Privacy Policy

Effective: February 15, 2026

At REPS, we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, and share your personal information when you use our mobile application ("App"), our website at getreps.io ("Website"), and any related services (collectively, our "Platform").

REPS is operated by Michael Mc Graw ("REPS," "we," "us," or "our"). Please read the following carefully to understand our practices regarding your personal information. We also encourage you to review our Terms of Service.

1. Information We Collect

We collect personal information that you provide directly, that we receive from third-party sign-in providers, and that we collect automatically when you use our Platform.

(a) Information you provide to us

• Account information. When you create an account, we collect your name, email address, display name, and profile photo or avatar. If you sign in using Google or Apple, we receive your name and email address from those providers.
• Content you submit. When you share articles, URLs, or text with REPS for processing, we collect those URLs and any text you provide. We store the learning sets, concepts, and flashcards generated from your content.
• Learning activity. We collect information about your training sessions, including which questions you answered, whether your answers were correct, your mastery levels, streaks, and IQ points earned.
• Social information. If you use our social features, we collect your friend connections, activity shared with friends, and any sets you choose to make public or share.
• Communications. When you contact us for support or send us feedback, we collect your email address and the content of your message.

(b) Information we automatically collect

• Device and browser data. We collect your device type, operating system, app version, and a unique device identifier.
• Usage data. We collect information about how you interact with the App, including screens visited, features used, session duration, and performance data.
• Approximate location. We may infer your approximate location from your IP address for the purpose of analytics and compliance with applicable laws.

(c) Information we do not collect

• We do not collect precise geolocation data.
• We do not collect biometric data.
• We do not collect payment card information directly. If we offer paid features in the future, payment processing will be handled by Apple's App Store or a third-party payment processor, and we will not have access to your full payment card details.

2. How We Use Your Information

We use your personal information for the following purposes:

• To provide and operate the Platform, including generating AI-powered flashcards from your submitted content, delivering spaced repetition training, tracking your learning progress, and powering social features such as friend connections and activity feeds.
• To improve the Platform, including analysing usage patterns, fixing bugs, developing new features, and understanding how users engage with our content.
• To communicate with you, including sending service-related notifications, responding to support requests, and providing updates about the Platform.
• To ensure safety and security, including detecting and preventing fraud, abuse, or unauthorised access.
• To comply with legal obligations, including responding to lawful requests from public authorities.

We do not use your personal information for advertising or sell your data to advertisers.

3. How We Share Your Information

We may share your personal information with the following categories of third parties:

• Cloud infrastructure and database providers. We use Supabase (built on PostgreSQL) to store your account data, learning content, and activity. Supabase processes your data on our behalf in accordance with their privacy practices.
• Authentication providers. If you sign in with Google or Apple, those providers receive confirmation of your authentication. We encourage you to review Google's Privacy Policy and Apple's Privacy Policy.
• AI processing providers. We use Anthropic's Claude API to generate learning content (concepts and flashcards) from the articles and text you submit. The content you submit is sent to Anthropic for processing. We encourage you to review Anthropic's Privacy Policy.
• Content extraction providers. When you share a URL, we use third-party services (such as Firecrawl and Jina) to extract the text content of the article for processing. Only the URL is shared with these providers.
• Workflow automation. We use n8n to orchestrate our content processing pipeline. n8n processes data on our behalf as part of our backend infrastructure.
• Other users. If you make a set public, share a set with friends, or participate in social features like the activity feed or leaderboards, other users will see the information you choose to share, such as your display name, avatar, set titles, and learning milestones.
• Legal and safety purposes. We may disclose your information if required to do so by law, in response to a court order or subpoena, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers. If REPS is involved in a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

We do not sell your personal information to third parties, and we do not share your personal information with advertisers.

4. Data Security and Retention

We take the security of your personal information seriously. We use industry-standard security measures, including encryption in transit (HTTPS/TLS) and at rest, row-level security policies in our database, and secure authentication protocols.

No method of transmission over the Internet or electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee absolute security. If you suspect unauthorised use of your account, please contact us immediately.

Retention. We retain your personal information for as long as your account is active or as needed to provide you with our services. If you request deletion of your account, we will delete or anonymise your personal information within 30 days, unless we are required to retain it for legal or regulatory purposes. Learning activity data that has been aggregated and de-identified may be retained indefinitely for product improvement purposes.

Archived content. When you delete content within the App (such as sets or concepts), that content is archived (soft-deleted) rather than immediately and permanently erased. Archived content is no longer visible to you or other users and is excluded from your learning sessions. We retain archived content for a reasonable period to support features such as data recovery, abuse prevention, and legal compliance. Archived content may be permanently deleted after a retention period at our discretion. For permanent deletion of specific content, please contact us at privacy@getreps.io.

5. Your Privacy Rights

Regardless of where you reside, we provide you with the following rights regarding your personal information:

• Access. You have the right to request a copy of the personal information we hold about you.
• Correction. You have the right to request correction of inaccurate personal information.
• Deletion. You have the right to request deletion of your personal information and account.
• Data portability. You may request an export of your personal information in a machine-readable format.
• Non-discrimination. We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at privacy@getreps.io. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

Additional rights may apply depending on your jurisdiction. Please see our Supplemental Notices below.

6. Children's Privacy

REPS is intended for individuals who are at least 18 years old. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child under 13 has provided us with personal information, please contact us at privacy@getreps.io and we will take steps to delete that information.

7. AI and Content Processing

REPS uses artificial intelligence to generate learning content from articles and text you submit. Here is how that works:

• What is processed. When you share a URL or text with REPS, the extracted article content is sent to an AI model (Anthropic's Claude) to generate concepts and flashcards.
• How it is used. The AI-generated content is stored in your account and used solely to power your learning experience. We do not use your submitted content to train AI models.
• Third-party AI providers. Our AI processing is performed by Anthropic. Content you submit is sent to Anthropic's API for processing and is subject to Anthropic's usage policies. Anthropic does not use API inputs to train their models.

8. International Data Transfers

REPS is operated from the United Kingdom, and your personal information may be stored and processed in the United States or other countries where our service providers operate. If you are located outside these jurisdictions, your personal information will be transferred accordingly. By using the Platform, you consent to the transfer of your information to these jurisdictions, where data protection laws may differ from those in your home country.

For users in the European Economic Area (EEA) or the United Kingdom (UK), please see our supplemental notice below for information about the legal basis for processing and your additional rights.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, new features, or legal requirements. When we make significant changes, we will notify you through the App or by email. We encourage you to review this page periodically. Your continued use of the Platform after changes are posted constitutes your acceptance of the revised policy.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, you can reach us at:

Email: privacy@getreps.io

Website: getreps.io/support

11. Supplemental Notices

(a) For Users in the EEA and United Kingdom

Legal basis for processing. We process your personal information under the following legal bases as defined by the General Data Protection Regulation (GDPR) and UK GDPR:

• Contract performance — processing necessary to provide you with the Platform and services you requested (e.g., creating your account, generating learning content, tracking your progress).
• Legitimate interests — processing necessary for our legitimate business interests, including improving the Platform, ensuring security, and communicating with you, where those interests are not overridden by your rights.
• Consent — where you have given us explicit consent, such as for optional features or communications. You may withdraw your consent at any time.
• Legal obligation — processing necessary to comply with applicable law.

Your additional rights. In addition to the rights described in Section 5, EEA and UK residents have the right to:

• Object to processing based on legitimate interests.
• Restrict processing of your personal information in certain circumstances.
• Lodge a complaint with your local data protection authority. You can find your authority here (EEA) or at the ICO (UK).

(b) For California Residents

This section is provided in compliance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

Categories of personal information collected. In the preceding twelve months, we have collected the following categories of personal information: identifiers (name, email, device ID), internet or network activity (usage data, browsing history within the App), and inferences (learning preferences, mastery levels).

We do not sell your personal information. REPS does not sell personal information to third parties, as defined under the CCPA. We do not share your personal information for cross-context behavioural advertising.

Your California rights. California residents have the right to: know what personal information we collect, use, and disclose; request deletion of personal information; request correction of inaccurate personal information; and non-discrimination for exercising privacy rights.

To exercise these rights, please contact us at privacy@getreps.io.

(c) For Residents of Other US States

Residents of states with applicable privacy laws (including Virginia, Colorado, Connecticut, and others) may have additional rights similar to those described in Sections 5 and 11(b). To exercise any rights available to you under applicable law, please contact us at privacy@getreps.io.