1. About RepDesk and this policy
RepDesk is a coaching application for independent personal trainers and their invited clients. Trainers use RepDesk to plan and assign workouts, guide sessions, record training, review completed work, and follow progress. Invited clients use it to view assigned training, log workouts, review progress, and manage their account.
This policy covers trainers, invited clients, and people who contact RepDesk for support.
RepDesk supports non-medical personal training. It does not diagnose, treat, or provide medical advice.
2. Information RepDesk handles
Account and profile information
RepDesk may handle names, preferred names, email addresses, phone numbers, authentication identifiers, account roles, coaching format, invitation status, and contact preferences. Trainers create and manage client relationships; clients join through a trainer invitation rather than open client registration.
Workout, fitness, and coaching information
RepDesk may handle workout names and descriptions, exercises, sets, repetition and load targets, rest guidance, session dates, completed repetitions and loads, completion status, skipped-work reasons, substitutions, coaching cues, workout notes, review status, progress history, personal records, and achievements.
Goals, limitations, and free text
Trainers may record client goals and experience level. Dedicated injury and physical-limitation entry is retired in the current app; previously saved entries remain subject to current consent and relationship restrictions. The current health notice requires a fresh client choice before health-information features resume. Free-text notes, reasons, and goals may still contain health-related or otherwise sensitive information. Client health-information consent is a separate choice in Profile; refusing or withdrawing it restricts ordinary health entry and display but does not erase existing records. Users should provide only information appropriate for the coaching relationship.
Identifiers and operational information
RepDesk uses internal user, client, trainer, workspace, workout, assignment, and log identifiers. It also records information needed to operate the service, such as session timestamps, assignment state, review state, audit changes, queued sync work, and locally saved drafts.
3. How information is used
RepDesk uses information to:
- create and secure trainer and invited-client accounts;
- connect clients to the correct trainer workspace;
- plan, assign, deliver, log, synchronise, and review workouts;
- show relevant progress, history, records, and achievements;
- support offline drafts and recoverable synchronisation;
- protect account boundaries, investigate errors, and maintain service integrity;
- respond to support and privacy enquiries; and
- improve app functionality based on operational needs and user feedback.
RepDesk does not integrate advertising, cross-company tracking, an analytics SDK, or a data-broker service. RepDesk does not sell personal information. This static site contains no analytics or advertising scripts or contact form; Cloudflare processes website traffic as described below.
4. Service providers and disclosures
RepDesk relies on service providers where needed to operate the app:
- Supabase provides authentication, the hosted database, and server functions. The primary RepDesk database is configured in Sydney, Australia.
- Apple processes information when a user chooses Sign in with Apple. Apple may provide an authentication identifier and, where applicable, relay email information.
- Cloudflare Pages hosts this website and processes visitor traffic, including IP addresses and routing information. The website does not receive your coaching database records.
- Google Gmail hosts the RepDesk support mailbox. If you email us, Google handles your address, message and attachments. Do not email passwords, invitation tokens or health details.
- Your chosen sharing service handles an invitation when you choose to send its private link by email, SMS or another app. RepDesk does not currently have an automatic invitation-email provider configured.
- Expo/EAS is used for app build and distribution services and handles application source, assets, and public runtime configuration as part of that process. It is not integrated into RepDesk as an in-app advertising or analytics service.
Information may also be disclosed when reasonably necessary to comply with applicable law, protect users or the service, or establish, exercise, or defend legal rights. RepDesk does not disclose personal information to advertisers or data brokers.
5. Storage and international processing
The primary database and authentication service are hosted in Sydney, Australia. This does not mean all processing stays in Australia: provider operations, server functions, support and distribution may involve other countries. Cloudflare describes primary information storage in the United States and European Economic Area, with global access. Supabase describes processing in the United States and other countries where it or its providers operate. Google, Apple and Expo also operate internationally. See the provider policies linked below for their processing arrangements.
The app also stores owner-scoped caches, drafts, workout information, and pending synchronisation data on the device. Device data remains subject to the security of the device and operating system.
6. Retention
RepDesk keeps coaching records while the relationship is active. Archiving ends active coaching and makes a minimal summary recoverable for 12 calendar months from the server archive date. At expiry, ordinary access and reactivation end. A daily cleanup permanently deletes expired relationships and their linked coaching history from the live database. Ordinary access and reactivation end at the expiry boundary; disposal follows on the next successful cleanup run. Outages or a cleanup backlog may delay physical removal. The client’s independent sign-in account is not deleted merely because a relationship expires. RepDesk does not keep coaching history inside the app merely in case of future legal action against a trainer.
Private fingerprints of deleted record identifiers prevent old offline changes from restoring deleted records. They contain no names, contacts or coaching content and are removed when the owning workspace is deleted. They are not described as anonymous. Encrypted recovery copies are kept separately from the app database and are not available through trainer or client screens. Our retention policy for RepDesk-controlled recovery copies is 30 days from creation. A live account deletion does not rewrite an existing recovery copy; deleted information must be removed before a restored copy is returned to service. Our retention policy for routine support correspondence is deletion 90 days after the case is resolved. An identified legal preservation requirement may require particular records to be kept longer, with restricted access. Operational logs have a separate lifecycle. Provider security and recovery records may outlast removal from their active systems under their own retention policies. RepDesk cannot promise immediate removal from every log, backup, or third-party system.
7. Account deletion
Account deletion can be initiated in the app from Profile → Danger Zone → Delete Account. The confirmation requires the user to type DELETE.
- Trainer deletion: the server first deletes the trainer workspace and associated client, workout, plan, log, review, and audit rows, then removes the trainer’s authentication access. If either step fails, the user receives an error and may retry.
- Invited-client deletion: the server permanently removes authentication access, the client profile, invitations, consent records and linked workout and coaching history. Deletion also ends access to any archived relationship. Unrelated clients and reusable non-client-specific trainer templates are preserved.
After the server confirms deletion, the current app clears known local caches, drafts, and queued data belonging to the deleted account while preserving data scoped to other accounts on the same device.
Automatic Sign in with Apple token revocation is not yet verified. When RepDesk cannot revoke an Apple authorisation automatically, the app directs the user to open iPhone Settings, tap their name, then Sign in with Apple, select RepDesk, and tap Delete. This removes the Apple sign-in authorisation separately from deleting the RepDesk account. Contact RepDesk if you need help with either step.
8. Security
RepDesk uses authentication, role-based access controls, database row-level security, workspace boundaries, and owner-scoped device caches to reduce unauthorised access. Access is intended to be limited to the trainer responsible for a workspace and each client’s own information.
No system or transmission method is perfectly secure. Device-side caches are not separately encrypted by RepDesk, so users should protect their device and account credentials and report suspected unauthorised access promptly.
9. Children’s information
RepDesk version 1 is intended for adults aged 18 or over in Australia. RepDesk asks trainers and invited clients to confirm they are at least 18; it does not collect a date of birth or independently verify age. Contact RepDesk if you believe a child’s information has been entered.
10. Access, correction, and questions
Users can update certain information through their trainer or account workflow and can initiate account deletion in the app. For requests to access or correct information, questions about retained coaching history, or other privacy concerns, contact RepDesk. We may need to verify your identity before acting. Please describe the information or concern and the outcome you seek. We aim to respond to privacy complaints within 30 days and will explain if more time is needed. If you are not satisfied, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.
11. Provider information and policy changes
Provider information: Supabase privacy, Supabase data locations, Cloudflare privacy, Google privacy, Google retention, Apple privacy and Expo privacy.
This policy may be updated when RepDesk’s features, service providers, or data practices change. The updated page will show a revised “Last updated” date. Material changes may also be communicated through an appropriate in-app or account channel.
12. Contact
Responsible contacts: Prakhar Srivastava and Nejdet Sonmez
For privacy questions or requests, email repdesk.demo@gmail.com.
For general help, visit RepDesk Support. The Terms of Service also apply to use of RepDesk.