OverRep Privacy Policy
Last updated: 19 August 2026 Data controller: Carlos Oronoz, an individual developer established in the Netherlands ("OverRep", "we"). Contact: support@overrep.app
The short version
Your workouts stay on your device. OverRep has no accounts and no server that stores your training data. We collect only pseudonymous diagnostics (usage analytics only if you opt in) and subscription-validation data. No ads, no selling of data, no tracking across other apps.
1. Data that stays on your device
Your routines, logged sets, training profile, preferences, and optional body weight are stored in a local database on your device. We cannot access this data. It is deleted when you delete the app or use Settings → Reset all data, and is included in your device backups per your own iOS settings.
2. Usage analytics — only with your consent
If you opt in to "Share usage data" (asked at first launch; changeable anytime in Settings → Privacy), we collect pseudonymous usage events via Google Firebase Analytics — e.g., workouts started/finished, sets logged (weight, reps, RIR), features used — linked to a random identifier, never to your name, email, or advertising ID (we do not use the IDFA). Switching the toggle off stops collection immediately, with no effect on app functionality. Retention: 14 months.
3. Crash reports
To keep the app stable, we collect crash diagnostics via Google Firebase Crashlytics: device model, iOS and app version, crash traces, and the same random identifier. Crash reports contain no workout content or contact details, and are retained for up to 90 days. You may object to this processing at any time via the contact above.
4. Purchases
Purchases are processed by Apple through your Apple ID; we never see your name or payment details. Our provider RevenueCat receives your purchase history linked to a random anonymous identifier, solely to validate your subscription, and retains it for as long as needed to keep your purchases working and to meet legal obligations.
5. Exercise animations
Exercise animations load from our content delivery network (Cloudflare); your IP address is processed transiently to deliver them, as with any internet content.
6. Legal bases (GDPR)
| Processing | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Usage analytics | (a) Consent — opt-in, withdrawable in Settings → Privacy |
| Crash reporting | (f) Legitimate interest in a functioning, stable app |
| Subscription validation | (b) Performance of contract |
| CDN content delivery | (f) Legitimate interest in delivering app content |
We process no special categories of personal data (Art. 9); your optional body weight never leaves your device.
7. Processors, transfers, and security
Our processors under data-processing agreements are Google (Firebase), RevenueCat, and Cloudflare. Transfers to the United States rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses (GDPR Arts. 45–46); you can request a copy of the applicable safeguards via the contact above. We minimize what we collect by design; no transmission method is 100% secure, but the data we hold is pseudonymous and limited.
8. Your rights
Because we are established in the Netherlands, the GDPR applies to our processing wherever you are located: you have the rights of access, rectification, erasure, restriction, portability, and objection, and may withdraw consent at any time — contact support@overrep.app. You may complain to a supervisory authority; ours is the Dutch Autoriteit Persoonsgegevens. Because the data we hold is not linked to your identity, we may be unable to match a request to specific data (GDPR Art. 11) — but you control everything directly: your training data is on your device, the analytics toggle stops collection instantly, and deleting the app removes all local data.
US residents: we do not sell or share personal information or use it for targeted advertising. OverRep is currently below the applicability thresholds of the CCPA/CPRA and similar state laws; we honor access and deletion requests regardless, where we can associate data with you.
9. Children
OverRep is not directed at children under 13 and we do not knowingly collect their data; contact us for deletion if you believe a child has provided any.
10. Changes and contact
Changes will be posted here with an updated date; material changes will be announced in the app.
Carlos Oronoz · Netherlands · support@overrep.app