Privacy Policy

Next Rep is a workout logbook for progressive overload. This policy explains the information Next Rep processes, why it is used, the service providers involved, and the choices available to users.

Information we collect

Account and authentication information

Depending on the method a user chooses, Next Rep and Supabase Auth may process:

• email address;
• password authentication data, password reset requests, and password changes;
• one-time email-code requests and verification results;
• Apple or Google provider identifiers, verified-email status, and basic provider profile information;
• an Apple private-relay email address if the user chooses that Apple feature;
• a name Apple provides on the first authorization, when available;
• provider-linking status and sign-in method information;
• Next Rep's internal Supabase user UUID; and
• Supabase session tokens used to keep the user signed in.

Passwords are transmitted to Supabase Auth for authentication and are not stored by Next Rep in plain text. Next Rep does not copy provider tokens into its own application data; Apple, Google, and their SDKs may manage credentials under their own policies.

Legal acknowledgment information

Next Rep stores the exact Terms version accepted, the Privacy version acknowledged, the disclosure locale, the app version, the action context, and a server-generated time associated with the user's Supabase UUID. This legal acknowledgment is separate from marketing consent; Next Rep does not treat continuing into the app as consent to marketing messages.

Profile and onboarding information

Next Rep stores information a user enters or confirms during setup and Settings, including:

• display name;
• onboarding progress and the last required step;
• answers about what the user wants help with;
• preferred unit, such as pounds or kilograms;
• gender option and optional self-description;
• birth year, height, and body weight in pounds and kilograms;
• whether body weight was entered or estimated;
• training goal, experience level, and training style;
• selected starter workout or split identifier and recommendation state; and
• onboarding completion version and timestamps.

If a user skips bodyweight entry, Next Rep may estimate bodyweight from profile details so bodyweight-based workout calculations can work. The user can edit bodyweight later. Selecting a starter during onboarding does not itself create workout content before the applicable access stage is active.

Workout information

Next Rep stores workout data users create, including:

• workout sessions, titles, start and finish times, pause timing, duration, device time zone, status, and source template;
• exercises, movement names, exercise order, and tracking fields such as weight, dumbbells, bodyweight, assisted or weighted bodyweight, time, distance, reps, laps, rounds, or lengths;
• set rows, including entered values, warmup or working type, completion state, source, time, load, reps, distance, duration, count, and calculated volume;
• exercise history and latest-use timestamps;
• saved workout templates, template rows, workout splits, and split order; and
• calculated stats, consistency information, and personal records.

App activity and diagnostics

Next Rep records limited first-party events for product health and usage understanding, such as app opened, profile completed, workout started, and workout finished. These events may include the account UUID, event name and time, activity date, device time zone, and related workout session UUID. Repeated app-open events are throttled.

Next Rep may also use privacy-conscious Apple system diagnostics, crash reports, performance metrics, and application logs to investigate reliability. Logs are designed not to contain passwords, session tokens, email codes, provider tokens, nonces, complete authentication URLs, or email addresses.

Service providers may process standard technical request information, such as IP address, device or browser information, timestamps, and request metadata, to deliver and protect their services.

Subscription or entitlement information

If paid access is enabled, Next Rep may process plan and entitlement status, provider, product identifier, provider customer identifier, transaction identifiers, trial or subscription period dates, and verification time. Purchases made in the iPhone app are processed by Apple. RevenueCat may be used to validate purchases and synchronize entitlement state. Email is not used as the RevenueCat App User ID; the Supabase UUID is used instead.

Information stored on the user's device

Depending on the current client, Next Rep may store:

• language and display preferences;
• Supabase session tokens in browser session/local storage or the iOS Keychain;
• a recoverable active workout draft and pending synchronization queue;
• a temporary, user-specific copy of the latest onboarding answer waiting to be saved;
• the email address currently being used for OTP entry until the flow finishes or is canceled; and
• timestamps used to throttle activity events or authentication resends.

Universal Link and provider callback values are processed only to complete the requested authentication or recovery action. They are not displayed or intentionally written to logs. Clearing browser storage, signing out, deleting the native app, or using device settings may remove some local information, but does not delete server data.

How we use information

Next Rep uses information to:

• create, authenticate, protect, recover, and link accounts;
• record the Terms version accepted and Privacy version acknowledged;
• save onboarding progress and resume it across devices;
• save, synchronize, and recover workout logs;
• recall recent exercise values and repeat workouts;
• calculate volume, stats, consistency, and personal records;
• save and reuse templates and splits;
• personalize setup and recommendations;
• provide and verify subscription access if paid access is enabled;
• provide support and respond to account, export, or deletion requests;
• prevent abuse, diagnose failures, maintain security, and improve reliability; and
• understand limited first-party product usage.

How information is shared

Next Rep does not sell personal information. It does not use user workout data for third-party advertising.

Information is shared only as reasonably necessary with service providers that help operate the app, including:

• Supabase for authentication, database storage, sessions, and related backend services;
• Apple for Sign in with Apple, App Store distribution, and purchases when applicable;
• Google for Google Sign-In when the user selects it;
• hosting, domain, and email-delivery providers for public pages, authentication links, and transactional email; and
• RevenueCat for purchase validation and entitlement synchronization if paid access is enabled.

Information may also be disclosed when reasonably necessary to comply with law, protect users or the service, investigate fraud or security issues, or complete a business transfer subject to appropriate safeguards.

Next Rep does not currently include public profiles, a social feed, or third-party marketing analytics in the app.

Data security

Profile and workout data is stored in Supabase Postgres. Row Level Security restricts authenticated users to their own user-owned rows. Authentication sessions use Supabase Auth, and native session storage uses the iOS Keychain. Sensitive callbacks are restricted to allowlisted routes and are not intentionally logged.

No system can guarantee perfect security. Next Rep uses reasonable technical and organizational safeguards, limits the information it collects, and does not copy provider tokens into its own application data unless a future feature specifically requires them and this policy is updated.

Data retention

Account, profile, onboarding, workout, template, split, entitlement, and related information is generally kept while the account exists, unless deleted earlier through product controls or an approved request.

Legal-acknowledgment records are retained while the account exists and are deleted with the account through the approved deletion process. Detailed activity events may be cleaned up over time; aggregated activity summaries may be retained while the account exists. Service-provider logs and backups follow operational retention cycles and may remain briefly after a deletion request.

Completed workouts, active drafts, templates, splits, and exercise-library entries may be removed through available controls. Historical workout rows may retain the movement name needed to preserve the user's workout record even after an exercise is removed from future search.

User choices

Depending on the available client, users can:

• choose among supported sign-in methods and, if authenticated provider linking is enabled in the available client, link a supported provider;
• edit profile, unit, bodyweight, and training preferences;
• reset or change a password;
• sign out and clear local app data;
• delete completed workouts and discard active drafts;
• delete templates and splits and remove exercises from future search; and
• manage an Apple subscription through Apple.

Until authenticated self-service export and deletion are available, users can request a portable copy of stored data or account deletion by contacting hello@brightpixel.marketing. Deleting a Next Rep account does not automatically cancel an Apple subscription.

Children's privacy

Next Rep is not intended for children under 13. If you believe a child under 13 has provided personal information, contact hello@brightpixel.marketing so the account can be reviewed and deleted as appropriate.

Changes to this policy

This policy may be updated as Next Rep changes. The version and effective date identify the applicable text. If a material change requires renewed acknowledgment, Next Rep will present the updated policy before continued use.

Contact

Questions or requests about this policy can be sent to hello@brightpixel.marketing.