Privacy Policy

Last updated: September 25, 2026

This legal document is provided in English.

1. Who we are

Fotograf Vegard Kristoffersen, organisation number 926 392 433 (Norway), operates the REPLOADR app and website (the “Service”) and is the data controller for the personal data described here. You can reach us at fotografvegardkristoffersen@gmail.com.

This policy describes what the Service actually collects today. It does not describe features we have not built.

2. Data we collect

  • Account data: your email address and an authentication record (passwords are stored only as salted hashes by our authentication provider; if you sign in with Google we receive your email address and basic account identifier, never your Google password).
  • Profile data you enter: display name, birth year, sex, body weight, height, training experience, goals, unit preference (kg/lb), optional bio, optional city, optional preferred training times, and your optional profile photo.
  • Training data: workouts, exercises, sets, reps, weight, distance, time/duration, height, RPE/RIR, rest times, notes, personal records, XP and level, program enrolments and progress.
  • Heart-rate data (optional): if you connect a Bluetooth heart-rate monitor or enter values manually, the live readings are processed in your browser and only summary values (such as average and maximum heart rate and an estimated calorie figure) are saved with the workout. We never connect to your device without your explicit pairing action.
  • Community content (optional): posts, comments, likes, gym reviews, training-partner requests, and leaderboard/visibility choices.
  • Images you upload (optional): profile picture and session photos images, post-workout photos, custom exercise illustrations, and screenshots attached to feedback. Location metadata is stripped from workout photos before upload.
  • Feedback and support: the message, category and any attachment you send us, plus the account it came from.
  • Technical data: data necessary to serve requests, such as IP address, request timestamps, browser/device type and server error logs generated by our hosting and database provider.
  • Analytics (consent only): aggregate page-visit analytics provided by our hosting platform. The analytics script is blocked until you actively accept it in the cookie banner.

We do not collect precise GPS location, contacts, call or SMS data, or advertising identifiers, and we do not use the Service for advertising or profiling.

3. How we use your data

  • to create and secure your account and keep you signed in;
  • to store and display your workouts, programs, records and progress;
  • to calculate rest recommendations, XP, levels, ranks and leaderboards you opt into;
  • to run optional social features you choose to use (community feed, gym reviews, training-partner matching);
  • to answer feedback and support messages;
  • to keep the Service reliable and secure, and to diagnose errors and abuse;
  • to understand aggregate site usage, only where you consented to analytics;
  • to comply with legal, accounting and tax obligations.

4. Legal bases (EEA/UK)

  • Contract: providing the account, workout logging and the features you request.
  • Consent: analytics cookies, optional public profile/leaderboard visibility, optional community and partner features, optional heart-rate pairing, and any optional profile fields you choose to fill in. You may withdraw consent at any time.
  • Legitimate interests: security, abuse prevention, and improving the Service.
  • Legal obligation: bookkeeping and responding to lawful requests.

5. Visibility of your content

Your workouts, notes and photos are private to your account by default. Content becomes visible to other signed-in users only when you publish it — for example by posting in the community, writing a gym review, sending a partner request, or enabling leaderboard visibility. You can change these choices in your profile. Signed-out visitors cannot read member data.

6. Subscriptions and payments

REPLOADR is currently in the Founding Beta and is free for all registered users. There is no checkout, no payment method is requested and no card or billing data is collected or processed today.

Paid plans are planned for 2027. If and when they launch, payments will be handled by Paddle.com acting as Merchant of Record, and Paddle would then process your billing details under its own privacy policy. We will update this policy and notify you before any payment processing begins.

7. Email and notifications

We send account emails required to operate the Service: email verification, password reset, email change confirmation and similar security messages, sent through our authentication and email infrastructure provider. We do not send marketing email and do not sell your email address. The app may show in-app and browser notifications you enable yourself (for example rest timers); these are generated on your device.

8. Service providers we actually use

  • Lovable — application hosting, edge delivery, the managed backend used for authentication, database and file storage, and the consent-gated visit analytics.
  • Google — only if you choose “Continue with Google” to sign in.
  • Paddle.com — reserved for the planned 2027 paid plans; not used while the Service is free.

We do not use advertising networks, data brokers, or third-party trackers beyond what is listed here, and we never sell your personal data.

9. International transfers

Our providers may process data outside your country, including outside the EEA. Where that happens, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

10. Storage and security

Data is transmitted over HTTPS and stored in our managed database and object storage with row-level access rules so that each account can only reach its own data and the content others have chosen to publish. Passwords are hashed, administrative access is restricted, and uploaded files are served through access-controlled storage. No system can be guaranteed completely secure, so we cannot promise absolute security.

11. Retention

We keep your account and training data for as long as your account exists, because the Service is a training history. Feedback messages are kept while we work on them and for a reasonable period afterwards. Technical logs are kept only for a short operational period. When an account is deleted, its personal data is deleted or anonymised unless we must keep specific records for legal or accounting reasons.

12. Deleting your account and data

You can delete individual workouts, posts, reviews and photos in the app at any time. To delete your entire account and all associated personal data, email fotografvegardkristoffersen@gmail.com from your registered address with the subject “Delete my account”. We verify the request and complete deletion without undue delay, and in any case within 30 days.

13. Children and young users

REPLOADR is intended for users aged 13 and over. Users aged 13–17 may use the Service only with the permission of a parent or legal guardian, and a parent or legal guardian must authorise any future paid subscription for an account under 18. Features that share your area with other users — Training Buddy and city-based partner matching — are available only to users aged 18 and over. We do not knowingly collect personal data from children under 13; if we learn that we have, we delete the account and its data.

14. Your rights

Depending on where you live, you have the right to access, correct, delete, restrict or port your personal data, to object to certain processing, and to withdraw consent. You can exercise most of these directly in the app, or contact us at fotografvegardkristoffersen@gmail.com. We respond within one month. If you are in the EEA you may also complain to your local data protection authority; in Norway that is Datatilsynet.

15. Cookies and local storage

We use essential storage to keep you signed in, remember your unit and app preferences, and speed up repeat visits by caching public static app files. While a workout is open, unfinished set fields may also be stored locally on that device for up to seven days so you can choose to recover them after a refresh or brief connection loss. Draft keys are limited to your account and workout; they are removed after a confirmed save, completed or deleted workout, deleted set, sign-out or account change. These drafts do not sync in the background or to another device, and a connection is still required to load workouts and confirm completed sets. Analytics cookies and scripts stay blocked until you accept them.

16. Changes to this policy

We may update this policy as the Service changes. Material changes will be announced in the app or by email, and the current version is always available at https://reploadr.com/privacy.

17. Contact

Privacy questions and data requests: fotografvegardkristoffersen@gmail.com.