# Reapone Privacy Policy

**Review draft — not yet effective.** Prepared 20 October 2026. Effective date: [APPROVED EFFECTIVE DATE]. Version: [APPROVED VERSION]. Bracketed items require confirmation before publication.

## 1. Who we are and what this notice covers

Reapone (PTY) Ltd. operates Reapone, a personal fitness and nutrition tracking application. This notice explains the personal information handled through the current app, its web version and our associated landing and legal pages.

Our address is 1a Loerie Street, Randpark Ridge, Randburg, 2156, South Africa. Business telephone: +27 68 144 0715. Company registration number: [REGISTRATION NUMBER]. Privacy contact and Information Officer: [NAME OR ROLE AND MONITORED PRIVACY EMAIL]. Website: https://reapone.pages.dev.

Reapone determines the purposes of its app's personal-information processing. [CONFIRM RESPONSIBLE-PARTY/CONTROLLER DETAILS AND ANY REQUIRED LOCAL REPRESENTATIVES FOR LAUNCH MARKETS.] This notice describes data practices; accepting it is not, by itself, consent to every use of personal information.

## 2. Information you provide

**Account and access information.** When you register or sign in, we process your email, password if you choose email/password access, verification and recovery codes, and any name or username required to complete your account. Clerk provides authentication. If a security check uses an existing phone or authenticator factor, the associated identifiers and verification codes are processed through Clerk. Your password and codes pass through the app to the authentication service; they are not saved as fields in our fitness database.

If you select Apple or Google sign-in, Clerk and the selected provider handle the connection. The identity details available to Reapone depend on that provider and your permissions, and may include your name, email, provider identifiers and profile image. The app displays the name, email and image available on your account.

**Fitness profile and onboarding.** We process your date of birth, gender selection, height, starting and target weights, fitness goal, activity/training frequency, chosen pace, diet, food-tracking experience, whether you have coaching or nutritionist support, challenges, desired support and measurement-unit preference. We save onboarding progress on your device before you create an account; a completed guest profile can be connected to the account you subsequently sign into. Your completed profile and calculated daily nutrition targets are saved to your account.

**Records you log.** These include meal names, Breakfast/Lunch/Dinner/Snacks categories, quantities, units, calories and macronutrients; custom foods and favorites; workout names, categories, duration, distance you enter, completed exercises, repetitions, loads and notes; and weight measurements. Records also include account/record identifiers, relevant calendar dates and creation, update or removal timestamps where applicable.

**Choices and search inputs.** We record your legal-acceptance information and optional marketing preference through the account service. Online food lookup processes the search terms or product barcodes you submit.

Some fitness records and notes may reveal information about your health. Diet choices, such as Halal, may also suggest religious beliefs. A preference does not establish a belief or diagnosis. Please avoid adding unrelated sensitive information about yourself or other people in free-text fields.

## 3. Information from your device and use of the service

We read locale/region and measurement-system settings to choose initial metric or imperial units. You can change units. Log dates use your device's local calendar. This does not use GPS to determine your location.

Authentication, database, food-lookup and image requests involve technical information such as IP address, request time, headers and device/browser or session information received by the relevant services. [CONFIRM THE PRODUCTION LOG CATEGORIES, PURPOSES, ACCESS AND RETENTION WITH EACH PROVIDER AND WEBSITE HOST.]

The current Reapone source does not integrate a separate advertising, session-replay or product-analytics service. Clerk's SDK includes development-instance usage telemetry, such as SDK/feature usage and instance/version identifiers, and diagnostic capabilities. Our current provider setup does not expressly disable its optional telemetry. This is distinct from logging a meal or sending fitness records to an analytics platform. [CONFIRM RELEASE SDK DIAGNOSTICS, TESTER TELEMETRY SETTINGS AND ANY NECESSARY CHOICES BEFORE PUBLICATION.]

## 4. Why information is used

The current application uses information to:

- Create and authenticate accounts, verify sensitive account actions, recover access and maintain sessions.
- Resume onboarding and connect a completed guest profile to your account.
- Store, display, edit and summarize your food, nutrition, workouts and weight history, and keep your measurement-unit preference.
- Calculate estimated calorie/macronutrient targets and an illustrative goal timeline from relevant profile inputs, and display progress summaries.
- Search product nutrition data, retrieve images, cache lookup results and limit excessive requests.
- Record your optional marketing choice, without requiring it to create an account.
- Complete account deletion and prevent a deleted account's still-valid token from recreating records.

These are automated calculations and summaries rather than generative AI. The reviewed app does not send your fitness records to a generative-AI provider. Not every onboarding answer changes the calculation. The estimates do not make legal, credit or employment decisions about you.

Account access requires the information needed by your chosen sign-in method. Profile inputs are used to complete the personalized onboarding flow; if you do not provide inputs required by that flow, it cannot finish. Logging meals/workouts, searching online, camera access and marketing opt-in are choices. The gender screen includes a prefer-not-to-say option and diet includes no preference. You can enter a barcode manually without camera access.

**Legal grounds.** [FOR EACH ACTUAL LAUNCH JURISDICTION, IDENTIFY THE LAWFUL GROUNDS FOR ACCOUNT/SERVICE DELIVERY, SECURITY AND OPTIONAL MARKETING, AND THE ADDITIONAL AUTHORIZATION OR EXPLICIT CONSENT REQUIRED FOR HEALTH-RELATED OR OTHER SPECIAL PERSONAL INFORMATION. DESCRIBE HOW ANY REQUIRED CONSENT IS OBTAINED AND WITHDRAWN.] The current combined legal checkbox does not establish a separate, implemented sensitive-data-consent process.

## 5. Services that receive information

**Clerk** handles account identity, credentials, verification, sessions, social sign-in, account preferences and account deletion. Depending on the information and activity, Clerk's contractual role may differ; its DPA distinguishes processing on a customer's behalf from certain account information it handles as an independent controller. See [Clerk's privacy information](https://clerk.com/legal/privacy) and [data processing terms](https://clerk.com/legal/dpa). Those documents do not replace Reapone's responsibility for its own processing.

**Supabase** hosts the app's fitness database and backend functions, receiving account-linked profile/log data and authenticated requests. It also holds food-lookup caches, rate-limit records and deletion-security markers. See [Supabase's data processing terms](https://supabase.com/legal/customer-resources/data-processing-addendum).

**Cloudflare Pages** hosts and delivers our public landing, legal and support pages. Cloudflare receives ordinary website-request metadata, such as IP addresses, request times and headers, to deliver and protect those pages. Hosting response headers also enable network-error reporting by compatible browsers. See [Cloudflare’s privacy information](https://www.cloudflare.com/privacypolicy/). [CONFIRM THE APPLICABLE HOSTING AGREEMENTS, LOG ACCESS AND RETENTION.]

**Apple or Google**, if you choose their sign-in option, process the sign-in interaction under their respective account and privacy arrangements.

**Open Food Facts** receives submitted food queries or barcodes to return product information. The normal lookup is through our backend and does not forward your Clerk token, full profile or meal diary to Open Food Facts. If that lookup fails in certain ways on a native device, the app can request the product data directly, exposing your device's IP and ordinary request metadata to the provider. Product images also load directly from its image host. A query can itself reveal a food preference; do not put personal identifiers in it. Manually entering a food avoids submitting an online lookup.

Profile images load from the image URL supplied by the account service. The relevant image host receives the image request and ordinary network metadata.

Expo/EAS supports the current development build and distribution process. It is not configured in the app as a destination for your meal diary or a connected health record. [CONFIRM PRODUCTION DISTRIBUTION/HOSTING PROVIDERS, RELEVANT DIAGNOSTICS, SUBPROCESSORS AND ANY OTHER ACTUAL RECIPIENTS.]

The current app has no public feed or function for publishing your fitness diary to other users. Ordinary client access to database records is restricted by account ownership. Authorized backend services and privileged database access can still process those records; this is not end-to-end encrypted storage. [CONFIRM WHO HAS ADMINISTRATIVE ACCESS AND THE ACTUAL ACCESS-GOVERNANCE ARRANGEMENTS.]

## 6. Device storage, browser storage and permissions

Native onboarding drafts are stored using the operating system's secure storage. Native authentication tokens use Clerk's SecureStore token cache, with a different access setting from onboarding drafts. Secure storage can persist across app restarts; uninstall behavior differs between operating systems, and iOS keychain data can remain after uninstall.

The web version saves onboarding drafts in browser sessionStorage. Browser-based authentication and Apple/Google sign-in can use cookies or browser storage through those services. [CONFIRM THE ACTUAL COOKIE/STORAGE INVENTORY AND ANY REQUIRED CONSENT CONTROLS FOR THE RELEASE WEB APP.] Signing out is different from deleting your account or clearing every device draft.

On the web, selected food details and record identifiers can appear in navigation URLs, browser history and potentially server access logs. Images may be cached by the device/browser or image library.

The current static landing and legal pages do not set their own cookies or include analytics, forms, advertising pixels or externally hosted fonts/scripts. Cloudflare Pages receives page-request metadata as the hosting service. [CONFIRM HOSTING LOGGING AND RETENTION.]

The camera is used, with your permission, to decode food barcodes. The app sends the decoded barcode for lookup; it does not upload camera frames or record video/audio in this flow. You can deny or revoke camera access in device settings and enter the code manually.

## 7. Retention and deletion

**Saved fitness records.** Records remain associated with your account unless changed or deleted through the applicable process. [APPROVE RETENTION PERIODS OR CRITERIA FOR ACTIVE/INACTIVE ACCOUNTS AND SOFT-DELETED RECORDS.] The app's current 90-day loading window for meals/workouts is not a 90-day deletion rule. Removing a meal, workout or custom food marks it removed and hides it from ordinary lists; it does not immediately erase the stored row.

**Onboarding drafts.** Drafts older than seven days are ignored when read; the code does not automatically erase them at that point. Successful profile saving clears the current account and guest draft. Signing out does not explicitly clear every draft key. [CONFIRM PHYSICAL DRAFT PURGE AND SHARED/OTHER-DEVICE RETENTION ARRANGEMENTS.]

**Lookup data.** A shared cache stores the actual normalized query or barcode and product results, without an account identifier in that cache entry. Results are normally reusable for 24 hours, or five minutes for empty results; expired entries are removed opportunistically, not at a guaranteed erasure deadline. Rate-limit records contain a hashed account identifier, counters and time windows; records older than an hour are cleaned up on a subsequent reservation. These records are not automatically removed by the account-data deletion function.

**Account deletion.** In Profile, choose Delete Account, complete the confirmation and any requested identity verification. The app checks backend readiness, clears its current/guest onboarding drafts and requests deletion of your Clerk account. A signed deletion event triggers removal of the corresponding Supabase profile, meals, custom foods, workouts and weight history, including removed records and older history. Backend cleanup is asynchronous. [CONFIRM COMPLETION TARGET, FAILED-DELIVERY MONITORING AND RESIDUAL VENDOR-DATA HANDLING.]

A one-way hash of the deleted account identifier remains to prevent stale credentials from recreating deleted records. This is a security identifier, not a retained fitness profile, and is not necessarily anonymous. It currently has no automatic expiry. [APPROVE A NECESSARY, PROPORTIONATE RETENTION PERIOD OR JUSTIFICATION AND PURGE PROCESS.] Account deletion does not remotely clear drafts on your other devices or automatically erase shared lookup entries, provider logs or backups. [STATE VERIFIED BACKUP, LOG AND PROVIDER RETENTION/DELETION PERIODS AND ANY SPECIFIC LEGALLY REQUIRED EXCEPTIONS.]

## 8. Security and international processing

The app uses authenticated requests and database account-ownership policies; backend functions validate authentication tokens or signed account-deletion events. Privileged backend keys are read from server configuration rather than included as app public keys. Native drafts and tokens use secure storage. Food-service connections use HTTPS. [VERIFY ALL PRODUCTION AUTH/DATABASE/WEBSITE TRANSPORT, HOSTED STORAGE/BACKUP PROTECTION, STAFF ACCESS AND INCIDENT-RESPONSE ARRANGEMENTS.]

These controls reduce risk; they do not guarantee that every system or device is secure. This notice does not claim end-to-end encryption or a particular certification.

Our service providers can involve processing outside South Africa or your country. [IDENTIFY ACTUAL DATABASE, AUTHENTICATION, SUPPORT, IMAGE, HOSTING AND SUBPROCESSOR COUNTRIES; THE APPLICABLE TRANSFER SAFEGUARDS; AND HOW USERS CAN OBTAIN DETAILS.] We have not established through source code alone that all information stays in any one country or that a particular transfer mechanism applies.

## 9. Your choices and privacy rights

Within the app, you can edit your fitness profile and units, edit supported logged records, update today's weight, remove supported records, sign out and request account deletion. You can choose manual food entry instead of online lookup and control camera permission in device settings. The current app does not offer a self-service data-export button or a marketing-preference editor.

Depending on the law that applies, you may have rights to request confirmation of processing, access/copies, correction, deletion, restriction, objection, withdrawal of consent where relied on, or portability where applicable. These legal rights are not limited to the controls currently available in the app. To make a request, contact [MONITORED PRIVACY EMAIL / REQUEST CHANNEL]. [CONFIRM THE OPERATING PROCESS, PROPORTIONATE IDENTITY CHECKS AND APPLICABLE RESPONSE DEADLINES BEFORE PUBLICATION.] Do not send passwords or verification codes with a request.

You can leave the optional marketing choice unchecked. The current app records that choice but does not implement a campaign-sending or unsubscribe system. [BEFORE SENDING MARKETING, CONFIRM THE SENDER, VALID CONSENT EVIDENCE AND A WORKING WITHDRAWAL/UNSUBSCRIBE METHOD; THEN UPDATE THIS SECTION.]

You may raise concerns with South Africa's [Information Regulator](https://inforegulator.org.za/complaints/) or another competent privacy authority where applicable. [CONFIRM ANY ADDITIONAL MARKET-SPECIFIC CONTACTS/DISCLOSURES.] This notice does not require you to waive privacy rights or use private arbitration instead of complaining to a regulator.

## 10. Adults and changes to this notice

Reapone is intended for people aged 18 or older. Onboarding uses a self-declared birth date; it is not independent age verification. If you believe information about someone under 18 has been submitted, contact [PRIVACY CONTACT]. [CONFIRM THE PROCEDURE FOR INVESTIGATING AND REMOVING UNDERAGE DATA.]

This notice describes the current free app. Premium subscriptions and additional features are planned; they are not described as existing payment, AI, health-platform or tracking integrations. The notice must be reviewed when data practices change. [APPROVE EFFECTIVE DATE, VERSION HISTORY AND HOW MATERIAL CHANGES WILL BE COMMUNICATED, INCLUDING ANY REQUIRED NEW CONSENT.]