← Back to Arbito

RepBase Privacy Policy

Effective Date: February 7, 2026 · Last Updated: October 19, 2026

Arbito LLC ("we," "us," or "our") operates the RepBase mobile application and associated services (collectively, the "Service"). RepBase is a fitness tracking and social workout platform within the Arbito ecosystem.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using RepBase, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Account Information (via Arbito Market)

RepBase uses Arbito Market, our centralized authentication platform, for account management. When you create an account, the following information is shared from Arbito Market:

• Email address, username, and display name
• Avatar/profile photo URL
• Account role and verification status

For details on how your account data is handled, please also review the Arbito Market Privacy Policy.

1.2 Profile Information You Provide

• Personal Details: Bio, date of birth, sex (Male, Female, Other, or Prefer Not to Say), and location (city, state, country).
• Privacy Preferences: You control the visibility of your age, sex, location, and whether followers require approval.

1.3 Fitness and Health Data

Important: RepBase collects sensitive health and fitness data to provide its core workout tracking functionality:

• Workout Data: Completed workouts with start time, end time, and duration. Exercise sets including repetitions, weight, rest-pause indicators, warm-up sets, and failure sets.
• Cardio Metrics: Distance, duration, speed, incline, resistance level, heart rate, and calories burned.
• Strength Metrics: One-rep max (1RM) history and calculations, exercise goals with target 1RM and timelines.
• Body Measurements: Body weight, body fat percentage, and custom body measurements recorded with progress photos.
• Training Programs: Custom workout programs, cycles, and training schedules you create or save.

1.4 Photos and Media

• Progress Photos: Photos you upload with associated metadata including body weight, body fat percentage, body measurements, date taken, and visibility settings (Public, Followers Only, or Private).
• Post Photos: Images you share in social posts.
• Profile Photos: Your profile avatar image.

Photos are stored securely and respect the visibility settings you choose. We do not scan photo content or extract biometric data from images.

1.5 Social and Community Data

• Posts and Comments: Content you create, including text posts, workout shares, and comments on others' posts.
• Social Connections: Your follower/following relationships, follow requests, and blocked users.
• Engagement: Likes on posts and programs, program reviews and ratings, discussion forum participation.
• Reports: Content and photo reports you submit about other users' content.

1.6 In-App Economy Data

• Currency Balance: Your Iron (RepBase currency) balance.
• Shop Items: Items you unlock with earned Iron, including social themes, profile badges, and app themes.
• Challenge Participation: Daily challenge completions and associated rewards.

1.7 Diagnostics and Service Metrics

When error reporting is enabled, Sentry receives exception messages and stack traces, app version, platform, device model and operating-system details, and the signed-in Arbito account ID. We scrub email addresses and URL query strings and do not attach request headers or bodies, screenshots, progress photos or health records. Performance tracing is disabled.

Our own servers record a limited set of Pro purchase-screen, verification, restore, access and capacity events with account ID, timestamp, platform, product and categorical result codes. We use these to understand subscription conversion and diagnose access failures. These metrics do not contain receipts, purchase tokens, email addresses, free-text content or health records. We do not use Firebase Analytics or Firebase Crashlytics.

If you submit a bug report, we receive the description and app/device context you provide. Recent app logs are attached only when you choose to include them.

RepBase Pro Subscription Data

RepBase Pro is an optional monthly or annual store subscription. Apple or Google processes payment; we do not receive your payment-card number or billing address. Our server and RevenueCat process the account ID, store product, purchase receipt or token, transaction identifiers, renewal and expiry dates, subscription status and refund/revocation events to validate purchases and restore access. RevenueCat also provides subscription reporting. Pro does not award bonus Iron or increase activity rewards. Iron cannot be purchased or cashed out.

1.8 Notification Data

• Push Notification Tokens: We use Firebase Cloud Messaging to send push notifications to your device.
• Notification Preferences: Your settings for rest timer alerts, workout reminders, and daily challenge notifications.

Optional shared profile pictures

Where picture settings are available, you can choose initials, a saved avatar design, or a photo you select. Arbito stores your picture choice, avatar design, uploaded picture derivatives, review status, and picture reports or blocks. The same selected picture is used by your connected Arbito apps; editing it does not make a private task list, workout, or profile public.

Uploaded photos are processed on Arbito's server to remove embedded metadata and make square versions. We do not keep the original upload. We use Cloudinary to store the processed shared profile pictures. When you choose a new shared photo, supported apps show it privately to you while other people keep seeing your previous public picture. It is available only to you and authorized reviewers until approval. Approval makes it public automatically if it is still your chosen photo; choosing another picture first cancels that switch. Older apps may require explicit selection after approval. If a photo is not approved, your previous picture remains public and returns in your own view; review status is available in picture settings. An approved public profile photo is accessible to anyone with its image link, even if another part of an app is private. Your saved avatar remains available when you choose a photo.

You can remove a photo or switch to initials in picture settings. Switching to an avatar or initials keeps a saved photo private for reuse; use Remove photo to delete it. Choosing another approved photo removes the previous retained photo; review decisions can also remove a picture. Account deletion schedules removal of stored picture files. Removal from active display happens before file cleanup; supported app and server caches normally revalidate within five minutes; offline or saved copies can remain longer, and copies another person saved may remain outside our control. Restricted recovery backups may retain removed data until their applicable retention period expires. Review and safety records are used to operate and protect the account service. Contact support@arbito.co to report a picture or ask about removal.

2. How We Use Your Information

We use the information we collect to:

• Provide core workout tracking: Record and display your workouts, track strength progress, calculate 1RM estimates, and manage training programs.
• Enable social features: Facilitate post sharing, profile viewing, following, and community interactions.
• Power the in-app economy: Record Iron earned and spent, the shop items you unlock, and challenge completions.
• Personalize your experience: Display relevant content, respect your privacy preferences, and apply your chosen themes and badges.
• Improve the Service: Analyze usage patterns, identify bugs through crash reports, and develop new features.
• Ensure safety: Moderate content, process user reports, and enforce community guidelines.
• Communicate with you: Send notifications, respond to support requests, and provide service updates.
• Subscriptions: Validate and restore Pro access, reconcile renewals and refunds, and understand subscription conversion. RepBase has no advertising or advertising tracking.

3. Health and Fitness Data — Special Protections

We recognize that health and fitness data is particularly sensitive. We apply additional protections:

• Fitness data is used solely to provide workout tracking functionality and is never sold to third parties.
• We do not share your health data with advertisers or data brokers.
• Body measurements and health metrics are only visible according to your privacy settings.
• Heart rate and calorie data is used exclusively for workout tracking and personal fitness insights.
• You can export or delete your fitness data at any time by contacting us.

As required by Apple's App Store guidelines and Google Play's Health Connect policies, we handle health data with heightened care and do not use it for advertising purposes.

Optional Health and Music Integrations

On iOS, with permission, RepBase can read workouts, workout heart rate, active energy and body weight from Apple Health and write completed workouts, active energy and body weight. On Android, RepBase requests read access only to Health Connect exercise sessions and weight. Imported records can be synchronized to your RepBase account for training history, progress and eligible challenges. You can decline or revoke access and keep logging manually. We do not use Health data for ads, sell it, or share it with data brokers.

Apple Music library and player controls are optional on iOS; Android opens Music externally. Music selections and listening history are not sent to our server. Biometric sign-in checks stay on your device; RepBase does not receive your face or fingerprint data.

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Public Profile Content: Information you set as public (posts, profile details with visibility settings) is visible to other RepBase users.
• Within the Arbito Ecosystem: Your user identity syncs with Arbito for authentication. Your Iron currency balance is reflected in your Arbito Market wallet.
• Service Providers: We share information with vendors who provide hosting (Railway), photo storage/delivery (Cloudinary), error reporting (Sentry), subscription validation/reporting (RevenueCat), push notifications (Firebase Cloud Messaging), and account-related email delivery.
• Content Moderation: Reported content and associated user data may be reviewed by our moderation team.
• Legal Requirements: We may disclose information if required by law, regulation, or valid legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as a business asset.
• With Your Consent: We may share your information when you give explicit consent.

5. Your Privacy Controls

RepBase provides granular privacy controls:

Setting	What It Controls
Profile Visibility	Whether your profile is public or private
Show Age	Whether your age (from date of birth) is visible on your profile
Show Sex	Whether your sex is displayed on your profile
Show Location	Whether your city/state/country appears on your profile
Require Follower Approval	Whether follow requests must be approved by you
Photo Visibility	Per-photo control: Public, Followers Only, or Private
Blocked Users	Users blocked from viewing your content and interacting with you

6. Data Retention

We retain your data as follows:

• Account and profile data: Retained until you delete your account.
• Workout and fitness data: Retained for the lifetime of your account to provide progressive tracking.
• Photos: Retained until manually deleted by you or until account deletion.
• Social content (posts, comments): Retained until deleted by you or until account deletion.
• Challenge and shop data: Retained for the lifetime of your account.
• Subscription records: Kept to provide entitlement recovery, prevent replay of deleted-account purchases, resolve disputes and meet applicable legal obligations. Account deletion does not cancel a store subscription.
• Diagnostics and service metrics: Kept as needed for debugging, security and service operation, subject to provider retention settings.

When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law. Cached data on your device may remain until you uninstall the app.

7. Data Security

We implement technical and organizational measures to protect your data:

• All data is transmitted over HTTPS/TLS encryption.
• Authentication is handled by Arbito Market using JWT tokens with short-lived access tokens.
• Rate limiting on API endpoints to prevent abuse.
• Biometric authentication option (Face ID, fingerprint) for app access.
• Role-based access controls for data access.
• Photos are stored with access controls matching your visibility settings.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure.

8. Your Rights

8.1 All Users

• Access: View your data through the app at any time.
• Update: Edit your profile, privacy settings, and content.
• Delete: Delete individual posts, photos, and workouts. In Settings > Account > Delete Account, confirm with your Arbito password or an emailed code. This deletes your shared Arbito account across its apps and triggers deletion of RepBase data. You can also start from our public account-deletion page or contact support@arbito.co. Cancel any Pro subscription separately in your Apple or Google subscription settings; deleting an account or the app does not cancel it.
• Export: Request a copy of your workout data by contacting support.
• Opt-Out: Disable push notifications, adjust privacy settings, and manage feature preferences.

8.2 European Economic Area (EEA) Residents — GDPR Rights

If you are located in the EEA, you have rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing: Request limitation of how we process your data.
• Right to Data Portability: Receive your data in structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing.

Legal Basis for Processing: We process your data based on: (a) your consent (especially for health data), (b) performance of our contract with you, (c) compliance with legal obligations, and (d) legitimate interests (security, service improvement).

Contact support@arbito.co to exercise your rights. We will respond within 30 days.

8.3 California Residents — CCPA Rights

If you are a California resident, you have rights under the CCPA:

• Right to Know: Request disclosure of personal information collected, used, and disclosed.
• Right to Delete: Request deletion of your personal information.
• Right to Opt-Out of Sale: We do not sell personal information.
• Right to Non-Discrimination: We will not discriminate for exercising your rights.

9. Children's Privacy

RepBase is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal data from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, contact us at support@arbito.co.

10. Third-Party Services

Service	Purpose	Privacy Policy
Arbito Market (Arbito)	Authentication & identity	Arbito Market Privacy Policy
Google (Firebase Cloud Messaging)	Push notifications	Firebase Privacy
Google Sign-In	OAuth authentication (via Arbito Market)	Google Privacy Policy
Apple Sign-In	OAuth authentication (via Arbito Market)	Apple Privacy Policy
Cloudinary	Uploaded photos, image delivery and restricted shared-account recovery identifiers	Cloudinary Privacy
Sentry	Scrubbed errors and crash diagnostics	Sentry Privacy
RevenueCat	Subscription validation, notifications and reporting	RevenueCat Privacy
Apple App Store / Google Play	Native subscription payments and lifecycle events	Apple Privacy / Google Privacy
Railway	Server hosting	Railway Privacy Policy

11. International Data Transfers

Your information may be transferred to and maintained on servers located outside your country of residence. For EEA, UK, or Swiss residents, we ensure appropriate safeguards such as Standard Contractual Clauses are in place.

12. Push Notifications

We may send push notifications including rest timer alerts, daily workout reminders, challenge notifications, and social activity updates. You can manage notifications in the app settings or your device settings.

13. Offline Mode and Local Data

RepBase supports offline functionality. Your workout data, cached programs, and preferences are stored locally on your device. This local data is not encrypted separately from your device's own storage encryption. Clearing the app cache or uninstalling the app will remove locally stored data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy within the app or sending you a notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy:

• Email: support@arbito.co
• Mailing Address: Arbito LLC, 212 N. 2nd St. Ste 100, Richmond, KY 40475
• Website: https://arbito.co

For GDPR-related inquiries, you may also lodge a complaint with your local data protection authority.