Privacy Policy

01Who is the Data Controller? / Kim jest Administrator Danych?

The data controller within the meaning of Art. 4(7) GDPR is:

This Privacy Policy covers both the RepDrop mobile app (iOS and Android) and the website at repdrop.bypop.dev.

I am an independent developer. I do not have a registered company or a designated Data Protection Officer (DPO), as I do not process personal data on a large or systematic scale. For any privacy-related questions, please contact me directly by e-mail.

Administratorem danych osobowych jest Kamil Popczyk, prowadzący działalność nierejestrowaną pod nazwą bypop, z siedzibą w Polsce. Kontakt: hello@bypop.dev.

02What Data Do I Collect and Why? / Jakie dane zbieram i dlaczego?

2.1 Fitness and App Data - Stored Locally / Dane przechowywane lokalnie

Your personal fitness data - the full rep history, challenge settings, break history, and notification preferences - is stored on your device, not on any server:

• On iOS: in the App's private storage on your iPhone. RepDrop does not store or sync any of it in iCloud. Like most app data, it is included in your iPhone's own backups (iCloud Backup or a backup to your computer) if you have them turned on, so it can be restored to a new phone.
• On Android: in the App's private storage on your device. Like most app data, it is included in Android's own backup to your Google account and in device-to-device transfer to a new phone, if you use them.

Those backups are made by your phone's operating system under your own Apple or Google account and its settings; I cannot access them.

This data never reaches my servers - I have no server. I have no access to it.

Body measurements are handled differently: they are never stored in iCloud, are excluded from these backups, and are covered separately in section 2.7.

Apple Health workouts (iOS, optional): if you turn on Workouts and mindful minutes, RepDrop also saves copies of completed breaks and rep sessions to Apple Health on your device, as described in section 2.8. They are not sent to me.

Legal basis (GDPR): Performance of the service you requested - Art. 6(1)(b).

Twoje dane treningowe (pełna historia, ustawienia, preferencje) są przechowywane na Twoim urządzeniu, nie na żadnym serwerze. RepDrop nie zapisuje ich w iCloud; trafiają jedynie do kopii zapasowej telefonu (iCloud Backup lub kopia na komputerze na iOS, kopia na koncie Google lub przeniesienie na nowy telefon na Androidzie), jeśli z niej korzystasz. Pomiary ciała są z tych kopii wyłączone (sekcja 2.7). Firebase Analytics (sekcja 2.2) otrzymuje jedynie anonimowe sygnały o zdarzeniach (np. „zalogowano powtórzenia"), nie kopię Twoich danych. Nazwa własnego ćwiczenia, którą wpisujesz, nigdy nie opuszcza urządzenia - w analityce takie ćwiczenie jest oznaczane wyłącznie jako custom. Na iOS możesz opcjonalnie zapisywać ukończone przerwy i serie powtórzeń jako treningi w aplikacji Zdrowie (sekcja 2.8).

2.2 Analytics - Firebase Analytics (Google) / Dane analityczne

I use Firebase Analytics, a service by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), to understand how the App is used in aggregate so I can improve it.

Firebase Analytics does not collect your name, e-mail address, or any other directly identifying information. The following anonymous/pseudonymous usage events are collected:

Firebase assigns each app installation a random identifier generated by the Firebase SDK (the Firebase Installation ID and an app-instance ID). It is not derived from your name, e-mail address, or Apple or Google account, and it is reset if you uninstall the App (or clear its data on Android).

No advertising identifiers. The App does not request Apple's Advertising Identifier (IDFA) on iOS, and no App Tracking Transparency prompt is shown. On Android, the App is configured not to collect the Google Advertising ID: advertising-ID collection and ad-related signals are switched off in the App's Firebase configuration, and the advertising-ID permission is removed from the App. Android versions before 1.3 still declared two Android Privacy Sandbox permissions (ACCESS_ADSERVICES_AD_ID and ACCESS_ADSERVICES_ATTRIBUTION) that the Firebase SDK adds by default; advertising-ID collection and ad-related signals were switched off in those versions too, and from version 1.3 those permissions are removed as well.

Analytics is enabled by default and there is no in-app switch to turn it off. Because events are tied only to the random installation identifier above, uninstalling the App (or clearing its data on Android) stops collection from that installation and discards the identifier. You can also e-mail me to object (section 4).

Legal basis (GDPR): Legitimate interests - Art. 6(1)(f). I use only anonymous aggregate data to understand which features are used, with no profiling or advertising involved.

International transfer: Google LLC is in the USA. Google LLC is certified under the EU-US Data Privacy Framework, an adequacy decision under Art. 45 GDPR, and additionally relies on Standard Contractual Clauses under Art. 46(2)(c) GDPR. More details: Google's data transfer mechanisms.

Firebase Analytics zbiera anonimowe zdarzenia użycia aplikacji oraz podstawowe informacje o urządzeniu. Aplikacja nie używa identyfikatorów reklamowych (IDFA na iOS ani identyfikatora reklamowego Google na Androidzie). Dane są przekazywane do Google LLC w USA na podstawie decyzji o adekwatności (EU-US Data Privacy Framework, art. 45 RODO) oraz Standardowych Klauzul Umownych (art. 46 ust. 2 lit. c) RODO). Google nie zna Twojego imienia ani adresu e-mail.

2.3 Website Analytics - Google Analytics / Analityka strony internetowej

The website repdrop.bypop.dev uses Google Analytics 4, a service by Google LLC (USA). When you visit the website, Google Analytics collects:

Google Analytics uses cookies stored in your browser to distinguish visits. Your IP address is anonymised before storage.

Cookies set after consent: _ga (distinguishes visitors, up to 2 years) and _ga_35STRWSECQ (GA4 session state, up to 2 years). If you decline, no analytics cookies are set and Google Analytics is not loaded.

Functional local storage (no consent required): On phones and tablets the site may show a short "Get the app" strip at the top of the page. If you dismiss it, your browser stores a single flag, rd_appbanner_dismissed. It contains no identifier, it is not a cookie, and it is never transmitted to us or to any third party. It is strictly necessary to deliver the preference you asked for, so under Art. 399 of the Prawo komunikacji elektronicznej it does not require consent. You can remove it by clearing site data in your browser.

Legal basis (GDPR): Consent - Art. 6(1)(a). Analytics cookies are only set after you accept via the consent banner.

International transfer: Google LLC is in the USA. Google LLC is certified under the EU-US Data Privacy Framework, an adequacy decision under Art. 45 GDPR, and additionally relies on Standard Contractual Clauses under Art. 46(2)(c) GDPR. See Google Analytics data privacy.

You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.

Strona repdrop.bypop.dev używa Google Analytics 4 (Google LLC, USA). Analityczne pliki cookie są ustawiane wyłącznie po wyrażeniu zgody użytkownika za pomocą baneru cookie. Podstawa prawna: art. 399 ustawy Prawo komunikacji elektronicznej (obowiązujący od 10 listopada 2024 r., w miejsce art. 173 Prawa telekomunikacyjnego) w zakresie zapisu i odczytu informacji na urządzeniu, oraz art. 6 ust. 1 lit. a) RODO w zakresie przetwarzania danych. Zgodę można wycofać w każdej chwili przez link „Cookie settings" w stopce. Dodatkowo, na telefonach i tabletach po zamknięciu paska „Get the app" przeglądarka zapisuje jedną flagę (rd_appbanner_dismissed), aby pasek pozostał zamknięty. Nie zawiera ona identyfikatora, nie jest plikiem cookie i nie jest nikomu przesyłana, więc jako zapis niezbędny do realizacji wybranej przez Ciebie funkcji nie wymaga zgody.

2.4 In-App Blog Content / Treści bloga w aplikacji

The App includes a Reading screen listing articles from the RepDrop blog.

The article list is shipped inside the App and works with no internet connection. The App additionally checks repdrop.bypop.dev for an updated list so newly published articles appear without an App Store update.

No app data is sent. Your reps, challenges, breaks, settings and history are never included in these requests. The request contains no identifier for you or your device beyond what any web browser sends when loading a page.

Once an article opens, you are browsing the website, so the website's privacy practices apply - including Google Analytics and the cookie banner described in section 2.3.

Legal basis (GDPR): Legitimate interest - Art. 6(1)(f): delivering content you asked to see.

Aplikacja zawiera ekran „Reading" z artykułami z bloga RepDrop. Lista artykułów jest wbudowana w aplikację i działa offline; dodatkowo aplikacja sprawdza serwis repdrop.bypop.dev w poszukiwaniu nowych artykułów. Wysyłany jest wyłącznie adres IP i typ urządzenia - żadne dane treningowe. Po otwarciu artykułu obowiązuje polityka prywatności strony internetowej (sekcja 2.3). Podstawa prawna: art. 6 ust. 1 lit. f) RODO.

2.5 In-App Purchases / Zakupy w aplikacji

If you subscribe to RepDrop Pro (an auto-renewing monthly subscription; the price is shown in the App before purchase), the payment is processed entirely by:

• Apple App Store (iOS) - Apple Privacy Policy
• Google Play (Android) - Google Privacy Policy

I receive only a confirmation from the store that a valid subscription exists. I never see or store your payment card details. The subscription amount and currency are sent to Firebase Analytics as a purchase event (section 2.2), with no payment details.

The date your subscription was first started (trial start date) is stored locally on your device to manage free trial state and show you how many trial days remain. Like your other app data, it is included in your device backups if you have them turned on (section 2.1). If it is missing after a reinstall, the App restores it from the original purchase date reported by Apple or Google. It is never transmitted to me or any third party.

Płatności obsługują Apple lub Google. Otrzymuję jedynie potwierdzenie, że subskrypcja jest aktywna. Nie widzę danych karty płatniczej. Data rozpoczęcia subskrypcji jest przechowywana lokalnie na urządzeniu (i w kopii zapasowej telefonu, jeśli ją włączysz) wyłącznie w celu obsługi okresu próbnego.

2.6 Notifications / Powiadomienia

The App schedules local notifications entirely on your device (daily challenge reminders, break reminders, weekly recaps, and body-measurement reminders you choose to turn on). There is no notification server. Notifications are not used to collect any data. Body-measurement notifications never show a measurement value. The free weekly measure-in reminder is a fixed message with nothing about your body in it. If you are a Pro user and keep body insight notifications on, the monthly summary and the occasional "holding steady" notice are fixed messages too: they do not name any measurement and contain no numbers. You can switch these insight notifications off in Settings → Body data, and control what notifications show on your lock screen in your phone's settings.

2.7 Body Measurements and Apple Health / Pomiary ciała i aplikacja Zdrowie

The Body tab lets you log your weight, body circumferences (such as waist, chest, hips, neck, arms and legs), body fat percentage, and your height. Pro users can also add measurement sites they name themselves and set goals. Optionally, you can choose whether the Pro body-fat estimate uses the male or the female version of its formula; if you don't choose, no estimate is shown. This is data concerning health within the meaning of Art. 9 GDPR, so I keep it to the strictest setup I can offer:

• Stored only on this device. Body data is saved in the App's private storage on your phone. It is not stored in iCloud or synced through iCloud Drive, and it is excluded from iCloud Backup and computer backups (iOS) and from Google backup and device-to-device transfer (Android). One consequence: if you switch phones, your body data does not move with you unless you export it (see below) or, on iOS, the measurements RepDrop saved to Apple Health (weight, body fat and waist) come back from there.
• Never sent to me or to analytics. I have no server and no access to it. Firebase Analytics (section 2.2) only learns that a body action happened and, where relevant, which kind of measurement it involved, never a value. The names you give your own measurement sites never leave your device; in analytics they are recorded only as custom.
• Never sold, never used for advertising, tracking or profiling.
• Only you share it. Your body data leaves RepDrop only when you choose to: by exporting a CSV file, by sharing a Before/After card, or by turning on the Apple Health connection. The CSV export contains every measurement shown in the Body tab (including any read from Apple Health); the App writes it to its temporary cache only to hand it to your phone's share sheet, and removes it the next time you export or when you delete all body data. The Before/After card shows the body figure and dates; it never shows the number for your weight, body fat or any estimate, and shows numbers for up to three other measurements only if you switch numbers on. The figure is an illustration, not a picture of you, but its shape does change with your own measurements between the two dates (including, within set limits, your weight and body fat), so someone looking at the card can see roughly how your measurements changed. Share it only if you are comfortable with that. Once you send an export or a card somewhere, the place you sent it to is responsible for it.

Apple Health (iOS only, optional, free). If you turn on the Apple Health connection, iOS asks for your permission for each data type. With your permission, RepDrop:

• reads weight, body fat percentage, waist circumference and height from Apple Health, to show them in the Body tab alongside the values you log in RepDrop;
• writes to Apple Health only the weight, body fat percentage and waist measurements you enter yourself in RepDrop, marked as entered by you. Height is only read, never written. Estimates and ratios calculated by the App are never written to Apple Health. If you later edit or delete one of those entries in RepDrop, RepDrop replaces or removes the copy it saved in Apple Health.

Data read from Apple Health is not saved by RepDrop at all: it is read again each time you open the Body tab and held only in the App's memory while it runs. It is never sent to me, to Firebase, or to anyone else (except in a CSV export you make yourself, see above), and never used for advertising or marketing. Turning off the Apple Health connection in RepDrop stops reading and writing; to withdraw the permission itself, use the Health app → Sharing → Apps → RepDrop (or Settings → Health → Data Access & Devices → RepDrop). Apple Health is managed by Apple under your own Apple account and its settings. Other measurement sites (chest, hips, neck, arms, legs and your own sites) exist only in RepDrop.

Android: body measurements are entered manually and stored only on your device. The Android version does not connect to Health Connect or any other health service.

Deleting your body data. Deletion is immediate and cannot be undone.

• A single entry: open the day in the Body tab and delete it (or clear one measurement while editing). It is removed from RepDrop and, on iOS, if RepDrop had saved a copy of it to Apple Health, that copy is removed from Apple Health too (as long as RepDrop still has permission to write to Apple Health).
• Everything: Settings → Body data → Delete all body data removes all body data RepDrop stores on this phone: every measurement, goal and custom measurement site, your height and formula choice, your reminder and notification settings for the Body tab, your consent record and any leftover CSV export. It also turns off the Apple Health connection in RepDrop. It does not remove anything from Apple Health, including copies RepDrop saved there earlier; delete those in the Health app.
• Uninstalling the App also deletes all body data stored by the App. It does not remove anything from Apple Health.

Legal basis (GDPR): Your explicit consent - Art. 9(2)(a) together with Art. 6(1)(a). The App asks for it, on a screen with an equally easy "Not now" choice, before it saves any body data: your first measurement, your height or formula choice, or connecting Apple Health. The Apple Health connection is then a separate choice you make in the App and in iOS. You can withdraw consent at any time with Delete all body data, which also clears your consent and turns off the Apple Health connection in RepDrop; you can additionally withdraw RepDrop's access in the Health app. Withdrawing does not affect anything done before you withdrew. The weekly measure-in reminder contains no body data, so you can turn it on without giving this consent.

Zakładka „Body" pozwala zapisywać wagę, obwody ciała, procent tkanki tłuszczowej i wzrost (a w wersji Pro także własne miejsca pomiaru i cele). Opcjonalnie możesz wybrać męską lub żeńską wersję wzoru szacującego tkankę tłuszczową. To dane dotyczące zdrowia (art. 9 RODO). Są przechowywane wyłącznie na Twoim urządzeniu: nie trafiają do iCloud ani do kopii zapasowych (iCloud, komputer, Google) ani do transferu między urządzeniami na Androidzie, nie są wysyłane do mnie ani do Firebase (analityka wie jedynie, że wykonano daną czynność i jakiego rodzaju pomiaru dotyczyła, nigdy jaką miała wartość), nie są sprzedawane ani używane do reklamy. Na iOS możesz opcjonalnie połączyć RepDrop z aplikacją Zdrowie: RepDrop odczytuje wagę, procent tkanki tłuszczowej, obwód talii i wzrost (odczytanych danych nie zapisuje, trzyma je tylko w pamięci) oraz zapisuje w aplikacji Zdrowie wyłącznie wpisane przez Ciebie wagę, procent tkanki tłuszczowej i obwód talii (nigdy wartości szacunkowe). Dostęp zmienisz w aplikacji Zdrowie. Na Androidzie pomiary wpisuje się ręcznie, bez Health Connect. Usunięcie pojedynczego wpisu usuwa go z RepDrop oraz kopię, którą RepDrop zapisał w aplikacji Zdrowie. „Usuń wszystkie dane pomiarów" (Ustawienia → Pomiary ciała) usuwa wszystkie dane ciała z RepDrop na tym telefonie, w tym zgodę, ale nie usuwa niczego z aplikacji Zdrowie (to robi się bezpośrednio w niej); to samo dotyczy odinstalowania aplikacji. Szacunki w wersji Pro nie są poradą medyczną. Podstawa prawna: Twoja wyraźna zgoda (art. 9 ust. 2 lit. a) i art. 6 ust. 1 lit. a) RODO), o którą aplikacja prosi przed zapisaniem jakichkolwiek danych ciała i którą możesz w każdej chwili wycofać, używając „Usuń wszystkie dane pomiarów".

2.8 Workouts and Mindful Minutes in Apple Health / Treningi i minuty uważności w aplikacji Zdrowie

iOS only, optional, free, off by default. In Settings → Apple Health → Workouts and mindful minutes you can let RepDrop save your activity to Apple Health. The first time you turn it on, RepDrop explains what will be saved and iOS then asks for your permission to write workouts and mindful sessions. RepDrop only writes this data: it never reads workouts or mindful sessions from Apple Health.

While the switch is on, RepDrop saves:

• A workout for each timed break you complete, with the activity type that fits the break (for example walking, flexibility, yoga, core training or strength training) and its start and end time. Breaks you close early are not saved. Hydration, snack, fresh-air and eye-rest breaks are not saved.
• A Mindful Session for each breathing or relaxation break you complete (Box Breathing, Mind Reset, Progressive Relax), with its start and end time.
• A strength workout for each rep session: two or more sets logged no more than 5 minutes apart, spanning at least one minute. It is saved once 5 minutes pass without a new set, starting at your first set and ending at your last. The workout also carries your total reps, the number of sets and the exercise (the built-in exercise identifier, or custom for an exercise you named yourself; the name you typed is never saved to Apple Health). Single sets and sessions from before you turned the switch on are not saved.

Workouts are marked as entered by you. RepDrop never saves calories, active energy, distance or heart rate, because it does not measure them.

Edits and undo. If you undo or remove reps after a rep session was saved, RepDrop updates or removes that workout (for example, undoing your last set moves the workout's end time and rep total, or removes it if the session no longer qualifies) (as long as RepDrop still has permission to write to Apple Health). To do this, RepDrop keeps a small file on this device linking each saved workout to its own record, together with whether the switch is on and when you turned it on. That file holds nothing else, stays in the App's local storage, is excluded from backups, is not stored in iCloud, and is never sent to me.

Turning it off and deleting. Turning the switch off stops RepDrop from saving anything new. It does not remove workouts or mindful sessions RepDrop saved earlier, and neither does deleting data in RepDrop or uninstalling the App. Delete them in the Health app. To withdraw the permission itself, use Health app → Sharing → Apps → RepDrop (or Settings → Health → Data Access & Devices → RepDrop).

Where it goes. Once saved, these records are in Apple Health, which is managed by Apple under your own Apple account and its settings (including any Health sync you have turned on). Other apps you have allowed to read workouts or mindful minutes in the Health app can see them. Nothing RepDrop saves to Apple Health is sent to me, to Firebase, or to anyone else: analytics only learns that the switch was turned on or off (section 2.2). It is never sold and never used for advertising, tracking or profiling.

Android: there is no equivalent feature. The Android version does not connect to Health Connect or any other health service.

Legal basis (GDPR): This feature only copies, at your request and on your device, rep and break history the App already keeps for you (section 2.1); I receive none of it. The basis is performance of the feature you switched on - Art. 6(1)(b). Because exercise records can be data concerning health, the App saves them only after your explicit choice: the switch is off by default, the App explains what it saves before you turn it on, and iOS asks for your separate permission - Art. 9(2)(a). This choice is separate from the body-data consent in section 2.7: giving or withdrawing one does not affect the other. You can withdraw at any time by turning the switch off or by removing RepDrop's access in the Health app; this does not affect anything saved before you withdrew.

Na iOS możesz opcjonalnie i bezpłatnie włączyć „Treningi i minuty uważności" (domyślnie wyłączone). RepDrop wtedy zapisuje w aplikacji Zdrowie (nigdy nie odczytuje z niej treningów ani sesji uważności): trening dla każdej ukończonej przerwy z odliczaniem (rodzaj aktywności, początek i koniec; bez przerw na wodę, przekąskę, świeże powietrze i odpoczynek oczu), sesję uważności dla ukończonych przerw oddechowych i relaksacyjnych oraz trening siłowy dla każdej serii powtórzeń (co najmniej dwie serie w odstępach do 5 minut, trwające łącznie co najmniej minutę), z łączną liczbą powtórzeń, liczbą serii i ćwiczeniem (własne ćwiczenia jako custom, bez wpisanej nazwy). Nigdy nie zapisuje kalorii, energii, dystansu ani tętna. Cofnięcie lub usunięcie powtórzeń aktualizuje albo usuwa zapisany trening (w tym jego godzinę zakończenia). Powiązania z zapisanymi treningami oraz stan przełącznika są trzymane tylko lokalnie na urządzeniu, poza kopiami zapasowymi i iCloud. Wyłączenie przełącznika, usunięcie danych w RepDrop ani odinstalowanie aplikacji nie usuwa niczego z aplikacji Zdrowie; zrobisz to bezpośrednio w niej, tam też odbierzesz RepDrop dostęp. Inne aplikacje, którym pozwolisz odczytywać treningi w aplikacji Zdrowie, mogą je zobaczyć. Nic z tych danych nie trafia do mnie ani do Firebase (analityka wie tylko, że przełącznik włączono lub wyłączono). Podstawa prawna: wykonanie funkcji, którą włączasz (art. 6 ust. 1 lit. b) RODO), oraz Twój wyraźny wybór (art. 9 ust. 2 lit. a) RODO), niezależny od zgody na dane ciała z sekcji 2.7; możesz go w każdej chwili wycofać, wyłączając przełącznik.

03Retention Periods / Okresy przechowywania

04Your Rights Under GDPR / Twoje prawa wynikające z RODO

If you are in the EEA, UK, or Switzerland, you have the following rights:

To exercise any right, e-mail me at hello@bypop.dev. I will respond within 30 days (Art. 12 GDPR).

Right to Lodge a Complaint / Prawo do skargi

Poland - UODO:

Other EU/EEA countries: You may contact the supervisory authority in your country of residence.
UK: Information Commissioner's Office - ico.org.uk

Masz prawo złożenia skargi do Prezesa UODO jeśli uważasz, że przetwarzam Twoje dane niezgodnie z RODO.

05Rights for US Users / Prawa użytkowników w USA

California - CCPA / CPRA

Categories of personal information collected (CCPA):

To submit a request: e-mail hello@bypop.dev with subject "CCPA Request". I will respond within 45 days.

Shine the Light (Cal. Civ. Code § 1798.83): I do not share personal information with third parties for their own direct marketing purposes.

Virginia, Colorado, Connecticut and other US states

I extend the same access, deletion, and correction rights to residents of states with enacted comprehensive privacy laws (VCDPA, CPA, CTDPA, etc.).

06Third-Party Services / Usługi zewnętrzne

All three are US-based. EU data transfers rely on the EU-US Data Privacy Framework adequacy decision under Art. 45 GDPR where the recipient is certified, and on Standard Contractual Clauses under Art. 46(2)(c) GDPR otherwise.

07Children's Privacy / Ochrona prywatności dzieci

RepDrop is not directed at children under 13 (USA - COPPA) or under 16 (Poland / EU). I do not knowingly collect personal data from children below these ages. If you believe a child is using the App, please contact me and I will take appropriate steps.

Aplikacja nie jest przeznaczona dla dzieci poniżej 16 lat (Polska/UE) ani 13 lat (USA).

08Changes to This Policy / Zmiany polityki

I may update this Privacy Policy. When I do, I will update the "Last updated" date above. For material changes, I will display a notice within the App. Your continued use of the App after the effective date constitutes acceptance. This does not replace consent: where processing relies on your consent (body measurements, section 2.7; workouts in Apple Health, section 2.8), the App asks for it separately, and continued use is never treated as consent.

O istotnych zmianach poinformuję w aplikacji.

09Contact / Kontakt

See also the Terms of Use.