Privacy Policy

Effective: June 17, 2026

At REPS, we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, and share your personal information when you use our mobile application ("App"), our website at getreps.io ("Website"), and any related services (collectively, our "Platform").

REPS is operated by REPS AI LTD, a company registered in England and Wales (company number 17271160) with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, trading as REPS ("REPS," "we," "us," or "our"). REPS AI LTD is the data controller responsible for your personal information. Please read the following carefully to understand our practices regarding your personal information. We also encourage you to review our Terms of Service.

1. Information We Collect

We collect personal information that you provide directly, that we receive from third-party sign-in providers, and that we collect automatically when you use our Platform.

(a) Information you provide to us

• Account information. When you create an account, we collect your name, email address, display name, and profile photo or avatar. If you sign in using Google or Apple, we receive your name and email address from those providers.
• Content you submit. When you share articles, URLs, or text with REPS for processing, we collect those URLs and any text you provide. We store the learning sets, concepts, and flashcards generated from your content. You can also add knowledge by uploading a screenshot, photographing a page or your bookshelf, or importing a PDF or document. In those cases the image or file is uploaded to our servers and sent to our AI provider to extract its content for your learning sets. One exception is book-page highlighting, where the text is recognised on your device and the photo itself is not uploaded.
• Learning activity. We collect information about your training sessions, including which questions you answered, whether your answers were correct, your mastery levels, streaks, and IQ points earned.
• Voice training. If you use voice training, your microphone audio is streamed in real time to our voice AI provider so Echo can converse with you and assess your answers. We store a text transcript of your responses to power grading and your learning history. We do not keep the audio recording.
• Social information. If you use our social features, we collect your friend connections, activity shared with friends, and any sets you choose to make public or share. To help you find friends already on REPS, we can match your device contacts: the email addresses and phone numbers in your address book are hashed on your device, and only the resulting one-way hashes are sent to us for matching. Your raw contact details are never uploaded.
• Communications. When you contact us for support or send us feedback, we collect your email address and the content of your message.

(b) Information we automatically collect

• Device and browser data. We collect your device type, operating system, app version, and a unique device identifier.
• Usage data. We collect information about how you interact with the App, including screens visited, features used, session duration, and performance data.
• Approximate location. We may infer your approximate location from your IP address for the purpose of analytics and compliance with applicable laws.
• Analytics and session activity. We use analytics and session-replay tools to understand how the App is used, diagnose crashes, and improve the experience. This includes recordings of in-app screen interactions, captured in a privacy-preserving form designed to mask personal content.
• Advertising attribution. We work with a mobile measurement partner to understand which of our own marketing campaigns led you to install REPS. On iOS, we ask for your permission through Apple's App Tracking Transparency prompt before any measurement that involves tracking, and you can change your choice at any time in your device settings.

(c) Information we do not collect

• We do not collect precise geolocation data.
• We do not collect biometric data.
• We do not collect payment card information directly. If we offer paid features in the future, payment processing will be handled by Apple's App Store or a third-party payment processor, and we will not have access to your full payment card details.

2. How We Use Your Information

We use your personal information for the following purposes:

• To provide and operate the Platform, including generating AI-powered flashcards from your submitted content, delivering spaced repetition training, tracking your learning progress, and powering social features such as friend connections and activity feeds.
• To improve the Platform, including analysing usage patterns, fixing bugs, developing new features, and understanding how users engage with our content.
• To communicate with you, including sending service-related notifications, responding to support requests, and providing updates about the Platform.
• To ensure safety and security, including detecting and preventing fraud, abuse, or unauthorised access.
• To comply with legal obligations, including responding to lawful requests from public authorities.

We do not sell your personal information, and we do not use it to target you with third-party behavioural advertising. We do measure the effectiveness of our own marketing campaigns through an attribution provider, so we can understand which campaigns bring people who love the App. On iOS, this measurement is subject to your App Tracking Transparency choice.

3. How We Share Your Information

We may share your personal information with the following categories of third parties:

• Cloud infrastructure and database providers. We use Supabase (built on PostgreSQL) to store your account data, learning content, and activity. Supabase processes your data on our behalf in accordance with their privacy practices.
• Authentication providers. If you sign in with Google or Apple, those providers receive confirmation of your authentication. We encourage you to review Google's Privacy Policy and Apple's Privacy Policy.
• AI processing providers. We use Anthropic's Claude API to generate learning content (concepts and flashcards) from the articles and text you submit. The content you submit is sent to Anthropic for processing. We encourage you to review Anthropic's Privacy Policy.
• Content extraction providers. When you share a URL, we use third-party services (such as Firecrawl and Jina) to extract the text content of the article for processing. Only the URL is shared with these providers.
• Workflow automation. We use Trigger.dev to orchestrate our content processing pipeline. It processes data on our behalf as part of our backend infrastructure.
• Analytics providers. We use PostHog to collect product-usage events and diagnostics, which helps us understand engagement and fix problems. This usage data is associated with your account.
• Session replay. We use UXCam to record privacy-preserving replays of in-app sessions (screen layouts and interactions) so we can improve usability. UXCam's technology is designed to mask personal content and does not use advertising identifiers.
• Advertising attribution. We use AppsFlyer to attribute app installs to our own marketing campaigns. AppsFlyer may receive a device identifier and your user identifier for measurement purposes. On iOS, this is gated by App Tracking Transparency.
• Voice AI providers. When you use voice training, your audio is streamed to ElevenLabs, over LiveKit's real-time infrastructure, to power the conversation. Audio is processed in real time and is not stored by us as a recording.
• Other users. If you make a set public, share a set with friends, or participate in social features like the activity feed or leaderboards, other users will see the information you choose to share, such as your display name, avatar, set titles, and learning milestones.
• Legal and safety purposes. We may disclose your information if required to do so by law, in response to a court order or subpoena, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers. If REPS is involved in a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

We do not sell your personal information to third parties, and we do not share it with advertisers to target you. Our use of an attribution provider is limited to measuring the performance of our own marketing.

4. Data Security and Retention

We take the security of your personal information seriously. We use industry-standard security measures, including encryption in transit (HTTPS/TLS) and at rest, row-level security policies in our database, and secure authentication protocols.

No method of transmission over the Internet or electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee absolute security. If you suspect unauthorised use of your account, please contact us immediately.

Retention. We retain your personal information for as long as your account is active or as needed to provide you with our services. If you request deletion of your account, we will delete or anonymise your personal information within 30 days, unless we are required to retain it for legal or regulatory purposes. Learning activity data that has been aggregated and de-identified may be retained indefinitely for product improvement purposes.

Archived content. When you delete content within the App (such as sets or concepts), that content is archived (soft-deleted) rather than immediately and permanently erased. Archived content is no longer visible to you or other users and is excluded from your learning sessions. We retain archived content for a reasonable period to support features such as data recovery, abuse prevention, and legal compliance. Archived content may be permanently deleted after a retention period at our discretion. For permanent deletion of specific content, please contact us at privacy@getreps.io.

5. Your Privacy Rights

Regardless of where you reside, we provide you with the following rights regarding your personal information:

• Access. You have the right to request a copy of the personal information we hold about you.
• Correction. You have the right to request correction of inaccurate personal information.
• Deletion. You have the right to request deletion of your personal information and account.
• Data portability. You may request an export of your personal information in a machine-readable format.
• Non-discrimination. We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at privacy@getreps.io. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

Additional rights may apply depending on your jurisdiction. Please see our Supplemental Notices below.

6. Children's Privacy

REPS is intended for individuals who are at least 18 years old. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child under 13 has provided us with personal information, please contact us at privacy@getreps.io and we will take steps to delete that information.

7. AI and Content Processing

REPS uses artificial intelligence to generate learning content from articles and text you submit. Here is how that works:

• What is processed. When you share a URL or text with REPS, the extracted article content is sent to an AI model (Anthropic's Claude) to generate concepts and flashcards. Screenshots, photos, and documents you upload are also sent to Anthropic's Claude, including its image (vision) capability, so we can extract their content.
• How it is used. The AI-generated content is stored in your account and used solely to power your learning experience. We do not use your submitted content to train AI models.
• Third-party AI providers. Our AI processing is performed by Anthropic. Content you submit is sent to Anthropic's API for processing and is subject to Anthropic's usage policies. Anthropic does not use API inputs to train their models.

8. International Data Transfers

REPS is operated from the United Kingdom, and your personal information may be stored and processed in the United States or other countries where our service providers operate. If you are located outside these jurisdictions, your personal information will be transferred accordingly. By using the Platform, you consent to the transfer of your information to these jurisdictions, where data protection laws may differ from those in your home country.

For users in the European Economic Area (EEA) or the United Kingdom (UK), please see our supplemental notice below for information about the legal basis for processing and your additional rights.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, new features, or legal requirements. When we make significant changes, we will notify you through the App or by email. We encourage you to review this page periodically. Your continued use of the Platform after changes are posted constitutes your acceptance of the revised policy.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, you can reach us at:

Data controller: REPS AI LTD (company no. 17271160), registered in England and Wales, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Email: privacy@getreps.io

Website: getreps.io/support

11. Supplemental Notices

(a) For Users in the EEA and United Kingdom

Legal basis for processing. We process your personal information under the following legal bases as defined by the General Data Protection Regulation (GDPR) and UK GDPR:

• Contract performance — processing necessary to provide you with the Platform and services you requested (e.g., creating your account, generating learning content, tracking your progress).
• Legitimate interests — processing necessary for our legitimate business interests, including improving the Platform, ensuring security, and communicating with you, where those interests are not overridden by your rights.
• Consent — where you have given us explicit consent, such as for optional features or communications. You may withdraw your consent at any time.
• Legal obligation — processing necessary to comply with applicable law.

Your additional rights. In addition to the rights described in Section 5, EEA and UK residents have the right to:

• Object to processing based on legitimate interests.
• Restrict processing of your personal information in certain circumstances.
• Lodge a complaint with your local data protection authority. You can find your authority here (EEA) or at the ICO (UK).

(b) For California Residents

This section is provided in compliance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

Categories of personal information collected. In the preceding twelve months, we have collected the following categories of personal information: identifiers (name, email, device ID), internet or network activity (usage data, browsing history within the App), and inferences (learning preferences, mastery levels).

We do not sell your personal information. REPS does not sell personal information to third parties, as defined under the CCPA. We do not share your personal information for cross-context behavioural advertising. We use a mobile measurement partner solely to attribute app installs to our own marketing campaigns. This is advertising measurement, not cross-context behavioural advertising, and on iOS you can opt out through Apple's App Tracking Transparency setting.

Your California rights. California residents have the right to: know what personal information we collect, use, and disclose; request deletion of personal information; request correction of inaccurate personal information; and non-discrimination for exercising privacy rights.

To exercise these rights, please contact us at privacy@getreps.io.

(c) For Residents of Other US States

Residents of states with applicable privacy laws (including Virginia, Colorado, Connecticut, and others) may have additional rights similar to those described in Sections 5 and 11(b). To exercise any rights available to you under applicable law, please contact us at privacy@getreps.io.