Privacy Policy

1. Data Controller

Name: Moritz Losert

Address: Eichendorffweg 1, 73760 Ostfildern, Germany

Email: contact@nextrep.de

2. Personal Data We Collect

We collect and process the following personal data when you use our website and the NextRep app for iOS or Android:

2.1 Account Data

Email address, username, name (optional), hashed password, profile picture (optional). Your profile picture is stored privately and shown only to you; the app loads it via time-limited links (valid for at most one hour). Profile pictures uploaded with older app versions remain, until they are migrated, at an unpublished address that anyone with the link can open. If you sign in with Apple or Google, we additionally receive the data described in section 5.

2.2 Fitness and Health Data

  • Workout data (type, duration, intensity, movement routes)
  • Weight and body measurements – entered by you or imported from Apple Health or Health Connect
  • Food diary and food item scans
  • Dietary supplements
  • Step count and activity data
  • Location data (for running features and route tracking)

2.3 Apple Health (iOS) and Health Connect (Android)

Apple Health (iOS)

With your consent, NextRep on iPhone reads steps, weight, workouts, distance, active calories, heart rate and workout routes from Apple Health and writes weight, workouts, distance, active calories and workout routes to it – so runs you record in NextRep are saved to Apple Health including their route. Weight values and runs (including route and heart rate) imported from Apple Health are stored in your NextRep account like entries you make yourself (Supabase, EU) and synced between your devices. Steps from Apple Health are only used for display and the step reminder; they are not stored in your account. Data from Apple Health is not used for advertising and not sold. The legal basis is your consent (Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR).

Health Connect (Android)

On Android, NextRep can exchange data with Health Connect with your explicit permission. You choose in Health Connect which data types you allow:

  • Steps (read): showing your steps (home, steps detail screen, calendar, widget, recap) and checking your daily goal for the step reminder.
  • Weight (read and write): importing measurements from other apps (e.g. smart scales) and saving the weight you log in NextRep.
  • Workouts (read and write): saving completed workouts as exercise sessions; reading prevents duplicates.
  • Runs incl. distance and GPS route (read and write): saving your runs and importing runs from other apps.
  • Active calories (write): saving the estimated calories burned on runs you record or log in NextRep; imported runs are never written back.
  • Heart rate (read and write): average and maximum heart rate of imported runs (stored with the run in your account), and showing the heart rate curve in the run details if the run has none of its own (the curve is only displayed, not stored); saving the heart rate curve of runs you record live in NextRep if heart rate was measured (e.g. with a connected heart rate sensor). Imported runs are never written back.
  • History (read, older than 30 days before first permission): requested only on the steps detail screen (month, 6 months, year) when you tap "Allow step history" there. After that, the calendar, your recap (Wrapped) and the manual import can also show older entries of the data types you allowed.
  • Background reading: only for the optional smart step reminder, if you turn it on.

Values imported from Health Connect are stored in your NextRep account like entries you make yourself (Supabase, EU) and synced between your devices. Data from Health Connect is not sold, not used for advertising and not shared with third parties. Our use complies with Google's Health Connect policies, including the Limited Use requirements. You can revoke permission at any time in Health Connect or in NextRep under Profile → Health Connect; imported entries can be deleted in the app. The legal basis is your consent (Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR).

Heart rate sensor (Android)

If you connect a Bluetooth heart rate sensor (e.g. a chest strap or watch) in the run setup, NextRep reads its heart rate only during a run you start. Android asks for the "Nearby devices" permission for this (up to Android 11: the location permission that NextRep uses for runs anyway); NextRep does not derive your location from the Bluetooth scan. Average, maximum and the curve (one value every 5 seconds) are stored with the run in your NextRep account (Supabase, EU) and synced between your devices; if you allow it in Health Connect, the curve is also saved there. The sensor's Bluetooth address stays on your device. You can remove the sensor at any time and delete runs in the app. The legal basis is your consent (Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR).

Note for both platforms: for the AI training plan we send the current body weight from your profile (see 2.4). If that value comes from Apple Health or Health Connect, it is sent in this context as well.

2.4 AI-Powered Features

When you use AI features (food scan by photo, logging meals as free text, importing a training plan from an image, personalized AI training plan), the data needed for this is sent via our server to OpenAI (USA): for a food photo, the photo and any note you add; for text logging, your text; for image import, the photo or screenshot of your plan; for the AI training plan, gender, height, weight, goal weight and your questionnaire answers (goal, experience, training days, duration, equipment, split, notes). For image import and the training plan we also send the names and muscle groups of the exercises in your library, including your own. Your name, email address and account ID are not sent to OpenAI. Photos are sent only for analysis; we do not store them. Under OpenAI's API terms, the data is not used to train AI models and is kept for at most 30 days for abuse monitoring. For barcodes, the Android app uses Google ML Kit on the device; the camera image does not leave the device, and according to Google only technical usage and performance data is sent to Google.

Before you use an AI feature for the first time, the app asks for your explicit consent and shows which data is sent to whom. Without consent, nothing is sent to OpenAI. We store the time of your consent on the device and in your account so that you are not asked again on your other devices. You can withdraw consent at any time in the app under Profile → Privacy → "AI features (OpenAI)"; the app will then ask again before the next use. The legal basis is your consent (Art. 6(1)(a) GDPR, for health details such as weight in conjunction with Art. 9(2)(a) GDPR).

To apply usage limits for AI features, we count per account how often you have used each feature (daily counters are deleted after 14 days; the total counter for the free allowance is kept until you delete your account). If you report an incorrect result, we store the recognised foods with their nutritional values and your reason – without the photo. Counters and reports are deleted together with your account.

2.5 Device Information

Operating system and version, app version, device model and a random installation ID. We do not use an advertising ID.

2.6 Usage Statistics and Crash Reports

To improve NextRep, we record which features are used (e.g. "workout completed", "meal added via scan", "purchase completed") together with the app version, platform (iOS/Android), a random installation ID and a session ID. Some events contain additional details, such as distance and duration of a completed run, duration and number of sets of a workout, or the goal chosen during onboarding (lose weight, maintain weight or build muscle), so we can see which suggestion helps after setup; free text, body measurements and nutritional values are not recorded. Once you are signed in, events are linked to your account. If the app crashes or stops responding, a technical crash report is sent (device model, operating system version, app version, cause of the error and technical trace); on iPhone, iOS provides this report (MetricKit). Data is only sent from versions installed via the App Store, TestFlight or Google Play. We store this data only in our own database (Supabase, EU); it is not shared with analytics or advertising services and is not used to track you across apps. We do not use an advertising ID and therefore do not ask for tracking permission. The legal basis is our legitimate interest in a stable and improving app (Art. 6(1)(f) GDPR).

You can object at any time: in the app (iOS and Android) under Profile → Privacy, turn off "Share usage data & crash reports". The setting applies to that device and is on by default. Turning it off deletes the installation ID; signing out creates a new one.

2.7 Android Waitlist (Website)

Purpose: If you join the waitlist at nextrep.de/android, we use your email address solely to notify you as soon as NextRep is available on Android – including an invitation to the test phase (beta) on Google Play.

Data: Email address and time of sign-up.

Legal basis: Art. 6(1)(a) GDPR (consent), which you give by submitting the form.

Storage: The data is stored with Supabase (EU data centers), our data processor under GDPR Art. 28 (see section 4).

Deletion: We delete your sign-up once NextRep is available on the Google Play Store and we have notified you, or earlier at any time at your request.

Abuse prevention: To prevent automated mass sign-ups, we limit the number of sign-ups per IP address. We do not store the IP address itself, only a hash created with a secret key (pseudonymised; for IPv6 from the first 64 bits of the address), kept separately from your sign-up and deleted after at most 25 hours. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working form free of abuse).

Withdrawal: You can withdraw your consent at any time without giving reasons – via the unsubscribe link in our email or by writing to contact@nextrep.de. This does not affect the lawfulness of processing carried out before the withdrawal.

2.8 Athlete Application (Website)

Purpose: If you apply as an athlete on nextrep.de, we use your details to review your application and to contact you about a possible collaboration.

Data: Name, email address, Instagram and/or TikTok handle (at least one), number of followers and your message.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request).

Storage: The data is stored with Supabase (EU data centers), our data processor under GDPR Art. 28 (see section 4).

Deletion: If no collaboration results, we delete your application no later than six months after our decision, or earlier at your request (email contact@nextrep.de).

Abuse prevention: To prevent automated mass applications, we limit the number of applications per IP address. We do not store the IP address itself, only a hash created with a secret key (pseudonymised; for IPv6 from the first 64 bits of the address), kept separately from your application and deleted after at most 25 hours. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working form free of abuse).

2.9 Hosting and Server Log Files (Website)

Purpose: Our website nextrep.de is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you open a page, the host processes technically necessary data in so-called server log files so that the page can be delivered and the website runs securely and reliably (e.g. to detect and fend off attacks).

Data: IP address, date and time of the request, page or file requested, referrer (the previously visited page), browser and operating system.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free operation of the website.

Storage: STRATO processes the data on our behalf as a data processor under GDPR Art. 28. Whatever you enter in the forms for the Android waitlist or the athlete application is sent directly to Supabase (see 2.7 and 2.8).

Deletion: The host automatically deletes or anonymizes the server log files after a short time, as soon as they are no longer needed for secure operation; the exact periods are set out in the host's data processing agreement. We do not analyze the log files or combine them with other data.

2.10 YouTube Video on the Homepage (Only After a Click)

Purpose: On our homepage we show a video hosted on YouTube. Until you tap “Play video”, you only see a preview image served from our own server – no connection to YouTube is made. Only when you start the video does your browser load the YouTube player in privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data: After the click: IP address, date and time, the video requested, the page it is embedded on, and browser and device information. YouTube sets or reads cookies or similar storage technologies on your device and may analyze playback, e.g. for statistics and abuse prevention.

Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent). You give it by tapping “Play video” after the notice shown with the video. Without this click, no data is sent to YouTube.

Third country: Google may also transfer the data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (see Section 12). Google is responsible for any further processing by YouTube; details: https://policies.google.com/privacy

Withdrawal: Your consent only applies to the current page view – on your next visit you will again only see the preview image. You can delete cookies set by YouTube in your browser at any time.

3. Legal Basis for Data Processing

Art. 6(1)(b) GDPR (Contract Performance): Data processing to provide and manage your user account, to operate app functionality, to handle your subscription and – as a pre-contractual measure – to process athlete applications.

Art. 6(1)(a) GDPR (Consent): For Apple Health and Health Connect, location access, AI features (OpenAI), the Strava connection, joining the Android waitlist and playing the YouTube video on the homepage (see 2.10), we require your explicit consent. You can withdraw it at any time in the app (for AI features under Profile → Privacy) or in your device's system settings or – for the waitlist – by emailing contact@nextrep.de; for the YouTube video it only applies to the current page view.

Art. 6(1)(f) GDPR (Legitimate Interests): Security measures and fraud prevention, usage statistics and crash reports (see 2.6, objection via the switch in the app), the map display in the run details of the Android app (see section 5) and the secure operation of the website (server log files, see 2.9).

4. Data Storage and Infrastructure

Local Storage: Most of your data is initially stored locally on your iPhone or Android device. Local data on the device is deleted when you sign out.

Supabase: Your account data, fitness data, and synchronization data are stored on Supabase servers (EU data centers). Supabase is a data processor under GDPR Art. 28.

Backup on Android: The Android backup (Google backup or device transfer) contains only the app's display settings (accent colour, light/dark mode, sound and voice prompts). Health, workout and account data as well as your sign-in are excluded from the backup; after reinstalling, they are loaded from your account once you sign in.

Encryption: All data transmissions are encrypted via TLS 1.2+.

5. Data Sharing with Third Parties

OpenAI: When you use AI features (see 2.4), the data needed for this is sent – after your consent – via our server to the OpenAI API (OpenAI, L.L.C., USA). OpenAI processes this data as a data processor to provide the service, does not use it to train its own models and keeps it for at most 30 days for abuse monitoring (see OpenAI API Data Usage Policies).

Apple Services (iOS): When you use 'Sign in with Apple', we receive either an anonymized or your real email address from Apple (depending on your choice). If you delete your account, we revoke Sign in with Apple. The app's reminders are local notifications scheduled by your device; we do not send push messages from a server. Maps on iPhone use Apple Maps. In-app purchases and subscriptions on iPhone are processed by Apple — your payment data never reaches us. Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Legal basis: Art. 6(1)(b) GDPR (contract performance). Privacy Policy: https://www.apple.com/legal/privacy/

Google Services (Android): If you sign up or sign in with "Sign in with Google", Google provides us with your name, email address and a Google user ID. We use this data only to sign you in and manage your account. Sign-in is handled by the Android Credential Manager and Google Play services on your device. The Android app is distributed through Google Play; subscriptions on Android are processed through Google Play Billing — your payment data never reaches us. Google processes data under its own privacy policy. Legal basis: Art. 6(1)(b) GDPR (contract performance). Privacy Policy: https://policies.google.com/privacy

RevenueCat: We use RevenueCat (RevenueCat, Inc., 1 Letterman Drive, Suite C3-700, San Francisco, CA 94129, USA) as a data processor to manage in-app subscriptions. Payments themselves are processed by Apple (App Store) or Google (Google Play Billing); we do not receive payment details such as credit card numbers. Once you are signed in, the app links your purchases to the identifier of your NextRep account (a random ID without name or email address), so that Premium is unlocked across your devices and platforms. RevenueCat receives this identifier, information about purchases and subscription status, and technical device data. If you redeem an athlete code, that code is also sent to RevenueCat. When you delete your NextRep account, we also delete your customer data at RevenueCat (account identifier and purchase history). Legal basis: Art. 6(1)(b) GDPR (contract performance). RevenueCat Privacy Policy: https://www.revenuecat.com/privacy/

Mailgun: We send confirmation and account emails (e.g. confirming your email address, resetting your password, changing your email address) via Mailgun (Mailgun Technologies, Inc., USA) as a data processor, using its EU servers. This transmits your email address and the content of the email (confirmation link or code). Legal basis: Art. 6(1)(b) GDPR (contract performance).

OpenFoodFacts: When you scan food barcodes in the iOS app, the scanned barcode is transmitted to the OpenFoodFacts API (https://world.openfoodfacts.org) to retrieve product information. No personal data is transmitted. OpenFoodFacts is a non-profit project based in France. The Android app looks up product data in our own database. Legal basis: Art. 6(1)(b) GDPR (contract performance).

Strava: On iPhone and Android, you can optionally connect NextRep to your Strava account (Strava Inc., USA). You sign in on Strava's page; our server exchanges the sign-in code. For this we briefly store a check value that links the sign-in to your account; the Strava access tokens themselves are stored only on your device (in the Keychain on iPhone, encrypted on Android). Once connected, NextRep imports your run activities (date, duration, distance, route and heart rate if available) into your account. A run recorded in NextRep is only uploaded when you explicitly upload it to Strava. When you disconnect, sign out or delete your account, the app revokes access at Strava and deletes the access tokens on the device. The revocation is triggered by your device; if it fails (e.g. without an internet connection), you can also remove NextRep directly in your Strava settings at any time. Legal basis: Art. 6(1)(a) and (b) GDPR. Strava Privacy Policy: https://www.strava.com/legal/privacy

Map Display (OpenFreeMap / OpenStreetMap, Android): When you open a run with a recorded route in the Android app, the app loads the map tiles around that route directly from the map service OpenFreeMap (https://openfreemap.org; server tiles.openfreemap.org), not via our server. For technical reasons this transmits your IP address, the app identifier (app name, app version, Android version) and the requested map tiles (tile coordinates). The tiles reveal the approximate area of the route; the route itself, times, your account or other run data are not transmitted. No cookies are set and no identifiers are used to recognise you. Loaded map tiles are cached on your device (at most 20 MB) and deleted when you sign out or delete your account. Without an internet connection, the app shows the route without a map. Map data comes from OpenStreetMap (© OpenStreetMap contributors, Open Database License). The legal basis is our legitimate interest in showing your route in an understandable way (Art. 6(1)(f) GDPR).

Authorities: We share data only if legally required to do so.

6. Health Data and Location Access

For full functionality, we need your consent for:

  • Apple Health (iOS): reading steps, weight, workouts, distance, active calories, heart rate and workout routes; writing weight, workouts, distance and active calories (see 2.3)
  • Health Connect (Android): the data types listed in section 2.3, each of which you can allow individually
  • Location Access: Approximate or precise location for running features and route recording
  • Nearby devices (Android): only to connect a Bluetooth heart rate sensor for runs, without using your location (see 2.3)

On Android, NextRep uses your location only during a run that you start yourself. To keep recording while the screen is off, the app uses a foreground service, during which a persistent notification is shown. Location access ends when you finish or cancel the run; there is no background location access without a visible notification. The route is stored with the run in your account.

You can change or revoke these permissions at any time – on iPhone in Settings under "Privacy & Security", on Android in the app permissions (Settings → Apps → NextRep → Permissions) and in Health Connect.

7. Data Retention Period

User Account: Data is stored as long as your account exists. You can delete your account in the app or at nextrep.de/delete-account. Deletion happens immediately via our server; residual copies in our provider's backups are deleted within 30 days at the latest.

Fitness Data: Stored as long as your account exists. You can delete individual entries in the app at any time.

Usage Statistics and Crash Reports: Events and crash reports are stored for 90 days, then automatically deleted. When you delete your account, entries linked to it are deleted immediately.

Payment Data: Apple or Google store payment data and receipts according to their own policies. Your customer data at RevenueCat (account identifier and purchase history) is deleted when you delete your account. Commissions for athlete codes are kept pseudonymously (without reference to your account) as accounting records.

Subscription and Account Deletion: An active subscription does not end automatically when you delete your NextRep account. Please cancel it yourself – on iPhone in your Apple ID's subscription settings, on Android in Google Play under "Subscriptions".

8. Your Rights

You have the right to:

  • Access: Obtain information about what data we store about you
  • Rectification: Correction of incorrect data
  • Deletion: Deletion of your data ("right to be forgotten") – How to delete your account
  • Data Portability: Receive your data in structured format
  • Objection: Object to processing under certain conditions – e.g. to usage statistics directly via the switch in the app
  • Withdraw Consent: Withdraw consent at any time without giving a reason

To exercise these rights, contact us at contact@nextrep.de. We will respond within 30 days.

9. Data Security

We implement technical and organizational measures to protect your data:

  • TLS encryption for all data transmissions
  • Secure password hashing (bcrypt)
  • Regular security audits
  • Minimal data collection (Privacy by Design)
  • Access controls and authentication

10. External Services and Links

This privacy policy applies only to NextRep. If you follow links to external websites (e.g., OpenAI, Apple, Google, Strava, Supabase), their own privacy policies apply. We are not responsible for their data practices.

11. Changes to This Privacy Policy

We reserve the right to update this privacy policy at any time. Material changes will be communicated to you via email or in-app notification. Your continued use of the app after changes means you accept the new policies.

12. Data Transfer to Third Countries

Some of the services we use (RevenueCat, OpenAI, Mailgun and – if you connect it – Strava and – if you play the video on the homepage – Google/YouTube) are US companies or process data in the USA. Under data protection law, the USA is considered a third country without consistently adequate data protection. Transfers are based on:

  • EU Standard Contractual Clauses (SCCs) per Art. 46(2)(c) GDPR, where no adequacy decision exists, or
  • certification of the respective provider under the EU-US Data Privacy Framework, where applicable.

Please note: US authorities may, under certain conditions, access data stored with US providers.

13. Right to Lodge a Complaint

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Königstraße 10a, 70173 Stuttgart, Germany

https://www.baden-wuerttemberg.datenschutz.de

14. Automated Decision-Making

No automated decision-making within the meaning of Art. 22 GDPR with legal effect or similarly significant impact on you takes place. Our AI-powered features (food recognition, training suggestions) serve solely as non-binding assistance and do not replace medical or nutritional advice.

15. Data Protection Officer

Due to our company size, we are not required to appoint a data protection officer under Art. 37 GDPR. For data protection inquiries, please contact us directly at: contact@nextrep.de

Last Updated: October 22, 2026