot, RepStar's AI assistant, and its replies | Trainers |
| Technical data | Log-in times, device and browser type, IP address, error reports | Collected automatically |
We do not collect payment card numbers. If card payments are added later, they will be handled by Stripe, and this policy will be updated first.
How we use it
We use information only to run RepStar and keep it safe:
- To provide the app: show programs, log workouts, book sessions, track progress, send messages.
- To send emails you'd expect: sign-up and password links, session reminders, invoices, invites and new-message alerts. Message alerts never include the message itself.
- To show browser notifications you choose to turn on, such as a new message or a client finishing a workout. They never include the message itself.
- To keep accounts secure: CAPTCHA checks, daily limits, and investigating misuse.
- To fix problems and improve the app.
We do not sell personal information, share it for advertising, or use health data for marketing.
Trainers and their clients
A trainer decides which clients to add and what to record about them. The trainer can see and edit their clients' records, except a client's own progress photos that the client hasn't chosen to share. A client can see their own records, and can disconnect from a trainer they don't recognize.
Trainers are responsible for having their clients' permission to add them and record their information. A client with questions about their records should ask their trainer first, or contact us.
Health data, photos and AI features
Fitness and body data is sensitive, so we treat it with extra care:
- Permission. Trainers must have each client's permission before recording their health and body information. A consent step for clients inside RepStar is coming soon.
- Progress photos. Photos a client adds are private to them unless they turn on "Share with my trainer". Photos are stored in private storage and shown only through links that expire after 15 minutes.
- Meal photos. When a client (or their trainer) takes a photo of a meal to log it, a small copy is kept with that day's food log so the client and their trainer can look back at it. Only they can see it. It's stored in private storage, shown only through links that expire after an hour, and deleted automatically after 90 days. The foods logged from it stay.
- Location data in photos is removed from face, meal and scan-report photos before they're uploaded.
AI features
Some features send information to Anthropic, the company that makes the Claude AI model, to do their job. Each one says so next to the button.
| Feature | What is sent | When |
|---|---|---|
| Scan reading | The body-scan report (PDF or photo) | When someone taps "Read the report" |
| Program import | The program file, screenshots or pasted text | When a trainer imports a program |
| Bio writer | The trainer's notes and name | When a trainer taps "Write it for me" |
| Meal reading | The meal photo, or the meal as typed (for example "2 eggs and toast") | When someone takes a meal photo or taps "Estimate" in the food log |
| Spot (AI assistant) | The trainer's request and what's on their screen, such as a program, client names, bookings and sessions remaining | Each time a trainer asks Spot something |
AI features are never used for clients known to be under 18. Under Anthropic's commercial terms, this information is not used to train their models.
Who we share it with
We share information only with the companies that run parts of RepStar for us, only as needed for their job, and under contracts that require them to protect it:
| Company | What they do for RepStar | Where |
|---|---|---|
| Supabase | Database, logins and file storage | United States (Northern California) |
| Vercel | Hosts the website | United States |
| Resend | Sends emails | United States |
| Anthropic | AI features (see above) | United States |
| Deepgram | Turns what a trainer says to Spot (using the microphone button) into text. RepStar does not keep the recording. | United States |
| USDA FoodData Central | Food search: the words typed into food search, or a scanned barcode number. No names or account details are sent. | United States |
| Open Food Facts | Looks up a scanned barcode number when USDA doesn't know the product. Only the barcode number is sent. | France (worldwide service) |
| Cloudflare | CAPTCHA "are you human?" check on log-in and sign-up | Worldwide network |
| YMove | Exercise demonstration videos, streamed from their servers when you press play | United States |
| Stripe | Card payments, if added later | United States |
We may also share information if the law requires it, to protect someone's safety, or as part of a sale or merger of RepStar (the buyer would have to keep this policy's promises). We never sell personal information.
Clients under 18
Trainer accounts are for adults only. A trainer may add a client under 18 only with a parent or guardian's permission. When a client's birthday shows they're under 18, RepStar automatically turns off:
- progress photos,
- message attachments,
- invitations to create their own login,
- reminder emails,
- nutrition tracking and meal photos,
- and every AI feature.
We don't knowingly collect information from children under 13. If you believe we have, contact us and we'll delete it.
Security, keeping and deleting data
How we protect it. All traffic is encrypted, and stored data is encrypted by our database provider. Database rules check every request, so a trainer can only reach their own clients and a client only their own records. Admin accounts use two-factor sign-in, and RepStar had an independent security review in October 2026. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.
How long we keep it. We keep information while the account is open. When a trainer removes a client, that client's records are deleted. When an account is closed, we delete its information within 30 days, except what we must keep by law (such as invoice records). Backup copies are replaced on a rolling basis and are gone within 7 days after that. Meal photos are deleted automatically 90 days after they're taken.
Deleting your account. Email support@repstar.app from the address on your account.
Your choices and rights
Everyone can:
- See and correct their information in the app, or ask us for a copy.
- Delete their account and information (see above).
- Turn off optional emails, such as message alerts, by emailing support@repstar.app, and turn browser notifications on or off on the Messages page.
- Keep progress photos private by leaving "Share with my trainer" off.
California residents
Under the California Consumer Privacy Act (as amended by the CPRA), you have the right to know what personal information we collect and why, to get a copy, to correct it, to delete it, and to limit how sensitive information (such as health data) is used. We don't sell or share personal information for advertising, and we use sensitive information only to provide RepStar. We won't treat you differently for using these rights.
To use any of these rights, email support@repstar.app. We'll confirm it's you and answer within 45 days. A client's request about records their trainer keeps may be passed to that trainer as well.
Changes and contact
If we change this policy in a way that matters, we'll email account holders and show a notice in the app before the change takes effect. The date at the top shows the latest version.
Contact: support@repstar.app · Ron Starr, doing business as RepStar