Privacy Policy.

1. Scope and who is responsible

This Privacy Policy applies to the MaxRep mobile application, maxrep.me, public workout and profile pages, club and group experiences, and related services that link to it (the “Service”). “MaxRep,” “we,” “us,” and “our” refer to the operator of the Service.

This Policy does not cover a gym, coach, club, app store, device platform, or other third party acting under its own privacy policy. When an organization uses MaxRep to manage a private space, it may receive member information and may have additional responsibilities for how it uses that information.

2. Information we collect

The information collected depends on the features you use, your settings, your device permissions, and what you choose to share.

Account and contact information

• Name, username, email address, phone number, profile image or avatar, login credentials or tokens, and account preferences.
• Age or date-of-birth information where needed to confirm eligibility.
• Records of consent, authentication attempts, one-time-password delivery, opt-outs, and support communications.

Fitness and activity information

• Exercises, sets, repetitions, weight, training volume, workout title and type, duration, dates, personal records, streaks, active days, estimated calories, distance, and related notes.
• Route, approximate or precise location, gym or venue information when you choose a location-enabled feature or attach location to activity.
• Data imported from a device, platform, or connected service only when you authorize that connection.

Nutrition information

• Foods, meals, serving information, barcodes, calories, macronutrients, nutrition goals, and related logs.
• Meal photographs, camera input, and voice or audio input submitted to identify or log food.

Community and club information

• Posts, comments, reactions, kudos, follower and following relationships, shared workouts, leaderboard results, challenge participation, groups, clubs, sessions, events, attendance, and membership.
• Club or administrator information such as workout programming, schedules, descriptions, exercise protocols, time caps, member management actions, and access or unlock codes.

Device, network, and usage information

• IP address, device and browser type, operating system, app version, language, time zone, crash and diagnostic information, pages or features used, timestamps, referring pages, and security events.
• Cookies, local storage, session tokens, and similar technologies necessary for sign-in, security, preferences, and core website operation. If we add non-essential analytics or advertising technologies, we will provide any notice or choice required by law.

Information you choose to provide

This includes messages to support, feedback, survey responses, reports, and any other information submitted through free-form fields. Please avoid including medical details or other sensitive information unless needed for your request.

3. Where information comes from

We collect information:

• directly from you when you register, log activity or food, post, join a group, contact support, or request a verification code;
• automatically from your browser, device, and use of the Service;
• from people and organizations you interact with, such as a club administrator who adds you to a group, another member who tags or follows you, or a person who reacts to a shared workout;
• from services you connect or authorize, such as a device platform or data integration; and
• from vendors that help with identity verification, SMS delivery, fraud prevention, security, or support.

4. How we use information

We use information to:

• create and secure accounts, authenticate users, send one-time passwords, recover access, and prevent fraud or abuse;
• record and display workouts, nutrition, routes, metrics, streaks, personal records, calendars, rankings, and progress;
• process photo, voice, and barcode inputs to provide requested food identification and nutrition estimates;
• operate profiles, feeds, reactions, comments, followers, public share pages, groups, clubs, events, challenges, and leaderboards;
• personalize the Service, remember settings, provide support, and communicate about transactions, security, moderation, or changes;
• debug, measure performance, conduct internal research, improve accessibility and features, and develop the Service;
• enforce our Terms and Conditions, protect members and the Service, investigate violations, and comply with law; and
• create aggregated or de-identified statistics that are not reasonably linkable to you.

Where applicable law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (including for certain device permissions or SMS), and compliance with legal obligations. You may withdraw consent at any time, but withdrawal does not affect earlier lawful processing.

5. Public and social features

Your profile name, username, avatar, workout summaries, metrics, posts, comments, achievements, ranks, follower relationships, and other content may be visible to the audience you select. Public pages and share links can be viewed without an account, indexed by search engines, copied, or reshared. Members and administrators of a group or club may see information connected to that space.

Precise routes, locations, nutrition records, and health-related details deserve particular care. Check the visibility setting before publishing. If a field or audience control is unclear, treat the information as shareable and do not submit sensitive data until you confirm the setting.

6. How we disclose information

We may disclose information in these circumstances:

• At your direction or based on your settings. To the public, followers, selected members, groups, clubs, event participants, or people who receive your share link.
• To service providers. Vendors that provide hosting, storage, databases, customer support, authentication, SMS delivery, security, maps, food or barcode data, content processing, and app operations. They may process information only for contracted services and subject to appropriate restrictions.
• To connected services. When you ask us to import, export, or synchronize information with another service.
• To clubs and administrators. Information needed to operate a club, private group, scheduled workout, event, leaderboard, or member experience.
• For safety and legal reasons. If reasonably necessary to comply with law or legal process; enforce our terms; detect or investigate fraud, security issues, or illegal activity; or protect the rights, property, health, or safety of MaxRep, members, or others.
• For a business transaction. In connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to legal safeguards and notice where required.
• With your consent. For another purpose clearly disclosed to you.

We may disclose aggregated or de-identified information where it cannot reasonably identify you, and we will not attempt to reidentify it except to test our de-identification safeguards or as permitted by law.

7. Your controls and choices

• Profile and sharing: update account information and use available audience, privacy, follow, block, group, and sharing controls.
• Location, photos, camera, and microphone: change permissions in your device settings. A feature may not work if its required permission is disabled.
• Connected services: disconnect an integration in MaxRep or the third party’s settings. Previously imported information may remain until deleted.
• Communications: use unsubscribe links for marketing email, device settings for push notifications, and reply STOP to qualifying SMS. Essential account and security notices may still be sent through available channels.
• Access, correction, export, and deletion: use available in-product tools or email hello@maxrep.me. We may verify your identity before acting.

Browser “Do Not Track” signals do not have a universal standard. Where legally required and technically supported, we honor recognized opt-out preference signals such as Global Privacy Control for sale or sharing. Because the current Service does not sell personal information or share it for cross-context behavioral advertising, such a signal may not change your experience.

8. Data retention

We keep personal information only as long as reasonably necessary for the purposes described in this Policy. Retention depends on the type of information, whether your account is active, your settings and requests, legal and contractual requirements, dispute and safety needs, and technical backup cycles.

Account and activity content generally remains while your account is active. After deletion, information may remain for a limited time in backups or where needed for security, fraud prevention, recordkeeping, legal claims, or compliance. SMS consent and opt-out records may be retained to document compliance and respect your messaging choice. Public copies saved or reshared by others are outside our control.

9. Security

We use administrative, technical, and organizational safeguards designed to protect information, such as access controls, secure transport, authentication, monitoring, and vendor controls where appropriate. No system, transmission, or storage method is completely secure. Protect your credentials and verification codes, use a secure device, and report suspected account compromise promptly.

10. Children’s privacy

MaxRep is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that a child under 13 submitted personal information, we will take appropriate steps to delete it. A parent or guardian who believes this occurred may contact us.

Teen users should involve a parent or guardian before sharing workouts, routes, photographs, nutrition information, or other sensitive content. Local law may provide additional protections for minors.

11. U.S. state privacy rights

Depending on where you live and whether applicable legal thresholds are met, you may have the right to request access to or a copy of personal information; correction; deletion; portability; information about categories, sources, purposes, and recipients; and to appeal a denied request. You may also have rights to opt out of sale, targeted advertising, profiling with legal or similarly significant effects, or certain uses of sensitive information.

MaxRep does not discriminate against you for exercising a privacy right. To submit a request, email hello@maxrep.me with “Privacy Request” in the subject line. We will verify your request using information reasonably related to your account. An authorized agent may submit a request where allowed, but we may require proof of authority and direct confirmation from you.

As described above, MaxRep does not currently sell personal information or share it for cross-context behavioral advertising. If that practice changes, we will update this Policy and provide required opt-out links and controls before the new practice applies.

12. Rights outside the United States

If privacy law in your country applies, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent, and complain to your local data-protection authority. You may also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. MaxRep does not use workout or nutrition estimates to make such decisions.

Some rights have exceptions. We will explain a refusal when required and provide available appeal or complaint information.

13. International data transfers

MaxRep and its service providers may process information in the United States and other countries whose laws differ from those where you live. Where required, we use recognized safeguards for international transfers, such as contractual protections, adequacy decisions, or another lawful mechanism.

14. Security incidents and health information

If a security incident affects your information, we will investigate and provide notices to you, regulators, or others as required by applicable law. Fitness, nutrition, and related identifying data may be subject to consumer-health privacy or breach-notification laws even when MaxRep is not a health-care provider covered by HIPAA.

15. Changes to this Policy

We may update this Policy as MaxRep, our data practices, or the law changes. We will post the revised Policy, update the date above, and provide additional notice before material changes take effect where required.

16. Contact us

For privacy questions or requests, use MaxRep’s in-app support tools or email hello@maxrep.me. Include “Privacy Request” in the subject line for rights requests, but do not send passwords, verification codes, government identification, or sensitive medical information by ordinary email unless we specifically request it through a secure channel.