Privacy Policy

Kong, your coach, is powered by AI models run by OpenAI, our AI processor. RepKong asks for your agreement before anything is sent. You can use the free logger without it.

What is sent to OpenAI when you agree: your messages to Kong; your workouts, programs, goals and the notes Kong keeps about you; your profile answers (such as goal, equipment and injuries); the health information you tell Kong about yourself (injuries, conditions, medication), which goes with your chat; Apple Health data if you allow Health access (the recent values with each chat turn, and up to 90 days when you ask Kong about trends); the photos you choose to scan at your gym; and voice recordings that need transcription.

Not used to train models. OpenAI processes this data under its API terms, which do not allow training on API inputs or outputs. OpenAI keeps API inputs and outputs for up to 30 days to detect abuse, then deletes them.

Withdraw at any time: open Settings, then Kong, and turn off AI. RepKong then sends nothing to OpenAI. Logging sets, plates and your program keep working. Data already processed stays under OpenAI's 30-day retention above.

Account data. Email address, and (if you sign in with Apple or Google) the name and avatar provided by those identity providers.

Onboarding profile. Experience level, age, primary training goal, available equipment, days per week, session length, injuries, unit system, and any free-text notes you provide.

Training data. Every workout log you create — strength sets, cardio, check-ins, body metrics — along with the programs your coach generates, your personal records, goals, and chat history.

Voice logging (iOS). When you log a set by voice, your phone transcribes your speech on the device when it can. When it cannot, or you have not allowed on-device speech recognition, the recording is sent to OpenAI to be transcribed (whisper-1). We use the audio only for that transcription and do not store it.

Gym photo scan (iOS). When you scan your gym, your phone shrinks the photos and removes their location data, then sends them to OpenAI to see which equipment is in the shot. We use the photos only for that, do not store them and do not keep them in chat or in our logs. We keep only the equipment you confirm.

Chat attachments. Images you upload during chat (for example, form checks) are stored in AWS S3 and served via CloudFront (images.repkong.com).

Health data (iOS, with your permission). If you connect Apple Health, the app syncs the last 14 days of sleep hours and quality, overnight heart-rate variability, resting heart rate, steps, active energy and workouts (type, minutes and energy) to our servers. We store them with your account, whether or not you agree to AI, so Kong can compare you with your own normal. They go to OpenAI only after you agree to AI. We never sell them. Turning off access in iOS Settings (Health, Data Access and Devices, RepKong) stops new uploads; what we already stored stays until you delete your account, which deletes it (backups are purged within 90 days, see Data retention). RepKong writes one thing to Apple Health: if you turn on Tell me when rest is up and leave Save workouts to Apple Health on, it saves your strength workout there. Turn that off in Settings, Apple Health.

Payment data. We do not store credit-card numbers. Web subscriptions are processed by Stripe; iOS subscriptions by Apple. We store your subscription status, plan, and renewal date so the app can gate access correctly.

Analytics. We use PostHog and Google Analytics to track product usage (page views, feature clicks, conversion events). These tools use cookies and identifiers in line with their own privacy policies.

To run the coaching service. Your profile, training history, and recent messages are assembled into a context snapshot that is sent to the AI model with each request. This is how the coach “remembers” your history.

To give the coach a memory. The coach saves durable facts about your training (e.g. “prefers volume-first programming,” “shoulder sensitive to OHP”) in our own database so future conversations feel continuous. Ask the coach to forget any of them at any time and it stops using them.

To operate the product. Delivering notifications, billing you, preventing abuse, and debugging issues.

To improve the product. Aggregated analytics help us understand what works. We do not sell your data.

We do not use your data to train foundation models. Your messages, your Health values (only if you connect Apple Health and agree to AI; see Health data above), and voice recordings that need transcription, are sent to OpenAI for inference and transcription only, under their API data-use terms (no training on API inputs).

We use a small set of service providers, each with access only to what they need:

• Supabase — authentication and database hosting
• OpenAI — chat model inference (your messages and training context), the gym photos you scan and, when your phone cannot do it on the device, transcription of voice recordings
• Stripe — web subscription billing
• Apple — iOS subscription billing and receipt validation
• Amazon Web Services (S3 + CloudFront) — image storage and delivery
• PostHog and Google Analytics — product analytics
• Vercel — web hosting
• Sentry — error tracking: which feature failed, the error details, and your account id. We do not intentionally send your messages to it.
• Upstash — a Redis store that counts your requests and model usage for rate limits, keyed by your account id. It holds no message content.

We only share data with law enforcement when required by valid legal process.

We keep your data for as long as your account is active. If you delete your account in the app (Settings, Account, Delete account) or by asking Kong, we permanently remove your profile, logs, programs, goals, and chat history from our systems immediately. Aggregated, anonymized analytics may be retained longer.

Backups are retained for up to 90 days and then purged on a rolling basis.

Operational records held by our providers are not removed when you delete your account: error reports (Sentry) and rate-limit counters (Upstash, which expire on their own within days). They carry your account id but no chat messages and no email or name.

You can access, correct, export, or delete your data at any time. You can export it and delete your account in the app under Settings, Account, or by asking Kong. If you cannot, email support@repkong.com from the address associated with your account and we'll act within 30 days.

If you are in the EEA, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA — including the right to object to processing and to lodge a complaint with a supervisory authority.

You can opt out of analytics via your browser's Do Not Track setting or by disabling cookies. Mobile users can reset their advertising identifier in system settings.

Data is encrypted in transit (TLS) and at rest. Access to production data is limited to a small number of engineers and logged. We'll notify affected users within 72 hours of becoming aware of a breach that risks your rights.

RepKong is intended for users 18 and over. We do not knowingly collect data from anyone under 13. If you believe a child has given us their information, contact us and we'll delete it.

RepKong is operated from the United States. If you use it from outside the US, your data will be transferred to and processed in the US and wherever our service providers operate. By using the service you consent to this transfer.

We'll update this page when our practices change and bump the “Last updated” date at the top. For material changes we'll notify you by email or in-app before they take effect.

Questions, access requests, or complaints: support@repkong.com. See also our Terms of Service.