Privacy Policy for RepTax
Effective TODO — a date
RepTax is made by TODO — the publishing entity. This policy explains what the app does with your information. It is written to be read, not to be survived.
The short version
- There is no account and no sign-in. We have no server that stores your data.
- The camera never records anything. Frames are analysed on your phone and thrown away. No video, no photo, no frame ever leaves your device or is written to storage.
- Your apps, rules, reps and streaks live in the app's own storage on your phone.
- Four outside services are involved: RevenueCat (purchases), PostHog (anonymous usage analytics, on by default, with an off switch), Sentry (crash reports, off unless you turn them on) and Google AdMob (ads, only if you don't have Pro).
- You can export everything the app stores, or delete all of it, from Settings.
No account, no backend
RepTax has no user accounts, no sign-in and no server of ours. We don't know your name, your email address or your phone number, and we have no way to look you up. Everything the app remembers about you is stored on your phone.
The camera
This is the part people ask about first, so it comes first.
When you do an exercise, the app opens the front camera and runs Google's ML Kit pose detection on your device. For each frame, the detector returns the positions of your joints. The app uses those positions to decide whether a rep counts, and then the frame is gone.
Specifically:
- Camera frames are held in memory only for the moment it takes to analyse them.
- They are never written to disk: no files, no caches, no temporary images, no logs, no crash reports.
- They are never transmitted, to us or to anyone else. Pose detection needs no network connection.
- No photo or video is ever recorded, and there is no way to make the app record one.
- What survives a session is a number: how many reps you did, how long it took, and how the session ended.
This rule is written into the project's engineering rules, and the code that handles camera frames carries a comment saying so.
The app asks for camera permission before your first exercise. You can refuse it, or withdraw it later in your device settings; the app then can't count reps.
What the app stores on your phone
The app keeps a small database and a set of preferences in its own private storage:
- Your restricted apps. On Android, the package name of each app you chose. On iOS, an opaque token from Apple's picker — the app can't read the app's name or icon from it (see "iOS Screen Time" below).
- Your rule: the exercise, the number of reps (or seconds, for the plank), the minutes each unlock buys, and whether Strict Mode is on.
- Your exercise sessions: exercise, target, reps achieved, how the session ended, and its start and end times.
- Your unlocks: when you earned time and how much.
- Emergency unlocks: when you used the "I need it now" hatch, the minutes it granted, and the short reason you typed. That text stays on your phone. It never goes into an analytics event, never into a crash report, and never to us.
- Daily statistics and streaks, which are derived from the above.
- Preferences: your theme, your analytics and crash-reporting switches, and the name you type when you sign the promise during setup, which the app reads back to you on the lock screen and the success screen. That name stays on your phone too. It never goes into an analytics event or a crash report.
None of this is sent to us. We have nowhere to send it to.
Backups
Your phone's operating system may back up app data as part of its own backup system. On Android, Google's automatic backup can copy an app's files — including the preferences and the blocking policy described above, and so the name you signed — to your own Google Drive account, depending on your device settings and on how the app is configured. On iOS, iCloud Backup can do the same with the app's storage.
Those copies sit in your own cloud account, under Apple's or Google's terms. We can't see them. You can turn backup off for this app in your device settings.
Android: usage access
On Android, the app asks for usage access (PACKAGE_USAGE_STATS) and permission to display over other apps. It needs both to do its job: a background service checks which app is in the foreground, so it can count the time you spend in the apps you restricted and draw the lock screen over them when your allowance runs out.
What the service reads — which app is open, and for how long — stays on the device. It is used to enforce the limits you set for yourself and nothing else. It is never transmitted.
During setup, and for the occasional "42 minutes in that app today" prompt, the app also reads Android's aggregate usage statistics for apps you didn't restrict. That reading happens on the device, isn't stored, and isn't sent anywhere.
The app doesn't use Android's accessibility services and doesn't request the QUERY_ALL_PACKAGES permission. It lists only apps that have a launcher icon.
iOS: Screen Time
On iOS, the app uses Apple's Screen Time frameworks (FamilyControls, ManagedSettings, DeviceActivity) with individual authorization — you managing your own device, not anyone managing yours.
You pick apps in Apple's own picker. Apple hands the app an opaque token for each one. The app never learns which apps you picked: not their names, not their bundle ids, not their icons. Where a name has to appear on screen, iOS draws it; the app can't read it.
Your Screen Time data — which apps you selected, and how long you've used them — stays inside Apple's sandbox on your device. None of it reaches us.
Notifications
The app sends local notifications from your phone: one when you tap the lock screen and need to be brought back to the app, and one two days before a free trial turns into a paid subscription. There is no push server, and nothing about notifications leaves your device.
Services we use
Four third parties are involved. Here is what each one gets, and why.
RevenueCat — purchases
RevenueCat manages subscriptions and the lifetime purchase. It receives a randomly generated, anonymous user id and your purchase and subscription status from Apple or Google: which plan, whether a trial has been used, whether it is active. It doesn't receive your name, email address or payment details — those stay with Apple or Google, who take the payment. We use it to know whether to unlock Pro, and to decide which ads, if any, to show. RevenueCat processes this for us; see their privacy policy for their own handling.
PostHog — anonymous usage analytics (on by default)
PostHog tells us where people get stuck: which setup step loses them, which permission gets refused, where the camera gives up, which paywall converts.
- It runs on PostHog's EU Cloud, hosted in the European Union.
- Your install gets a random id. No profile is created for you, we never link that id to a person, and there's nothing to link it to. IP addresses are discarded on arrival.
- Events carry counts, fixed values and yes/no answers: screen names, how many apps you restricted, how a session ended, how many reps, which permission you refused, which plan you bought. PostHog adds your operating system, app version and device model.
- Events never name the apps you restrict. They are counted, never named: no labels, no package ids, no bundle ids. Automated tests enforce that.
- Events never carry the name you signed, the reason you typed for an emergency unlock, or any other free text.
Analytics are on by default. Turn them off in Settings → Share anonymous usage and nothing more is sent. Delete all data resets the random id.
What analytics can include
Our analytics can go beyond plain events, so you should know the outer edge of what may be collected while the switch is on:
- Recordings of the app's own screens. A recording shows the app as you saw it: the screens you moved through, what you tapped, and the text and images on them. That can include the names and icons of the apps you chose to restrict, because they are drawn on those screens.
- Body pose data derived from the camera. The joint positions the pose detector produces during an exercise — a moving stick figure of shoulders, elbows, wrists, hips, knees and ankles, as plain numbers — along with the rep count.
In both cases the camera image itself is masked and is never captured. Screen recording is switched off for the whole of every exercise, and the camera preview is blacked out on top of that. What can be collected is derived numbers, never the picture.
The switch in Settings → Share anonymous usage covers all of this. Turn it off, and none of it is collected.
Sentry — crash reports (off by default)
If the app crashes, we'd like to know why — but only if you say so. Send crash reports in Settings is off unless you turn it on. When it's on, Sentry receives the crash: the error, the stack trace, and your device and app version. It receives no name, no screenshots and nothing from the camera, and crash reports are dropped entirely while an exercise session is running.
Google AdMob — ads (only without Pro)
Without Pro, the app shows a full-screen ad before some unlocks. Ads are served by Google AdMob, which reads device identifiers (on Android, the advertising ID) and records ad views and taps, to serve and measure ads and to detect fraud. Google acts as an independent controller of that data; see Google's advertising privacy information.
- In the EEA and the UK, Google's consent form appears before the first ad and asks what you allow. Your answer governs what Google does.
- On iOS, the app shows no App Tracking Transparency prompt — it doesn't ask to track you across other companies' apps — so ads are non-personalised.
- Pro subscribers see no ads, and the ad SDK doesn't start for them.
- The camera is never open while an ad is playing.
Your controls
| What | Where |
|---|---|
| Stop sending usage analytics | Settings → Share anonymous usage |
| Send or stop sending crash reports | Settings → Send crash reports (off by default) |
| Change your ad consent (EEA/UK) | Google's consent form, reachable from the app |
| See everything the app stores | Settings → Export my data — copies the whole database as JSON to your clipboard |
| Erase everything the app stores | Settings → Delete all data — deletes every row and preference on this phone, stops blocking, and resets the analytics id |
| Withdraw camera, usage access, Screen Time or notification permission | Your device settings |
There is no account to delete, because there isn't one. Deleting the app removes its storage as well.
Delete all data doesn't cancel a subscription. A purchase belongs to your Apple Account or Google account; manage it there.
Your rights
Depending on where you live, you may have the right to access, correct, export or erase personal data about you, and to object to its processing. Most of that is already in your hands: the data is on your phone, Export my data gives you all of it, and Delete all data erases it.
For the little that reaches our processors: analytics are anonymous by design, so we usually can't pick "your" data out of them — turning the switch off stops collection, and Delete all data resets the id. For purchases, write to TODO — a support address and we'll do what we can with the anonymous id the app holds. You can also complain to your local data protection authority.
Children
RepTax is not directed at children. Don't use it if you are under 13, or under 16 in the EEA. We don't knowingly collect data from children. If you believe a child has used the app and something needs removing, write to TODO — a support address — though in most cases you can do it yourself with Delete all data.
Changes to this policy
If we change this policy, we'll change the date at the top and post the new version at this address. For a change that affects what is collected, the app will tell you before it takes effect, inside the app, at the point where it matters.
Contact
Questions about this policy: TODO — a support address, or TODO — the publishing entity.