GReps Strength Privacy Policy

Information collected

• Identifiers and contact information, such as name, email address, telephone number, mailing address, and account identifiers.
• Purchase and transaction information, including membership, payment status, billing dates, session credits, refunds, and transaction identifiers. The payment provider depends on where and how you purchase, and may include Stripe, Apple, or Google. Providers process payment credentials; GReps receives transaction and membership information needed to administer service, rather than your complete card number.
• Fitness and wellness information provided through profiles, intake forms, check-ins, messages, consultations, and coaching, including goals, exercise history, completed sets, repetitions, loads, recorded and estimated strength results, injuries, pain reports, restrictions, preferences, equipment, training locations, schedules, and performance records. Coaches may enter or update records on an athlete's behalf.
• Communications, support and deletion requests, appointments, signed agreements and waivers, reviews, and survey responses. If you choose Scan My Gym, we also process the photo you submit and equipment information you confirm.
• Website and app device information, such as IP address, browser or app version, pages or features used, referring page, authentication cookies, and diagnostics. If additional analytics, advertising, or tracking technologies are enabled, GReps will provide applicable notices and choices.

How information is used

• Provide, personalize, and administer programming and coaching, including athlete and coach accounts, assigned-athlete access, workout logging, progression, equipment records, and optional AI features subject to the choices below.
• Process payments, schedule appointments, manage memberships, and maintain business records.
• Respond to questions, provide support, and communicate service information.
• Improve services, troubleshoot, prevent misuse, protect accounts, and comply with legal obligations.
• Send marketing communications when permitted; recipients may unsubscribe from promotional email.

Service providers and disclosures

GReps uses providers to host and operate the app, authenticate users, store records, process purchases, and deliver selected features. Website operations use Start Dancing/vibeCMS. The app provider inventory includes Cloudflare for application hosting and backend services, Supabase for authentication and associated account services, Stripe for applicable web and session payments, Apple or Google for applicable store purchases, Google for optional Calendar and Gemini features, OpenAI for the optional external ChatGPT connection, and YouTube for embedded exercise demonstrations. Listing a provider does not mean every customer uses it. The information disclosed depends on the service used.

Existing website or coaching operations may also use Superset, Tally, Squarespace, Kit, and Google Workspace. Provider processing is subject to applicable configurations, contracts, and privacy terms. This Policy does not promise that every provider offers the same retention, training, or deletion terms.

GReps may also disclose information when reasonably necessary to comply with law, respond to lawful process, protect rights or safety, investigate fraud or misuse, complete a business transaction, or with the customer's direction or consent.

No sale of personal information

GReps does not sell personal information for money. If GReps enables activities that constitute a sale, sharing for cross-context behavioral advertising, targeted advertising, or another regulated disclosure, GReps will provide applicable notices and choices. Public availability of an embedded video does not eliminate privacy implications of loading its player.

Fitness and health information

Fitness and health information may be sensitive. GReps provides fitness coaching, not healthcare, and does not represent that all records are covered by HIPAA. GReps uses this information for requested services and seeks separate consent where required for additional collection, sharing, or optional AI use. Access to athlete records is intended for authorized personnel with a service need. The intended coach model limits each coach to assigned athletes, with owner access for administration and oversight.

Optional AI-assisted coaching

For its planned store-app launch, GReps will offer separate optional permissions for sharing athlete information with the external ChatGPT connection and Google Gemini. These planned controls will explain the information, purpose, recipient, and withdrawal method and record the choice before relevant athlete data is shared. General waiver acceptance, membership purchase, or a coach authorizing an integration does not substitute for required athlete permission.

Currently, a separate photo-processing consent is required before a Scan My Gym submission, and a coach must confirm a generation-consent checkbox before Gemini workout generation. The separate athlete controls for opting into or withdrawing Gemini or ChatGPT sharing are not yet available.

If you decline or withdraw optional AI sharing, GReps can use generic templates containing no identifying athlete information and personalize or assign them manually. You retain the coaching benefits promised by your plan without an AI opt-out surcharge. The speed or range of AI-supported adjustments may be reduced, but declining permission does not make the coaching promised by your plan unavailable.

External ChatGPT connection

A coach initiates and authorizes the external ChatGPT connection and chooses permissions and athlete scope. When authorized tools are used, the GReps backend returns permitted athlete information to ChatGPT. Depending on scope and the request, this can include names and identifiers, experience, assigned routines and prescribed workouts, coaching rules, restrictions, preferences, exercise instructions, equipment and training locations, scheduled workout dates, and optional history such as sets, loads, preparation, corrections, and substitutions. Free-text fields can contain identifying or sensitive information.

The reviewed programming tools exclude email, billing records, raw intake answers, signed waivers, and session notes from normal structured responses. This does not guarantee that free-text entries contain none of those details. Coaches must avoid unnecessary personal information.

The observed integration is ChatGPT accessing GReps tools through an external connection; this is not evidence of an app request to an OpenAI inference API. Processing depends on the specific ChatGPT account or workspace, account tier, applicable provider terms, and retention and training settings. OpenAI API data protections do not automatically apply because a connection uses OAuth or is called an AI connector.

Coach permissions may include reading, proposing changes, publishing certain programming changes under standing authorization, and rollback. Some routine updates can therefore be published without separate approval for every change. The planned sharing controls limit coach authorization to valid athlete sharing permission. Withdrawal through those controls is intended to stop future access or sharing; it does not automatically erase data previously received by a provider. Requests to delete information already received by a provider may require that provider's applicable deletion process.

Google Gemini workout assistance

A coach initiates workout and routine generation. The request is sent to Google Gemini through the Gemini Developer API to create draft programming. Depending on the request, it can include training goals, coach instructions and policies, experience, screened exercise choices, equipment information, preferences, restrictions, current and prior routines, setup settings, approved substitutions, and recent completed workout history, including weights and repetitions. Restriction records and preference notes are free text and may include injury or pain information. The request has no dedicated athlete-name or athlete-ID field, but names or other identifying information can appear in routine names, instructions, or other text. This information is not anonymized or automatically redacted. Instructions can still reveal personal information and must be limited. Generated workouts are drafts for coach review before assignment. This is separate from the external ChatGPT connection described above.

Optional voice dictation may use your browser's built-in speech service. GReps does not record raw dictation audio. Transcript text you review can become generation instructions sent to Gemini.

Scan My Gym

An athlete or coach may choose to submit a gym photo to Google Gemini for equipment recognition. A separate photo disclosure and affirmative consent are required before submission. Scan My Gym sends the prepared equipment photos, recognition instructions, and a photo-count prompt to Gemini. Athlete and location identifiers are used by GReps servers for access checks and are not forwarded to Gemini, and the scan request does not add athlete history or gym addresses. Avoid photos containing people, documents, or unnecessary identifying details. The reviewed app resizes and re-encodes the submitted image and saves derived equipment information after confirmation; it does not intentionally persist the source image in the reviewed flow. Re-encoding removes original filenames and embedded EXIF and GPS location data, but people, addresses, or other details visible in the photo remain visible. Provider retention follows the applicable terms and settings. A store:false request does not establish zero retention or exclusion from all provider logging.

Google processes information submitted through these Gemini features under the applicable Gemini API terms and Google's privacy practices, including the Gemini API Additional Terms of Service and the Google Privacy Policy. Whether Google may use submitted information to improve its products, and how long it is kept, can depend on the service tier and account settings that apply.

Google Calendar connection

A coach may separately connect Google Calendar for scheduling and synchronization. The connection requests calendar-list, calendar-event, and free/busy access; event content and synchronization must be limited to the disclosed scheduling purpose. Access can be disconnected through available integration controls or revoked through Google account permissions. Disconnecting does not establish that previously created events or retained business records are deleted.

Retention and security

During an active membership, GReps retains information needed to provide service. Under the planned store-app access rules, ordinary workout logging and program access will stop after the paid access period ends. For 90 days after that date, the planned member export is a PDF containing individual exercise results, heaviest actually logged weights, and clearly labeled estimated one-repetition maximums. It excludes workouts, routines, programs, and prescriptions.

Under the planned archive feature, with your separate optional permission, GReps may retain your exercise-results archive for up to 24 months after the paid access period ends so you can resume from prior results if you return. Under that planned feature, without permission those results will be scheduled for deletion after the 90-day export period. You may withdraw archive permission or request deletion earlier, subject to specific lawful exceptions. Archive retention does not provide ongoing app access or tracking.

Transaction records, signed agreements, waivers, consent records, and records subject to a specific legal obligation or legal hold may follow separate documented retention periods. These exceptions do not authorize keeping all fitness data indefinitely. GReps will explain retained categories, purposes, and applicable periods when required. Backup and processor deletion may follow separate operational schedules, subject to applicable requirements.

The 90-day summary and 24-month optional archive are proposed business rules, not legal safe harbors. They do not restrict statutory access, portability, correction, withdrawal, appeal, or deletion rights while information is held.

GReps uses reasonable administrative, technical, and physical safeguards, but no storage or transmission system can be guaranteed completely secure.

Customer choices

• Update account information in the GReps app and payment information through your purchase provider. Membership cancellation, account deletion, and revoking an integration are separate actions. Requesting deletion does not automatically cancel a subscription billed by an external provider; contact GReps for help identifying the appropriate cancellation path.
• Unsubscribe from promotional email using the link in the message.
• Request access, a copy, correction, or deletion by emailing dan@grepsstrength.com. You can also request account and data deletion through our Account Deletion page. The planned store app will also provide an in-app account-deletion initiation path. GReps may verify identity using proportionate steps and will handle requests, authorized agents, deadlines, required appeals, and processor notifications under applicable law. Any lawful retention exception will be limited and explained. The ordinary PDF summary does not replace a legally required access or portable data response.
• Adjust browser cookie controls and available device permissions. Disabling necessary cookies may affect sign-in or other functions. The planned ChatGPT sharing, Gemini sharing, and archive retention controls are separate from photo submission and Google Calendar permissions. Exercising a privacy right or declining optional AI sharing does not create a surcharge or remove coaching benefits promised for your plan.

Age eligibility and children

GReps athlete enrollment is limited to persons age 18 or older at launch, including free trials, memberships, and separately purchased coaching sessions. The service is not directed to children, and GReps does not knowingly enroll minors. Parent or guardian permission does not create a launch exception. GReps may collect proportionate age information to check eligibility. If GReps learns that a minor has enrolled or submitted personal information, address the account and information under applicable law; contact dan@grepsstrength.com to report suspected underage use. Any future minor-enrollment process requires separate review and revised disclosures. An app-store age rating does not replace this eligibility policy.

External links and platforms

The website, app, and communications may link to third-party services and display public YouTube exercise demonstrations using the official embedded player. Loading a player or thumbnail may disclose technical information such as IP address, device information, and referring context to YouTube or Google, and may involve cookies or identifiers depending on configuration and settings. Embedded players and thumbnails should not be assumed to be anonymous or free of tracking. Third-party videos remain the property of their respective rights holders; availability and terms may change. Review the privacy notices of services you use.

Changes

GReps may update this Policy. The updated version will be posted with a revised effective date. Material changes will be communicated when required by law.

Contact