Privacy Policy

Last updated: May 2026

1. Data Controller

The REPSLOT application is published by:

• AND JOY SAS, a French simplified joint-stock company
• Registered office: 173 rue de Courcelles, 75017 Paris, France
• SIREN: 104 968 102
• Contact: contact@repslot.com

And Joy SAS is the data controller for your personal data under the EU General Data Protection Regulation (GDPR).

2. Data We Collect

REPSLOT collects the following data to provide and improve its services:

• Account data: email address, password (hashed by Firebase Authentication), display name chosen by you.
• Usage data: workout statistics (exercises, reps, duration, XP earned), group memberships, contributions to team workouts.
• Technical data (Firebase Analytics): pseudonymous user identifier generated by Firebase, app version, operating system version, device model, language, usage events (app open, screen views, sessions), approximate country derived from IP address.
• Crash reports (Firebase Crashlytics): when a crash occurs, we collect the stack trace, device state (memory, battery), app and OS version. No directly identifying personal data is included.

3. Purposes and Legal Basis

Your data is processed for the following purposes:

• Service delivery (authentication, workout sync, groups) — legal basis: performance of the contract (GDPR art. 6.1.b).
• App improvement and stability (usage analytics, crash reports) — legal basis: legitimate interest (GDPR art. 6.1.f), proportionate and non-intrusive.
• Legal obligations (accounting, response to lawful requests) — legal basis: legal obligation (GDPR art. 6.1.c).

4. Data Retention

• Account and usage data: retained for as long as your account is active. Deleted within 30 days after account deletion.
• Technical data (Analytics): retained for a maximum of 14 months, per Firebase Analytics default settings.
• Crash reports: retained for 90 days.

5. Subprocessors and Hosting

Your data is hosted and processed by:

• Google Ireland Limited (Firebase / Google Cloud), acting as a subprocessor.
• Primary hosting in Belgium (region europe-west1). Occasional transfers to other Google Cloud regions may occur for backups and high availability, covered by the European Commission's Standard Contractual Clauses.
• Google's privacy policy: policies.google.com/privacy.

Your data is never sold, rented, or shared with third parties for commercial or advertising purposes.

6. Your Rights

Under the GDPR, you have the following rights over your data:

• Right of access: view the data we hold about you.
• Right to rectification: correct inaccurate data (your display name is editable from your profile).
• Right to erasure: delete your account and all associated data from app settings, or by email.
• Right to data portability: receive a copy of your data in a structured format.
• Right to object: object to processing based on legitimate interest (usage analytics).
• Right to restriction: request temporary suspension of processing.

To exercise a right, email dpo@repslot.com. We respond within one month at the latest.

You may also lodge a complaint with the CNIL, the French supervisory authority, or your local EU data protection authority.

7. Minors

REPSLOT is intended for users aged 16 or older. We do not knowingly collect data from anyone below that age. If you are a parent or guardian and believe your child has provided us with data, contact us for immediate deletion.

8. Security

We apply the technical and organizational measures recommended by Firebase and Google Cloud: TLS encryption in transit, encryption at rest, strict Firestore access rules, mandatory authentication, separation of development and production environments.

9. Changes

This policy may be updated to reflect changes to the service or regulations. Significant changes are announced in the application. The date at the top of this page indicates the most recent update.

10. Contact

For any question regarding this policy or your personal data: dpo@repslot.com.