Privacy Policy

REPTOR OS ("REPTOR OS", "we", "us" or "our") provides an AI-powered fitness operating system that delivers coaching, adaptive training, nutrition guidance, accountability tooling and the R-XP rewards programme (collectively, the "Services").

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights and choices available to you. It applies to the REPTOR OS website, web application, progressive web app and any related communications.

We collect information that you provide directly, information generated through your use of the Services, and information received from third parties.

Information you provide

• Account information — name, email address, password credentials and authentication identifiers.
• Profile and goal data — training objectives, experience level, availability and preferences captured during onboarding.
• Health and fitness inputs — workouts logged, body metrics, nutrition entries, recovery notes and progress photos you choose to upload.
• Communications — support tickets, bug reports, feature requests and survey responses.
• Payment details — processed by our payment providers; we receive limited billing metadata and never store full card numbers.

Information collected automatically

• Device and technical data — browser type, operating system, device identifiers, language and time zone.
• Usage data — pages viewed, features used, session duration, referral activity and R-XP events.
• Approximate location — derived from IP address for security, fraud prevention and localisation.

Information from third parties

• Authentication providers where you sign in with a third-party account.
• Referral and marketing partners, limited to the data required to attribute a referral.

We use personal information to:

1. Provide, operate, maintain and improve the Services.
2. Generate personalised training, nutrition and recovery recommendations.
3. Operate the R-XP rewards programme and referral engine, including fraud detection.
4. Authenticate users, secure accounts and prevent abuse.
5. Communicate service updates, security notices and, where permitted, marketing.
6. Measure product performance through aggregated analytics.
7. Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use your health or fitness inputs for third-party advertising.

The REPTOR Coach uses machine learning models to generate training plans, nutrition guidance and conversational responses.

• Inputs you submit to the Coach (messages, goals, logged activity) are processed to produce a response and to maintain conversation context.
• Model outputs are informational and are not medical advice. Always consult a qualified professional before changing your training, diet or medication.
• We apply safeguards to limit the personal information sent to model providers and to prevent your data from being used to train third-party foundation models where that option is available to us.
• Automated processing does not produce legal or similarly significant effects about you. You may contact us to request human review of any decision you believe was made in error.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract — to deliver the Services you have requested.
• Legitimate interests — to secure the platform, prevent fraud, and improve the product, balanced against your rights.
• Consent — for optional marketing, non-essential cookies and any processing of health data that requires explicit consent. You may withdraw consent at any time.
• Legal obligation — to meet tax, accounting and regulatory requirements.

We use cookies, local storage and similar technologies to keep you signed in, remember preferences, secure sessions and understand product usage.

• Strictly necessary — authentication, security and load balancing. These cannot be disabled.
• Functional — remembering settings such as units, locale and dismissed prompts.
• Analytics — aggregated measurement of feature usage and performance.

You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent the Services from functioning. A dedicated Cookie Policy will provide a full inventory.

We share personal information only as described below:

• Service providers — hosting, database, email, analytics, payment and AI infrastructure vendors acting on our instructions under written agreements.
• Community features — content you publish to leaderboards, challenges or community spaces is visible to other members.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this Policy.
• Legal and safety — where required by law, or to protect the rights, property or safety of REPTOR OS, our members or the public.

We never share your data with data brokers.

We operate globally and may transfer personal information to countries other than the one in which you reside. Where we transfer data out of the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses together with supplementary technical and organisational measures.

We maintain administrative, technical and physical safeguards designed to protect personal information, including:

• Encryption in transit (TLS) and encryption at rest for stored data.
• Row-level authorisation rules so members can access only their own records.
• Least-privilege access controls and audit logging for internal systems.
• Secure credential storage using industry-standard hashing.
• Continuous dependency and vulnerability scanning of our codebase.

We retain personal information for as long as your account is active and for the period required to:

• Deliver the Services and maintain your training history.
• Resolve disputes and enforce our agreements.
• Comply with legal, tax and accounting obligations.

When you delete your account, we delete or anonymise personal information within 30 days, except where a longer retention period is legally required. Backups are purged on a rolling schedule not exceeding 90 days.

Depending on where you live, you may have the right to:

• Access a copy of the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information.
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with your local supervisory authority.

To exercise any right, email privacy@reptoros.com. We respond within 30 days and will never discriminate against you for exercising your rights.

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact privacy@reptoros.com and we will delete it promptly.

We may update this Privacy Policy to reflect changes to the Services or applicable law. Material changes will be announced in-app or by email at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

Questions about this Privacy Policy or our data practices:

• Privacy inquiries — privacy@reptoros.com
• General support — support@reptoros.com
• Business and legal — legal@reptoros.com