Privacy Policy

1Who is responsible

More details are in our legal notice (Impressum).

2What stays on your iPhone

RepRumble processes the following only on your device. We don’t receive it and can’t access it. It’s gone when you delete the app.

• Camera. With your permission, RepRumble uses the camera during a fight. A pose model on your iPhone finds 33 points of your body in each picture, and the app turns them into reps. The pictures are neither stored nor sent anywhere.
• Fight clips. If you record a clip of a fight, it is saved on your iPhone, with the picture from your camera, and only leaves it when you share it yourself.
• Progress and settings. Campaign stars, your deck, card levels, fighters, your streak, sounds and language.
• Your answers during setup. Your name, your goal, how often you train, how many push-ups and squats you manage in a row, and on how many days a week you want to train. They only set your level and plan. Your name goes to our server only when you play online (see below).
• Notifications. With your permission, RepRumble schedules local reminders on your iPhone.

3Online fights and friends

Online fights, ranked and friend duels are optional. When you use them, RepRumble sends to our game server and stores there:

• Your player profile: a random player ID, your player name, your fighter, the platform, the app’s language, your rating and league, and how many fights you have played and won.
• Your online rounds: when you did which exercise and how long you held a plank, your deck and the result. The server judges ranked rounds from this. Other players can fight a recorded copy of your round (your ghost), which shows your player name and fighter.
• Friends and invites: invite codes, who you are friends with, who invited whom (for invite rewards) and duels between friends. An invite link opens a page on our server that shows your player name and the code, so your friend knows who is challenging them.
• Device check: to keep ranked fair, the app proves to our server with Apple’s App Attest that it is a genuine copy of RepRumble. We store the key that creates for your copy of the app.

No video, no camera pictures and no body points ever reach the server, only the reps and holds counted from them. The server uses your IP address only briefly, to fend off too many requests, and doesn’t store it. When a request fails, it keeps a technical error report for a few days, without your IP address. It runs on Cloudflare, which operates it for us as our processor.

We delete recorded rounds after 180 days and friend duels after 30 days. Your profile stays until you delete it: in RepRumble, Profile, Online, “Delete online data” removes your profile, friends, duels and rounds from our server and takes your name off the ghosts other players still have.

The legal basis is Art. 6(1)(b) GDPR, because you use these features, and for the device check and fending off too many requests Art. 6(1)(f) GDPR, our legitimate interest in fair and safe fights.

4Push notifications

When a friend challenges you or answers your challenge, RepRumble can tell you with a push notification. Only if you allow it, the app sends your device’s push token to our server, which stores it with your player profile and sends the notification through Apple Push Notification service (on Android devices, Google’s Firebase Cloud Messaging). The notification contains the friend’s player name.

The legal basis is Art. 6(1)(a) GDPR, your permission. You can turn notifications off at any time in your iPhone’s settings.

5Names, reports and blocks

So that online fights stay friendly, the server checks player names against a list of words that aren’t allowed. A name that fails is hidden from other players, who see a neutral name instead. You can report or block a player. A report stores who reported whom, the reason, where it happened and the reported name. After several open reports a name is hidden until we have looked at it; we review reports by hand and can block a player from online fights. A block ends a friendship both ways and keeps the two of you apart in matchmaking.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in protecting players. We keep a report as long as both profiles exist.

6Purchases and subscriptions

Purchases go through Apple’s App Store. We never receive your payment details.

To check, unlock and restore purchases, we use RevenueCat (RevenueCat, Inc., USA) as our processor. RevenueCat receives a random, anonymous identifier, the purchase data from the App Store (product, price, currency, dates, transaction IDs), technical details such as device type and iOS and app version, and your IP address, from which it derives your country before discarding it. We also look at purchases in aggregate, for example how many subscriptions start or are cancelled.

The legal basis is Art. 6(1)(b) GDPR for handling your purchase and Art. 6(1)(f) GDPR for the aggregate figures, our legitimate interest in understanding our offer. We keep this data while you use your purchases and for as long as the law requires us to.

7When you write to us

When you email us, we process your address, your message and anything you attach, to answer you. We delete your message once your request is settled, unless the law requires us to keep it.

The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering you and improving RepRumble.

8This website

When you visit reprumble.com, our host Cloudflare processes what’s technically needed: your IP address, the time, the page and your browser’s identifier. That’s necessary to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR). The site sets no cookies, uses no analytics or tracking, and loads its fonts from its own server. The App Store button takes you to Apple.

9Children

RepRumble is meant for people aged 13 and over. We don’t knowingly collect data from children under 13. If you believe a child under 13 has played online or sent us data, write to lukas@brombach-technologies.de and we’ll delete it.

10Recipients and transfers

• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: hosting this website and running our game server and its database.
• RevenueCat, Inc., USA: managing purchases.
• Apple: App Store, App Attest and push notifications, under Apple’s own privacy policy.
• Google: push notifications on Android devices (Firebase Cloud Messaging), under Google’s own privacy policy.

Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found adequate (Art. 45 GDPR). With RevenueCat we have agreed the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

We don’t sell data, show ads or build profiles for advertising.

11Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interest (Art. 21). Just write to lukas@brombach-technologies.de.

To find your online data, tell us your player name and roughly when you last played. You can delete your online data yourself in the app (Profile, Online, “Delete online data”); to delete what’s on your iPhone, delete the app. For questions about purchases, the order ID from Apple’s receipt helps.

You don’t have to give us any data, but without camera access RepRumble can’t count your reps. We make no automated decisions within the meaning of Art. 22 GDPR.

You can complain to a data protection authority (Art. 77 GDPR), for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

12Changes

When RepRumble changes, we update this policy. The version published here applies.