ZEROSYNTAX (SMC-PRIVATE) LIMITED

HeyReps Privacy Policy

Effective date: 23 October 2026

The short version

• You can use HeyReps without an account. Your workout log, body measurements and progress are stored on your phone.
• If you sign in and choose to back up, your training records are stored in your own account on servers in the EU (Frankfurt, Germany). Turning backup off deletes that copy.
• Cycle, pregnancy, Ramadan and fasting settings, daily wellness checks, and anything read from Apple Health or Health Connect never leave your phone.
• We do not sell your data, we do not show ads, and we do not use your data for advertising or to train AI models.
• You can delete your account and its data in the app at any time: Settings → Account → Delete account.

1. Who we are

HeyReps (the "App") is published by ZEROSYNTAX (SMC-PRIVATE) LIMITED ("we", "us"), Wapda Town, Lahore, Punjab, Pakistan. We are the controller of the personal data described in this policy. For any privacy question or request, email info@zer0syntax.com.

2. Information we handle

2.1 Stored only on your phone

Unless you choose to back up (section 2.3), everything you enter stays in the App's storage on your device: your profile answers (goal, level, training days, equipment, focus areas, age, height, weight, limitations), workouts, sets, weights, personal records, plans you follow, custom workouts, pain flags, sleep and stress entries, and exercise likes.

The following always stay on your phone, even if you sign in and back up. Our servers have no place to store them:

• life stage, cycle settings, period log, pregnancy or postnatal weeks and clinician clearance;
• daily wellness checks (energy, symptoms, fasting);
• Ramadan and fasting settings;
• data read from Apple Health or Health Connect (section 2.4).

Uninstalling the App removes this data from your phone. We cannot recover it.

2.2 Account (optional for members)

Members can use the App without an account. Trainers and gym owners need one, because their profiles are published. You sign in with Sign in with Apple on iPhone or Google on Android. We receive a user ID, your email address (with Apple this may be a private relay address) and your name if the provider shares it. We never receive your Apple or Google password. Your sign-in session is kept in your phone's secure storage (iOS Keychain or Android Keystore).

2.3 Backup (only with your explicit consent)

After you sign in, the App asks whether to back up your progress, and nothing is chosen in advance. If you agree, we store a copy of the records listed in section 2.1 (except the always-on-phone items) in your account, so they survive a new phone. Some of these records concern your health, such as pain flags, limitations, weigh-ins and sleep and stress entries. We process them only because you gave this explicit consent. We record when you agreed and which wording you saw.

You can withdraw consent at any time by turning backup off. That deletes the server copy, and your phone keeps its own.

2.4 Apple Health and Health Connect

If you choose, the App can:

• write finished workouts (start, end, name, type) and weigh-ins you log to Apple Health or Health Connect on your device;
• read sleep, heart rate, resting heart rate, heart rate variability, steps, VO₂ max and weight to show your strain, recovery, sleep, stress and fitness-age scores. Separately, and only after you agree on the biological age card, it can read date of birth, biological sex and height to estimate your biological age and BMI.

Health data read this way is processed only on your phone. It is never uploaded to our servers, never included in backups, never shared with anyone, never used for advertising, and never sold. It is not stored in iCloud. Disconnecting in the App, or removing access in the Health app or Health Connect settings, deletes the copies the App kept.

The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. Information from Apple HealthKit is used only to provide the App's health and fitness features, as Apple's guidelines require.

2.5 Community: trainers, gyms and members

• Public profiles. If you create a trainer or gym profile, what you put on it is public to anyone using the App. That includes your name, photo, cover image, city, description, the plans you publish, and the contact links you choose to show (WhatsApp, phone, email, Instagram). Photos are picked with the system photo picker, and the App does not ask for access to your photo library. Before upload, the App re-encodes pictures and removes location and other embedded (EXIF) data.
• Follows, requests and memberships. We store who follows whom, client and member requests, and gym rosters so these features work.
• Plans from a trainer or gym. If you follow a plan a trainer or gym assigned you, they can see your progress on it (sessions done and when you last trained). They never see your sets, weights or other records.
• Gym Buddy. If you join a buddy team, your teammate sees your check-ins (which plan and session, the day, minutes trained, when you finished) and cheers.
• Reports and blocks. If you report a profile or plan, we store the reason and any note you add so we can review it. The person you report is never told who reported them. We also store the profiles you block.

Contact links open WhatsApp, your phone, email or Instagram outside the App. What happens there is covered by those services' own policies.

2.6 Purchases

Subscriptions are bought through the Apple App Store or Google Play. We never see your card details. We receive what you bought, when it started, when it renews or ends, and store transaction identifiers, through RevenueCat (section 4). If you are signed in, this is linked to your account so your subscription works on your other devices.

2.7 Technical data

When the App loads the exercise library, plays exercise videos, or talks to our servers, our hosting providers receive standard technical data: IP address, request time, app version and device type. It is used to deliver content, keep the service secure and fix faults.

2.8 What we do not collect

• No advertising identifiers, no advertising SDKs and no ads.
• No third-party analytics or tracking SDKs, and no tracking across other companies' apps or websites.
• No precise location, contacts, camera, microphone or photo-library access.
• No identity documents. If we ever introduce identity verification, we will update this policy first and ask only those who choose it.
• Music you pick to play during a workout is played from your phone and never uploaded.

3. How we use information

• To provide the App's features: workout plans, progress, backup, health scores, community features and subscriptions.
• To manage your account and keep your subscription active on your devices.
• To keep the community safe: reviewing reports, removing content that breaks our rules, and preventing abuse.
• To answer your support requests.
• To meet legal obligations, such as tax and accounting rules for purchases.

We do not use your data for advertising, profiling for marketing, or training AI models.

4. Who we share data with

We share data only with service providers that process it on our behalf, under contracts that limit them to providing their service:

Other users see only what section 2.5 describes. We may disclose data if the law requires it, to protect the safety of a person, or as part of a merger or sale of the business, in which case this policy continues to protect your data. We do not sell or rent personal data, and we do not "share" it for cross-context behavioural advertising.

5. International transfers

Your account and backup are stored in the European Union. Some providers (RevenueCat, Resend, Apple, Google, Cloudflare) may process data in the United States or other countries. Where data leaves the EU, EEA or UK, we rely on the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, or another lawful safeguard.

6. How long we keep data

7. Deleting your account and data

• In the App: Settings → Account → Delete account. This deletes your account, your backup, your trainer or gym profile with its photos and plans, your follows, memberships, requests, blocks, Gym Buddy data and invite codes. If you used Sign in with Apple, we also revoke the App's access to your Apple ID.
• Without the App: follow the steps on our account deletion page, or email info@zer0syntax.com from the email address on your account. We reply within 30 days.
• Only the backup: turn backup off in Settings. That deletes the server copy and keeps your account.

Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play account settings (see our Terms of Use).

8. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive a portable copy, and withdraw consent at any time without affecting earlier processing. To use any of these rights, email us. We will answer within 30 days and may need to confirm the request comes from the account holder. You can also complain to your local data protection authority.

California residents: we do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. You have the rights to know, delete and correct, and we will not treat you differently for using them.

9. Legal bases (EU, EEA and UK)

• Contract: to provide the App, your account, community features and subscriptions.
• Explicit consent: for backing up health-related records and for reading or writing Apple Health or Health Connect data. You can withdraw it in the App.
• Legitimate interests: to keep the service secure, prevent abuse and moderate community content.
• Legal obligation: for purchase records and lawful requests.

10. Children

HeyReps is not directed to children under 13, and we do not knowingly collect data from them. Users under 18, or under the age of digital consent where they live, should use the App only with a parent's or guardian's permission. Trainer and gym accounts and purchases are for adults. If you believe a child has given us personal data, email us and we will delete it.

11. Security

Data is encrypted in transit (HTTPS). Every user's records on our servers are protected by access rules so that only that user can read them. Sign-in sessions are kept in the iOS Keychain or Android Keystore, and private files are stored in buckets that are not public. No system is perfectly secure, but we limit what we collect so there is less to protect.

12. Health information is not medical advice

The App's scores and estimates, such as recovery, stress and biological age, are for general fitness information only. They are not a diagnosis or medical advice. See our Terms of Use.

13. Changes to this policy

If we change this policy, we will update the effective date above. If the change is significant, we will tell you in the App before it applies. Where the law requires it, we will ask for your consent again.

14. Contact

ZEROSYNTAX (SMC-PRIVATE) LIMITED
Wapda Town, Lahore, Punjab, Pakistan
info@zer0syntax.com