Privacy Policy

Rebar is a strength-training app: a logbook, with optional planned training on top. It is operated by Rebar Fitness LLC, a limited liability company based in North Carolina, USA ("Rebar", "we", "us"). We are responsible for your personal data as its "controller". This policy covers the Rebar iPhone app, the Apple Watch app, the web app at getrebar.app, and the beta sign-up. Contact us at support@getrebar.app.

Until September 30, 2026, Rebar was run by its founder, Christopher Corriher, personally. On that date it moved to Rebar Fitness LLC, the company he formed to run it. Your account and data moved with it, and this policy applies to them unchanged. If Rebar is ever transferred to another operator, your data will move with the Service under this policy, and we will tell you before it does.

• Account and profile: email address, display name, username, profile photo, and the optional details you add: bio, sex, age, experience level and training goal. We also store your device's time zone so reminders arrive at the right local time.
• Training data: the workouts you log (exercises, sets, reps, weights, effort ratings, rest times, notes), records, templates, programs and training blocks, how recovered you say each muscle feels, and the stats we work out from them, such as estimated one-rep maxes, the Strength Index and streaks.
• Body metrics (optional): bodyweight, height, target weight and your weigh-in history.
• Apple Health and Apple Watch (optional): if you allow it, the Watch app reads your heart rate and active energy to show them during a workout. The iPhone app saves finished workouts and an estimated calorie figure to Apple Health, and reads your recent Health workouts only to avoid saving a duplicate. Heart rate and other data read from Apple Health stay on your devices. They are not sent to our servers and never used for advertising.
• Location (optional): only if you use gym search while adding a place you train. Your location is read once, while the app is open, and sent to our server and to Google's Places service to list nearby gyms. It is not saved to your account. A rounded location (to about 100 metres) may be cached with the search results for up to 30 days to save repeat lookups, and it isn't linked to you. Only the gym you pick is saved, with its name, address and map position, on your private training location. You can type a gym's name instead and never grant location access.
• AI import (optional): the workout screenshots or text you submit. See "AI import" below.
• Social: who you follow, who follows you, follow requests, the users you block or mute, and the 1v1 challenges you take part in.
• Purchases: whether you have Premium, and your subscription and purchase history from the App Store. We never see your card details.
• Support and reports: messages you send us, including the in-app feedback form, which also attaches your app version and operating system, and any reports you file about another user.
• Beta sign-up: if you ask to join the beta, your email address, the phone you train with, how often you lift, where you log today and whether you follow a program. We also note how you reached the form: the tag on the link you followed and the name of the website it was on (such as reddit.com), never the page itself. If you came from a friend's invite link, we record which Rebar account invited you, so the app can show you that friend when you sign up. They are told you joined once you follow them, or straight away if you open their link in the app.
• Device and usage data: push notification tokens, device model and operating system, crash reports, and app usage. Usage covers which screens and features you use, summary numbers about finished sessions (such as duration, number of exercises and total volume), the text of exercise searches that find nothing (so we can add what's missing), and how long the app takes to start. Usage data is collected with Google Analytics for Firebase and linked to your account ID. Google also receives your IP address, which it uses to estimate your region.

• We don't sell your personal data.
• We don't share it for targeted advertising, show third-party ads, or use your device's advertising identifier to track you across other companies' apps and websites.
• We don't track your location in the background and we don't keep a record of where you have been.
• We don't collect video or record audio.

• To provide Rebar: your account, syncing across devices, your stats, training suggestions and planned blocks, reminders, Premium, and the social features you use. We need this to deliver the service you signed up for.
• With your permission: Apple Health, location for gym search, push notifications and AI import. Each is off until you turn it on. You can withdraw permission for the first three at any time in your phone's settings. AI import sends nothing unless you submit something, so to stop it, stop using it. We also process body metrics and any other health-related data you choose to enter with your consent, which you can withdraw by deleting that data.
• To keep Rebar safe and working: reviewing reports, preventing abuse and fraud, fixing crashes, and understanding which features are used so we can improve them. We rely on our legitimate interest in running a safe, reliable app, and you can turn off usage analytics in Settings → Share usage data. If your phone's region is in the EU, the EEA, the UK or Switzerland, usage analytics stays off until you turn it on there, and we rely on your consent for it. Names, usernames and bios are checked against a list of words we don't allow, and profile photos are checked automatically for sexual or graphic violent content; anything found is removed.
• To contact you: account emails such as verification and password reset, and, if you signed up for the beta, beta and launch emails. Every beta or launch email we send will include an unsubscribe link.
• Legal obligations: to meet our legal obligations and to respond to lawful requests.

• Accounts are public unless you make yours private. A public profile shows your name, username, photo, bio, training level and goal, streak, follower counts and join date. It can be seen by other Rebar users and by anyone on the web at getrebar.app/u/…, and it may appear in search engines.
• Private accounts: people must ask to follow you, and Rebar doesn't show your profile details, workouts or records to anyone you haven't approved. Your name, username and photo stay visible so people can find you. Private profiles are not shown to search engines. Turn this on in Settings.
• Training partners (everyone who follows you; on a public account anyone can follow without asking) see your per-lift estimated maxes and levels on friends boards. When you set a headline record or reach a streak milestone, they get a notification. Turn that off in Settings → Share my PRs and streaks.
• Your workout log, notes, body metrics, age and sex are not shown to other users. Rebar uses age, sex and bodyweight for your suggested starting weights, calorie estimates and per-lift levels. Other users see only the resulting level.
• Templates and programs you make public, and challenges you enter, are visible to the people they are shared with. A share link can be opened by anyone who has the link, and may appear in search engines if it is posted publicly.
• Share cards are made on your device and go nowhere until you share one.

AI import is optional. Before your first import, the app asks for your permission. The screenshots or text you submit are sent through our server to Anthropic, our AI provider, which reads them and returns the workout. We don't store the images. Anthropic processes them under its commercial terms. It doesn't use them to train its models, and it deletes them after a limited retention period (at most 30 days, unless they are flagged for a policy violation). Don't submit screenshots that show information you don't want shared, such as other people's names or messages.

We use these companies to run Rebar. They process data on our behalf and only for the purpose listed:

• Google (Firebase and Google Cloud): sign-in, including Sign in with Google, database, file storage, server functions, web hosting, push notifications, app integrity checks, crash reporting (Crashlytics), usage analytics (Google Analytics for Firebase) and automated checks of profile photos (Cloud Vision).
• Google Maps Platform: gym search. It receives the search text or your location for that one search, not your account.
• Apple: Sign in with Apple, push notification delivery, Apple Health and App Store purchases.
• RevenueCat: subscription status. It receives your Rebar account ID and App Store purchase receipts, never your card details.
• Anthropic: reading the workout screenshots and text you submit through AI import.

These providers are in the United States. If you use Rebar from elsewhere, including the EU, UK or Switzerland, your data is transferred to and stored in the US. We rely on our providers' safeguards for those transfers, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

• Your account and training data: for as long as your account exists.
• Daily activity records used for our usage statistics: 120 days.
• Google Analytics and crash reports: up to 14 months for analytics and 90 days for crash reports, under Google's retention settings.
• Beta sign-ups: until the beta ends, or sooner if you ask us to delete yours.
• Feedback you send: kept to improve the app, with your name and account removed when you delete your account. A screenshot you attach to feedback is deleted when you delete your account.
• Reports you file, or that name you, are kept as a safety record after either account is deleted.
• After you delete your account: usage analytics already sent to Google Analytics expire on its retention schedule above, and App Store purchase records are kept by Apple and by RevenueCat.

You can delete your account at any time in the app under Settings → Delete Account, or on the web at getrebar.app/delete-account. This permanently removes your profile, photo, workouts and training history, body metrics, templates and programs, follows, challenges, share links and notifications. It also removes a beta sign-up made with your account's email address, and asks Apple to revoke Rebar's access if you signed in with Apple.Copies in our providers' backups are overwritten on their normal cycles.

Deleting your account doesn't cancel an App Store subscription, so cancel that with Apple first. If you used social features Rebar has since retired, such as posts, comments or clubs, email support@getrebar.app and we will delete that content too.

Depending on where you live, you have the right to:

• Access and portability: get a copy of your data. In the app, Settings → Export my data → Everything saves a copy of everything we store for your account, as a file you keep. You can also email us for one.
• Correct it, in the app or by email.
• Delete it, as described above.
• Object to or restrict how we use it, for example by turning off usage analytics.
• Withdraw consent at any time, without affecting what we did before you withdrew it.
• Complain to your data protection authority, if you are in the EU, UK or Switzerland.

To use any right, email support@getrebar.app from the address on your account, so we can confirm it is you. You can also have an authorized agent ask for you. We will reply within 30 days (45 days for consumer health data requests), or sooner if your local law requires it. If we turn down your request, you can appeal by replying to our answer, and we will respond to your appeal within 45 days. We will never treat you differently for using your rights.

This section is for residents of California and other US states with consumer privacy laws. In the last 12 months we collected these categories of personal information, all from you or your devices, for the purposes described above: identifiers (such as email and account ID); customer records; characteristics such as age and sex; commercial information (subscription status); internet or device activity (app usage); approximate location from gym search or your time zone; fitness and health-related information; and the content you create.

We disclose these only to the service providers listed above, for business purposes, and to a successor operator if Rebar is ever transferred, as described under "Who we are". We don't sell or "share" personal information for cross-context behavioral advertising, and we haven't done so in the last 12 months. That includes sensitive personal information, which we use only to provide Rebar. Because we don't sell or share, there is nothing to opt out of, and we treat a Global Privacy Control signal the same way. We don't knowingly sell or share the data of anyone under 16.

Some state laws (such as Washington's, Nevada's and Connecticut's) give consumer health data extra protection. Read our Consumer Health Data Privacy Policy.

Rebar is not for children under 13. Sign-up stops, in the app and on the web, when someone enters an age under 13, and we don't knowingly collect data from children under 13. If you believe a child is using Rebar, email support@getrebar.app and we will delete the account.

The web app stores your sign-in session, a local copy of your data for speed and offline use, and display preferences in your browser's storage. These are needed for it to work. If you arrive from a friend's invite link, it is also remembered until you close the browser tab, so the beta sign-up can say who invited you. We don't use advertising or analytics cookies on the web.

Data is encrypted in transit and at rest by our providers. Access to production systems is restricted, and security rules enforce who can read each piece of your data. No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

If we change this policy, we will update the date above. If a change is material, we will tell you in the app or by email before it takes effect. Questions or requests: support@getrebar.app.