Strength Training App
ZyRep LLC ("ZyRep," "we," "us," or "our") operates the ZyRep iPhone app and related websites (collectively, the "Services"). This Privacy Policy explains how we handle personal information when you create an account, request AI-generated workouts, use community features, communicate with us, or otherwise use the Services. The Services are intended for individuals in the United States.
Our separate Consumer Health Data Privacy Policy applies whenever ZyRep processes consumer health data, including health or limitation responses and health-related workout data. We present separate choices for optional health data collection and for disclosure of health data to our AI service provider.
As of the Effective Date, ZyRep does not collect precise geolocation (gym location is self-reported text only), does not integrate with wearable devices, Apple Health, or Google Fit, and does not offer public web profiles. ZyRep may add these features in the future. If it does, ZyRep will update this Policy to describe the information involved before the feature is available to you, will make each feature off by default where it involves sharing or new collection, and, where a feature introduces a new consumer health data category, purpose, or recipient, will obtain your fresh affirmative consent as described in Section 11.
Android distribution through Google Play and use of RevenueCat to administer subscription entitlements are planned and are not active as of the Effective Date. ZyRep will update this Policy to describe the information involved before activating those services and obtain any consent required for the new processing.
ZyRep does not currently sell personal information, use personal information for cross-context behavioral advertising, or use health information for advertising or marketing.
ZyRep generates workouts using Anthropic's commercial API. Anthropic processes the information described in this Section on ZyRep's behalf under contract, solely to generate the workout, plan, or post-workout suggestion you requested. ZyRep sends goals, experience level, equipment, training frequency, optional gym location, preferences, and workout history to the extent needed to generate the workout, plan, or post-workout suggestion you requested. With your separate permission, ZyRep also sends your optional health information, including injuries, physical limitations, surgical history and restrictions, chronic conditions affecting training, body measurements, recovery information such as sleep and stress, nutrition, other activity, and your Trainer Notes. Trainer Notes are stored with your profile on all tiers but are sent to Anthropic only when ZyRep generates a workout, plan, or post-workout suggestion for you; on the free tier, which does not include generated workouts, plans, or post-workout suggestions, Trainer Notes are not transmitted to Anthropic. The generated workout and related inferences are returned to ZyRep and stored with your account. Anthropic's processing on ZyRep's behalf is governed by its Commercial Terms and incorporated Data Processing Addendum, together with the applicable API retention practices described below.
Health data collection and disclosure of health data to Anthropic are two independent choices presented during onboarding. You may skip either choice, and you may withdraw either choice separately in Settings at any time. Withdrawing collection consent stops the affected future collection. Withdrawing disclosure consent stops the affected health data from being sent with future workout-generation requests. Withdrawal does not by itself delete information already held; you may separately request deletion under Section 7.
Authorized personnel may access relevant information only when reasonably needed for support, safety, or troubleshooting.
As of the Effective Date, ZyRep does not use personal information, consumer health data, AI inputs, AI outputs, or user feedback to train, fine-tune, evaluate for improvement, benchmark, or otherwise improve a ZyRep or third-party artificial intelligence or machine learning model. ZyRep does not submit API inputs or outputs as model feedback, participate in an Anthropic model improvement program, or authorize Anthropic to use ZyRep's commercial API inputs or outputs for model training or improvement. This restriction does not prevent limited processing needed to provide or secure the API service, enforce Anthropic's Usage Policy, or comply with law. You may withdraw permission to share health data with Anthropic for future requests and continue to receive workouts personalized from your non-health information.
As of the Effective Date, ZyRep uses Anthropic's standard commercial API retention. Anthropic states that it automatically deletes API inputs and outputs from its backend within 30 days after receipt or generation, except when a feature has a different retention setting, ZyRep and Anthropic agree otherwise, or longer retention is needed to enforce Anthropic's Usage Policy or comply with law. Anthropic does not offer ad hoc deletion of individual API submissions. These provider retention practices do not limit your deletion rights or ZyRep's obligations under applicable law. ZyRep separately retains the source information and generated outputs described in Section 7.
Your username, display name, avatar, and trainer selection are visible to other signed-in users regardless of your privacy settings. Community posts and follower relationships are also visible to signed-in users. Users who have blocked each other cannot see any of each other's content.
Other profile content is visible to other signed-in users only when Allow Others To View My Profile is on and neither party has blocked the other, as follows: photos are visible when Show Photos is also on; workout information is visible when Show Total Workouts or Show Days Active is also on; and personal records and badges are visible when Show Total PRs / Badges is also on. Show Photos, Show Total Workouts, Show Days Active, and Show Total PRs / Badges default to on, but none of them expose content until Allow Others To View My Profile is turned on.
Allow Others To View My Profile, Auto-post New PRs To Community, Auto-post New Badges To Community, and Auto-post Workouts And Milestones are off by default.
Avatar images and post image files are stored at web addresses that anyone with the exact link can open, whether or not they are logged in to ZyRep. ZyRep does not offer search engine indexing of profiles or community content. Deleting a post, photo, or account removes the underlying file. Other profile and community content is accessible to signed-in users only, as described above, and may be copied, screenshot, or reshared.
Public web profiles. ZyRep plans to offer public web profiles at zyrep.com/username. This feature is not available as of the Effective Date. When it launches, public web profiles and search engine indexing will be off by default, will require your affirmative choice to enable, and will be governed by this Policy.
We disclose information to the following recipients for the stated purposes:
Third-party protections. ZyRep takes reasonable steps to ensure that each service provider, SDK provider, or other business recipient to which ZyRep provides user data provides the same or an equivalent level of protection as this Policy, applicable law, and applicable app store rules require. When a service provider processes personal information on ZyRep's behalf, ZyRep contractually requires it to follow documented instructions, use the information only for the contracted services, use appropriate safeguards, assist with privacy rights and deletion where required, and notify ZyRep of relevant security incidents. These detailed contractual requirements apply to processors acting for ZyRep. Anthropic's standard retention and the limits on individual API deletion are described in Sections 3 and 7. Independent payment platforms process information you provide directly to them under their own terms and privacy policies. User-directed public sharing and legally required disclosures are governed by Sections 4 and 5.
We do not disclose personal or consumer health information to data brokers or advertisers.
Analytics. Optional product analytics is off by default. If you opt in, you can turn it off in Settings. Turning analytics off stops future optional analytics collection but does not affect essential security, authentication, or service logs.
Marketing. Marketing email is off by default. You may opt in and later unsubscribe using the message link or Settings. Account, security, billing, and other requested service messages are not marketing.
Do Not Track and cross-service tracking. ZyRep does not use personal information to track you across unrelated websites or apps for targeted advertising and does not permit its service providers to do so for their own advertising. Browser Do Not Track signals therefore do not change how the Services operate. Your optional analytics choice is controlled in Settings.
ZyRep assembles prompts temporarily to send a workout, plan, or post-workout suggestion request to Anthropic; it does not save a separate copy of the assembled prompt in its application database. The underlying profile information, workout records, and generated outputs are retained as described below. Anthropic's retention of the API inputs and outputs it receives is described in Section 3.
ZyRep keeps account, profile, authentication, community, workout, generated output (including workouts and training plans), and related inference records while your account is active or until you delete the information. Within 30 days after you complete an available in-product deletion, initiate account deletion through your authenticated account, or ZyRep authenticates another deletion request, ZyRep deletes the covered information from active production systems or, where permitted, deidentifies it so that it can no longer reasonably be linked to you. A shorter period applies where required by law, and the limited exceptions below may apply. Consumer health data is deleted, rather than deidentified, where applicable law requires deletion and is also governed by the Consumer Health Data Privacy Policy.
ZyRep may retain limited purchase, entitlement, tax, accounting, consent, security, fraud prevention, moderation, support, dispute, and legal compliance records for as long as reasonably necessary for those purposes or as required by law. For consumer health data, the narrower retention exceptions in the Consumer Health Data Privacy Policy control. ZyRep notifies applicable processors and other recipients of covered deletion requests and takes the steps required by applicable law to secure deletion. Anthropic handles API deletion under the standard retention practices described in Section 3; ZyRep does not promise individual on-demand deletion of API submissions. Those practices do not replace any notice, assistance, or deletion obligation imposed by applicable law. Information in routine backups is deleted on the applicable backup cycle, subject to the state-specific limits below; if a backup is restored, deletion controls are reapplied.
Account deletion is available in the app under Settings. For other privacy requests or assistance with deletion, use the Privacy Request page or contact privacy@zyrep.app. Before you confirm account deletion, the app displays any remaining Purchased Credit balance.
Copies of public content outside ZyRep's control may remain as described in Section 4. Deleting a ZyRep account does not automatically cancel an Apple or Stripe subscription; you must cancel through the payment channel where you subscribed.
Subject to authentication of your identity and applicable exceptions, ZyRep offers the following choices to U.S. users:
Submit a request through Privacy Settings, our Privacy Request page (zyrep.com/privacy-request), or by email at privacy@zyrep.app. You may use any of these methods to submit an appeal.
We will promptly take reasonable steps to authenticate your request and may ask for information reasonably necessary to do so. Subject to authentication and applicable exceptions, we will respond without undue delay and no later than 45 days after receiving the request, unless a state-specific rule below provides otherwise. We may take a legally permitted extension after notifying you within the initial response period and explaining why. We will delete covered consumer health data and delete or deidentify other covered personal information unless an exception applies. To appeal, reply to the decision or use any request method listed above and identify the submission as a "Privacy Appeal." We will inform you in writing of the action taken or not taken, explain the reasons, and, if we deny the appeal, provide the method for contacting the applicable Attorney General, within the period required by applicable law. ZyRep will not discriminate against you for exercising a privacy right.
ZyRep uses reasonable administrative, technical, and physical safeguards designed to protect personal information during transmission and storage and to limit access according to role and need.
The Services are offered only to individuals located in the United States who are age 18 or older, as provided in the Terms of Service. ZyRep does not knowingly collect personal information from anyone under 18. A parent or guardian may report a suspected underage account using the contact below; after verification, we will delete or otherwise address it as appropriate.
We will post the revised Privacy Policy with a new effective date and version. Before a material change takes effect, we will notify users through a prominent in-app notice and may also use email. If a change introduces a new consumer health data category, purpose, or recipient, ZyRep will obtain fresh affirmative consent when required before the new processing begins.
Privacy questions, requests, and appeals: privacy@zyrep.app
The provisions below supplement the request, deletion, and appeal procedures in Sections 7 and 8. They apply when the identified state law covers the request. If a provision below conflicts with another timing statement in this Policy, the provision that gives you greater protection controls. ZyRep may respond or act sooner.
For a request covered by Connecticut law, ZyRep will respond without undue delay and no later than 45 days after receiving the request. ZyRep may extend that period once by up to 45 additional days when reasonably necessary. If ZyRep takes an extension, it will notify you within the first 45 days and explain the reason. If ZyRep declines to act, it will explain the reason and provide appeal instructions without undue delay and no later than 45 days after receiving the request. Within 60 days after receiving an appeal, ZyRep will inform you in writing of any action taken or not taken and explain the reasons for the decision. If ZyRep denies the appeal, it will provide a method for contacting the Connecticut Attorney General to submit a complaint. If you withdraw consent to processing covered by Connecticut law, the withdrawal method will be at least as easy as the method used to give consent, and ZyRep will stop the affected processing as soon as practicable and no later than 15 days after receiving the withdrawal.
For a request concerning consumer health data covered by Nevada law, ZyRep will respond without undue delay and no later than 45 days after authenticating the request. ZyRep may extend that period once by up to 45 additional days when reasonably necessary. If ZyRep takes an extension, it will notify you within the first 45 days after authentication and explain the reason. Subject to lawful exceptions, ZyRep will, within 30 days after authenticating a deletion request, delete the covered consumer health data from its active records and network and notify each affiliate, processor, contractor, or other third party with which ZyRep shared the data. Those recipients must delete the covered data within 30 days after receiving ZyRep's notice. Deletion from archived or backup systems may be delayed only as needed to restore those systems and for no longer than two years after authentication. You may appeal a refusal through any request method listed above; the appeal process will be conspicuously available and similar to the request process. Within 45 days after receiving an appeal, ZyRep will inform you in writing of any action taken or not taken and explain the reasons for the decision. If ZyRep denies the appeal, it will provide contact information for the Nevada Attorney General.
For an authenticated request covered by Virginia law, ZyRep will respond without undue delay and no later than 45 days after receiving the request. ZyRep may extend that period once by up to 45 additional days when reasonably necessary. If ZyRep takes an extension, it will notify you within the first 45 days and explain the reason. If ZyRep refuses to act, it will explain why and provide appeal instructions no later than 45 days after receiving the request. Within 60 days after receiving an appeal, ZyRep will inform you in writing of any action taken or not taken and explain the reasons for the decision. If ZyRep denies the appeal, it will provide a method for contacting the Virginia Attorney General to submit a complaint.
For a consumer health data request covered by Washington law, ZyRep will act without undue delay and within 45 days after receipt. Authentication does not pause or extend that period. ZyRep may extend once by up to 45 additional days when reasonably necessary if it notifies you within the initial period and explains why. Subject to lawful exceptions, ZyRep will delete the covered data from its records and network and notify the recipients with which it shared the data so they can delete it. Backup deletion may be delayed only as needed for restoration and no more than six months after authentication. Within 45 days after receiving an appeal, ZyRep will inform you in writing of any action taken or not taken and explain the reasons for the decision. If ZyRep denies the appeal, it will provide an available online mechanism or another method for submitting a complaint to the Washington Attorney General.