Privacy Policy

1Who is responsible

More details are in our legal notice (Impressum).

2What stays on your phone

RepRumble processes the following only on your device. We don’t receive it and can’t access it. It’s gone when you delete the app.

• Camera. With your permission, RepRumble uses the camera during a fight. A pose model on your phone finds 33 points of your body in each picture, and the app turns them into reps. The pictures are neither stored nor sent anywhere.
• Fight clips. If you record a clip of a fight, it is saved on your phone, with the picture from your camera, and only leaves it when you share it yourself. If you choose Save Video while sharing, RepRumble adds the clip to your photo library. RepRumble never reads your photos.
• Progress and settings. Campaign stars, your deck, card levels, fighters, your streak, sounds and language.
• Your answers during setup. Your name, your goal, how often you train, how many push-ups and squats you manage in a row, and on how many days a week you want to train. They only set your level and plan. Your name goes to our server only when you play online (see below).
• Notifications. With your permission, RepRumble schedules local reminders on your phone.

3Online fights and friends

Online fights, ranked and friend duels are optional. When you use them, RepRumble sends to our game server and stores there:

• Your player profile: a random player ID, your player name, your fighter, the platform, the app’s language, your rating and league, how many fights you have played and won, and when you signed up and were last online.
• Your online rounds: when you did which exercise and how long you held a plank, your deck and the result. The server judges ranked rounds from this. Other players can fight a recorded copy of your round (your ghost), which shows your player name and fighter.
• Friends and invites: invite codes, who you are friends with, who invited whom (for invite rewards) and duels between friends. An invite link opens a page on our server that shows your player name and the code, so your friend knows who is challenging them.
• Device check: to keep ranked fair, the app proves to our server that it is a genuine copy of RepRumble. On iPhone it does this with Apple’s App Attest, and we store the key that creates for your copy of the app. On Android phones, the app asks Google Play for a Play Integrity verdict when your account is created: Google’s statement that this is the genuine app, installed from Google Play, on a device that passes Google’s checks. Our server has Google check that verdict; it adds nothing about you, and no key is stored for Android, only that the check passed.

No video, no camera pictures and no body points ever reach the server, only the reps and holds counted from them. The server uses your IP address only briefly, to fend off too many requests, and doesn’t store it. When a request fails, it keeps a technical error report for a few days, without your IP address. It runs on Cloudflare, which operates it for us as our processor.

We delete recorded rounds after 180 days and friend duels after 30 days. Your profile stays until you delete it: in RepRumble, Profile, Online, “Delete online data” removes your profile, friends, duels and rounds from our server and takes your name off the ghosts other players still have. Without the app, you can ask for the same on our account deletion page.

The legal basis is Art. 6(1)(b) GDPR, because you use these features, and for the device check and fending off too many requests Art. 6(1)(f) GDPR, our legitimate interest in fair and safe fights.

4Push notifications

When a friend challenges you or answers your challenge, RepRumble can tell you with a push notification. Only if you allow it, the app sends your device’s push token to our server, which stores it with your player profile and sends the notification through Apple Push Notification service (on Android devices, through Google’s Firebase Cloud Messaging, with the token Firebase issues for the app). The notification contains the friend’s player name.

The server can also tell you when someone fought your Ghost, when a friend passes you in the ranking, or when a friend’s duel is still waiting for you; those contain the other player’s name, at most one a day. So they never arrive at night, the app also sends how far your phone’s clock is ahead of UTC (for example +120 minutes), which the server stores with the token, and when it last sent you one. The reminder from your next campaign rival is set on your phone itself; nothing about it leaves your device.

The legal basis is Art. 6(1)(a) GDPR, your permission. You can turn notifications off at any time in your phone’s settings.

5Names, reports and blocks

So that online fights stay friendly, the server checks player names against a list of words that aren’t allowed. A name that fails is hidden from other players, who see a neutral name instead. You can report or block a player. A report stores who reported whom, the reason, where it happened and the reported name. After several open reports a name is hidden until we have looked at it; we review reports by hand and can block a player from online fights. A block ends a friendship both ways and keeps the two of you apart in matchmaking.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in protecting players. We keep a report as long as both profiles exist.

6Purchases and subscriptions

Purchases go through Apple’s App Store, and on Android through Google Play Billing. We never receive your payment details.

To check, unlock and restore purchases, we use RevenueCat (RevenueCat, Inc., USA) as our processor. RevenueCat receives a random, anonymous identifier, the purchase data from the App Store or Google Play (product, price, currency, dates, transaction IDs), technical details such as device type and iOS or Android and app version, and your IP address, from which it derives your country before discarding it. We also look at purchases in aggregate, for example how many subscriptions start or are cancelled.

The legal basis is Art. 6(1)(b) GDPR for handling your purchase and Art. 6(1)(f) GDPR for the aggregate figures, our legitimate interest in understanding our offer. We keep this data while you use your purchases and for as long as the law requires us to.

7Usage statistics (optional)

When you first start RepRumble, a dialog asks whether we may collect anonymous usage statistics. Only if you agree does the app send data for this; nothing is sent before you agree or after you decline. You can change your choice at any time in the app’s Settings.

For this we use PostHog (PostHog Inc.) as our processor, with servers in the EU and a data processing agreement. PostHog does not store your IP address; it is discarded.

• What is sent: a random, anonymous identifier (no name, no email address, no advertising ID), events such as onboarding finished, fight started, fight finished, paywall seen, purchase started, purchase completed and app opened, plus app version, device model, OS version, country and language.
• What is never sent: your player name, rep counts, camera images or video, contacts, your location or payment details.

We want to understand where players quit and improve RepRumble. We don’t use the data for advertising, build advertising profiles, sell it or track you across other apps.

The legal basis is Art. 6(1)(a) GDPR, your consent, which you can withdraw at any time with effect for the future. “Delete online data” in the app (Profile) also resets the statistics identifier. You can also have the statistics data deleted by emailing lukas@brombach-technologies.de.

8When you write to us

When you email us, we process your address, your message and anything you attach, to answer you. We delete your message once your request is settled, unless the law requires us to keep it.

The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering you and improving RepRumble.

9This website

When you visit reprumble.com, our host Cloudflare processes what’s technically needed: your IP address, the time, the page and your browser’s identifier. That’s necessary to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR). The site sets no cookies, uses no analytics or tracking, and loads its fonts from its own server. The App Store button takes you to Apple.

10Children

RepRumble is meant for people aged 13 and over. We don’t knowingly collect data from children under 13. If you believe a child under 13 has played online or sent us data, write to lukas@brombach-technologies.de and we’ll delete it.

11Recipients and transfers

• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: hosting this website and running our game server and its database.
• RevenueCat, Inc., USA: managing purchases.
• PostHog Inc.: anonymous usage statistics, only with your consent, on servers in the EU.
• Apple: App Store, App Attest and push notifications, under Apple’s own privacy policy.
• Google: on Android devices, Google Play (purchases and the Play Integrity check) and push notifications (Firebase Cloud Messaging), under Google’s own privacy policy.

Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found adequate (Art. 45 GDPR). With RevenueCat we have agreed the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

We don’t sell data, show ads or build profiles for advertising.

12Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interest (Art. 21). Just write to lukas@brombach-technologies.de.

To find your online data, tell us your player name, your fighter and roughly when you last played. You can delete your online data yourself in the app (Profile, Online, “Delete online data”); to delete what’s on your phone, delete the app. Without the app, use our account deletion page or email us with the subject “Delete my RepRumble account”; we delete the account within 30 days. For questions about purchases, the order ID from Apple’s receipt helps.

You don’t have to give us any data, but without camera access RepRumble can’t count your reps. We make no automated decisions within the meaning of Art. 22 GDPR.

You can complain to a data protection authority (Art. 77 GDPR), for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

13Changes

When RepRumble changes, we update this policy. The version published here applies.