PRIVACY POLICY

Last Updated: December 7, 2025

1. INTRODUCTION

This Privacy Policy (the "Privacy Policy") describes the privacy policy for your access and/or use of our app "RepVox" and any services offered or provided by Carlin Labs, LLC ("Company," "we," "our," or "us") through the app "RepVox" and website which includes, but is not limited to the iOS app and watchOS app or otherwise provided by us, including but not limited to those services that use AI and/or AI Tools services (as defined below), as well as your purchase of any services from the APP and/or any other related services that refer or link to this Privacy Policy (the "App"). We own and operate the App.

As part of the App, we may use artificial intelligence ("AI") for content creation, pictures, marketing, generating materials and customer service (including, but not limited to chat-bot services and the AI assistant) and this AI may process your workout history, exercise data, and in-app queries to power the AI Assistant feature and improve App functionality (the "AI Tools"). Our AI Tools includes an "AI Assistant" interface where you can ask questions about your own workout data (e.g., "How has my bench press progressed this month?") among other features. This AI Assistant feature uses third-party AI providers (e.g., OpenAI and Anthropic) to process your queries. Data sent to the third-party AI providers include, but are not limited to the text of your question, your aggregated statistics and your detailed workout history (e.g. last four weeks of volume) when needed. Short-term conversation context using the AI Tools are stored locally on your device to keep the AI Assistant coherent. We do not store a full conversation context using the AI Tools on our servers. Your conversations using the AI Tools are effectively ephemeral from our server/backend perspective. All outputs using the AI Tools are used only to respond to the question you made using the AI Tools. This Privacy Policy also governs the presence and use of AI Tools and AI Assistant in our App and in our services. The Terms also govern the presence and use of AI Tools in our App and in our services.

We are committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, share, and protect the personal information of visitors to our App.

2. ACCEPTANCE OF PRIVACY POLICY

If you are accessing and/or using our App and/or services for an entity, such as the company you work for, you represent that you have authority to bind that entity to this Privacy Policy, and you agree that "you," and "your," and "yourself" as used in this Privacy Policy includes both you personally and the entity you represent. If you are accessing our App and/or services on behalf of only yourself as an individual, then you agree that "you," and "your," and "yourself" as used in this Privacy Policy includes only you personally as an individual.

This Privacy Policy constitutes a legally binding agreement made between you and us. By accessing and/or using our App, you agree: (i) to the collection and use of information in accordance with this Privacy Policy; (ii) that you have read and familiarized yourself with this Privacy Policy; (iii) you understand this Privacy Policy, and (iv) you are bound by this Privacy Policy. If you do not accept and agree to all of this Privacy Policy, then you MUST NOT access and/or use this App and/or our services.

3. MINIMUM AGE

The App is rated 9+ and is intended for users who are at least nine (9) years of age. If you are under 9 years old, you must not use the App and/or any of the services offered by us.

If you are between 9 and 18 years old (or the age of majority in your jurisdiction, whichever is higher), you may only use the App with the consent of a parent or legal guardian who agrees to be bound by the Terms of Service and this Privacy Policy on your behalf. By allowing a minor to use the App, the parent or legal guardian agrees to supervise the minor's use of the App and accepts full responsibility for the minor's actions.

If you are using the App on behalf of a minor as their parent or legal guardian, you represent that you have the authority to consent to the collection and use of the minor's personal information as described in this Privacy Policy, and you agree that "you," "your," and "yourself" as used in this Privacy Policy includes both you personally and the minor you represent.

We do not knowingly collect, solicit data from, or market to children under the age of 9. If we learn that personal information from a user under 9 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from a child under 9 years of age, please contact us immediately at [email protected].

4. INFORMATION WE COLLECT

We may collect personal information from you for commercial and business purposes. Personal information refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly with you or your household or the company you work for and/or represent. Most data is stored in a cloud database and is synched across the user's device(s). We may collect information about you in a variety of ways. The information we may collect on the App includes:

Your workout data (for example, exercises, sets, reps, weight, RPE, notes, etc.) are all private to your own account. There is no public or social feed that includes this information.

Additionally, we may collect nonpublic personal information about you from the following sources:

We may receive data and/or information about you from third parties. For example, if you access the App and/or our services through a third-party service or interact with the App and/or our services via a third-party service connected to our App and/or our services, that third party may pass certain data and/or information you provided to its service to us. This information could include, but is not limited to, the user ID associated with your account, your username/handle, email address and any information that you have permitted the third party to share with us, and any information you have made public in connection with that service. You should always review, and if necessary, adjust your privacy settings on third-party websites, apps and services before linking or connecting them to our App and/or our services. Ultimately, the terms governing your use of a third-party service will control what data and/or information, if any, that third party shares with us. If you communicate with us via social media, and choose to share your user generated content with us, we may receive information such as posts or videos you have created, your photo, your account name and your comments about us.

We may obtain information about you from third-party sources, such as public sources, social media platforms (for example, LinkedIn, X, Instagram and other platforms) and third-party data providers and information services. Examples of the information we may obtain from such third parties include but are not limited to your username/handle and other profile information. We do this to better understand your profile and interests so that we can deliver customized offers and other personalized services to you, such as to serve relevant offers to you via email. If you prefer not to have your information used for this purpose, you can opt out at any time by contacting us at [email protected].

AI Tools may contain derivatives of, or incorporate or be integrated with, third-party AI models whose distribution is subject to restrictions and you acknowledge and agree that we are not responsible or liable for any third-party AI models or any consequences resulting therefrom.

5. HOW WE USE YOUR INFORMATION

Having accurate information about you permits us to provide you with a smooth and efficient experience. Specifically, we may use information collected about you:

We may use your email to tell you about your usage of the App and/or our services, new features, solicit your feedback, or to inform you about our services, upcoming events or other promotions. If you do not want to receive information from us or about the use of information volunteered by you in this manner, please send us a request specifying your new choice to us at [email protected]. You may also choose to opt out of receiving such emails by following the unsubscribe instructions included in these emails (if available), or by accessing the email preferences in your account settings page (if available). We may also use your phone number to contact you directly by phone, including, but not limited to via text message, in connection with such new services, upcoming events or other promotions.

Where required by applicable law, we will only send you marketing information by email or mail, or contact you by phone, including, but not limited to via text messaging, if you consent to us doing so. When you provide us with your consent to be contacted for marketing purposes, you have the right to withdraw your consent at any time by contacting us at [email protected]. In addition, if at any time you do not wish to receive future marketing communications or wish to be deleted from our mailing or calling lists, please contact us at [email protected]. Please note that if you opt out from marketing communications, we may still contact you regarding issues related to our App and/or our services and to respond to your requests.

6. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information or user data. We may share information we have collected about you in certain situations. Your information may be disclosed as follows:

7. HIPAA AND PROTECTED HEALTH INFORMATION

"HIPAA" refers to the Health Insurance Portability and Accountability Act of 1996 and the rules and the regulations passed by the U.S. Congress designed to protect privacy and ensure the security of Personal Health Information ("PHI") and electronic Personal Health Information (ePHI).

We are not a HIPAA covered entity or a business associate of a HIPAA-covered entity. As such, you must not send any PHI or ePHI when you use our App and/or the services we provide (including, but not limited to the AI Tools and AI Assistant); for example: no full names, addresses, payment information, sensitive personal identifiers, detailed diagnoses, doctor names, hospital names, insurance numbers, or policy numbers.

Apple Health data is accessed and written only with your explicit permission. Apple Health data is only used for fitness-related features.

8. TRACKING AND THIRD PARTIES

There may be other tracking technologies now and later devised and used by us in connection with the App and/or our services. Further, third parties may use tracking technologies in connection with the App and/or our services, which may include the collection of information about your online activities over time and across third-party web sites or online services. We may not control those tracking technologies and we are not responsible for them. However, you consent to potentially encountering third-party tracking technologies in connection with use of the App and/or our services and accept that our statements under this Privacy Policy do not apply to the tracking technologies or practices of such third parties.

The key subprocessors for live data are as follows: (i) Supabase for the database, auth and storage; (ii) RevenueCat for subscription management; (iii) Postmark or an equivalent company for transactional and marketing email; (iv) OpenAI as an AI model provider; and (v) Anthropic as an AI model provider.

9. VISITING OR USING OUR APP AND/OR SERVICE FROM OUTSIDE THE UNITED STATES

The primary backend database/auth/storage is via Supabase/Postgres hosted in the United States. Our App and our services are offered within the United States and operated within the United States, and as such, they are subject to the laws of the United States where and when applicable. We do not make any claims or representations regarding the applicability or compliance of our App and/or our services with the laws of any other country or jurisdiction. If you are a resident of a country other than the United States, then please be aware that your personal information may be transferred outside of that country; and (ii) may be disclosed to service providers and/or third parties located outside of that country.

10. COOKIES POLICY

This Cookies Policy ("Cookies Policy") explains the different types of cookies and similar technologies that may be applied on the browsers and devices of consumers who visit our App and/or who use our services. This Cookies Policy does not apply to the privacy practices of third-party websites and/or apps which may be linked to the App. If you have questions or concerns about this Cookies Policy and/or the Terms, and/or the Legal Disclaimer, and/or this Privacy Policy, please contact us at [email protected].

10.1 Consent: By continuing to use our App and/or our services, you are agreeing to the use of cookies and other similar technologies for the purposes we describe in this Cookies Policy.

10.2 What Are Cookies?: Cookies are small text files which are downloaded to your browser or device when you visit a website or an app. Most web pages and apps contain elements from multiple sources (including but not limited to web domains) so when you use our App and/or our services, your browser or device may receive cookies from several sources. This includes, but is not limited to, third parties that provide services on our behalf, such as website and/or app analytics. In relation to the use of cookies by third parties, we do not have access or control over these cookies. We may also use local shared objects in our App and/or services to store your user preferences and settings. You can manage local shared objects by following the instructions located at https://allaboutcookies.org/how-to-clear-flash-cookies.

10.3 Why Do We Use Cookies?: Our App and/or our services use both first party cookies which are set directly by us and third party cookies which are set by third parties. We use first party and third party cookies for several reasons. Some cookies are required for technical reasons in order for the App to operate, and we refer to these as "Strictly Necessary" cookies. Some cookies allow us to measure and improve the performance of our App, such as by counting visits and traffic sources, and we refer to these as "Performance" cookies. Some cookies enable us to provide enhanced functionality and personalization of the App, and we refer to these as "Functional" cookies. The specific types of cookies served through the App and the purposes they perform are described below.

10.4 Cookie Preferences And Disabling Cookies: You may be able to set your cookie preferences for our App. In addition, if you are not happy with the cookies preferences, you may: (1) delete your cookies (see below for information on deleting cookies); and then (2) refresh the web page. If you do not agree to the use of cookies, please disable or delete them by following the instructions for your browser(s) set out at http://www.allaboutcookies.org/manage-cookies/index.html. Please note that the App will not function well if cookies are disabled. It may also stop you from saving customized settings, like login information, workout history, saved routines or a multitude of other critical functions. You may download a browser extension that will help preserve the opt-out preferences you set by visiting www.aboutads.info/PMC.

10.5 Types Of Cookies We May Use:

11. DO NOT TRACK

Currently, various browsers offer a "do not track" or "DNT" option that relies on technology known as a DNT header which sends a signal to the websites or apps visited by the user about the user's browsers DNT preference setting. We do not currently commit to responding to browser's DNT preference across the App and/or our services because no common industry standard for DNT has been adopted by industry groups, technology companies or regulators, including no consistent standard of interpreting user intent. We take privacy and choices regarding privacy seriously and will make efforts to continue to monitor the development around DNT browser technology and the implementation of a standard for DNT.

12. DATA SECURITY

We use appropriate and reasonable administrative, technical, organizational and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that no security measures are perfect or impenetrable. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our App and in our services is at your own risk. You should only access the App and/or our services within a secure environment.

13. DATA RETENTION

We will retain personal data that you provide to us through the App and/or our services for the period necessary to fulfill the purposes outlined in this Privacy Policy, in our Terms, as set forth in a contract between you and us or unless a longer retention period is required or permitted by law. When we have no ongoing legitimate business need to retain and/or process your personal data and/or when you delete your account, we will either delete all identifiable workout data; however, we will retain billing/transaction records only as legally required and we will retain some analytics only in an aggregated/anonymized form that is not linked back to you individually.

14. MARKETING OPT-OUT RIGHTS

You have the right to opt-out of receiving marketing communications from us at any time by following the unsubscribe link in our emails or by contacting us directly at [email protected]. Depending on your jurisdiction, you may also have other rights regarding your personal information. Even if you opt-out of receiving marketing communications, we will still send you transactional messages which include but are not limited to responses to your questions or emails and those related to purchases you make regarding our App and/or services.

15. DATA PROTECTION RIGHTS

We value your rights with respect to your personal information. Depending on the jurisdiction where you reside, your rights may include any of the following:

We will comply with individuals' requests, including access, correction, and/or deletion of the personal information we store in accordance with the applicable law that applies to an individual.

We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, and to process transactions and facilitate customer requests.

We will take reasonable steps to verify your identity prior to responding to your requests. The verification steps will vary depending on the sensitivity of the personal information and whether you have an account with us.

You can also designate an authorized agent to make a request on your behalf. If you use an authorized agent, please include written permission that you have designated that agent to make the request, or proof of the agent's power of attorney. We may follow up with you to verify your identity before processing your authorized agent's request.

You may contact us directly at [email protected] to request that we provide you with a copy of your personal data or that we delete your personal data that we maintain on our systems. We will respond to your request within a reasonable timeframe. If you are a resident of certain jurisdictions, then please see your additional rights listed in the corresponding sections below:

15.1 Rights of California Residents

If you reside in the State of California, you have additional rights under the California Consumer Privacy Act as described herein. This information supplements our Privacy Policy for California residents only. The following rights do not apply to individuals who reside outside of California.

15.2 Rights of Colorado Residents

If you reside in the State of Colorado, you have additional rights under the Colorado Privacy Act ("CPA") as described herein. This information supplements our Privacy Policy for Colorado residents only. Under the CPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

We do not sell or share your personal information, as those terms are defined under the CPA.

If we decline to take action regarding your request and you wish to appeal our decision, please contact us at [email protected]. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

15.3 Rights of Connecticut Residents

If you reside in the State of Connecticut, you have additional rights under the Connecticut Data Privacy Act ("CTDPA") as described herein. This information supplements our Privacy Policy for Connecticut residents only. Under the CTDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

We do not sell or share your personal information, as those terms are defined under the CTDPA.

If we decline to take action regarding your request and you wish to appeal our decision, please contact us at [email protected]. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

15.4 Rights of Nevada Residents

If you reside in the State of Nevada, you have the right to request that we do not sell your personal information. Please submit your request to us at [email protected] and we will process it accordingly. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. This information supplements our Privacy Policy for Nevada residents only.

15.5 Rights of Utah Residents

If you reside in the State of Utah, you have additional rights under the Utah Consumer Privacy Act ("UCPA") as described herein. This information supplements our Privacy Policy for Utah residents only. Under the UCPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

We do not sell or share your personal information, as those terms are defined under the UCPA.

If we decline to take action regarding your request and you wish to appeal our decision, please contact us at [email protected]. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

15.6 Rights of Virginia Residents

If you reside in the State of Virginia, you have additional rights under the Virginia Consumer Data Protection Act ("VCDPA") as described herein. This information supplements our Privacy Policy for Virginia residents only. Under the VCDPA:

If this definition of "consumer" applies to you, your rights with respect to your personal data include:

We do not sell or share your personal information, as those terms are defined under the VCDPA.

If we decline to take action regarding your request and you wish to appeal our decision, please contact us at [email protected]. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may contact the Attorney General to submit a complaint.

15.7 Rights of Australia Residents

If you reside in Australia, you have the following additional rights:

You may exercise the above rights by contacting us at [email protected]. Please note that we may ask you to verify your identity before responding to such requests. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations.

If you have contacted us at [email protected] with a privacy related complaint and you are not satisfied with our handling of that complaint, you may refer that complaint to the Office of the Australian Information Commissioner:

GPO Box 5218 Sydney NSW 2001
Email: [email protected]
Telephone: 1300 363 992
Website: www.oaic.gov.au

This information supplements our Privacy Policy for Australia residents only.

15.8 Rights of Canada Residents

If you reside in Canada, you have the following additional rights:

You may exercise the above rights by contacting us at [email protected]. Please note that we may ask you to verify your identity before responding to such requests. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations.

In addition, if you have contacted us at [email protected] with a privacy related complaint and you are not satisfied with our handling of that complaint, you have the right to lodge that complaint with the Office of the Privacy Commission of Canada via the following link: https://www.priv.gc.ca/en/report-a-concern/file-a-formal-privacy-complaint/.

This information supplements our Privacy Policy for Canada residents only.

15.9 Rights of New Zealand Residents

If you reside in New Zealand and have an established business relationship with us, you may have the following additional rights:

You may exercise the above rights by contacting us at [email protected]. Please note that we may ask you to verify your identity before responding to such requests. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations.

This information supplements our Privacy Policy for only New Zealand residents who have an established business relationship with us.

15.10 Rights of European Economic Area and United Kingdom Residents

If you reside in the European Economic Area or the United Kingdom, then the following applies to you:

Our operations are located primarily in the United States. If you provide information to us, the information will be transferred out of the European Union ("EU") or United Kingdom (as the case may be) and it will be sent to the United States. By providing personal information to us, you are consenting to its storage and use as described in this Policy.

Under the regulations of the General Data Protection Regulation ("GDPR") you have certain rights as a Data Subject:

You may exercise the above rights by contacting us at [email protected]. Please note that we may ask you to verify your identity before responding to such requests. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations.

In addition to the rights above, please rest assured that we will always aim to encrypt and anonymize your personal information whenever possible. We also have protocols in place in the unlikely event that we suffer a data breach and we will contact you if your personal information is ever at risk. For more details regarding our security protections see this Privacy Policy or contact us at [email protected].

The data controller responsible for your personal information for the purposes of GDPR compliance can be contacted at [email protected].

This information supplements our Privacy Policy for the European Economic Area or the United Kingdom residents only.

15.11 Rights of South Africa Residents

If you reside in South Africa, you have the right to request access to or correction of your personal information by contacting us at [email protected].

If you are unsatisfied with the manner in which we address any complaint with regard to our processing of personal information, you can contact the office of the regulator, the details of which are:

The Information Regulator (South Africa)
General enquiries: [email protected]
Complaints (complete POPIA/PAIA form 5): [email protected] & [email protected]

This information supplements our Privacy Policy for South Africa residents only.

15.12 Rights for Other Jurisdictions

If you are located in another jurisdiction that is not specifically discussed in this Privacy Policy, you may have rights, under applicable data privacy laws, to request information about or access to your personal information that we maintain, to require that inaccurate information be corrected or, in some circumstances, to object to our processing of your personal information. To exercise any rights you may have in another jurisdiction, please send your written request to us at [email protected].

16. TERMS OF SERVICE

Our Terms of Service (currently published at /terms-of-service.html) (the "Terms") applies to your access and/or use of the App and/or our services, and its terms are made a part of and incorporated into this Privacy Policy by this reference. The Terms may be changed from time to time and such changes are effective immediately upon their posting. By accessing and/or using the App and/or our services, you acknowledge that you have read our Terms and agree to our Terms. Capitalized terms used but not defined in this Privacy Policy will have the meanings assigned to them in our Terms.

17. PRIVACY POLICY CHANGES

We reserve the right, at our sole discretion, to change, modify, add or remove all or portions of this Privacy Policy at any time. It is your responsibility to check this Privacy Policy periodically for changes. If we make any material changes to this Privacy Policy, we will update this Privacy Policy and change the "Last Updated" date at the top of this Privacy Policy. Unless otherwise indicated, any new material added to the App and/or services will also be subject to this Privacy Policy. You must periodically review the App and/or services for the latest information about our Privacy Policy. Please see the "Last Updated" date at the top of this Privacy Policy which shows the date this Privacy Policy was last updated. Your continued use of our App and/or our services following the posting of any changes will mean that you accept and agree to the changes.

18. MISCELLANEOUS

This Privacy Policy and any policies and/or operating rules posted by us on our App and/or the services or in respect to our App and/or the services or otherwise, including but not limited to the Terms constitutes the entire agreement between you and us concerning this subject matter and supersedes any prior version of this Privacy Policy and us. Our failure to exercise or enforce any right or provision of this Privacy Policy shall not operate as a waiver of such right or provision. This Privacy Policy operates to the fullest extent permissible by law, rules and regulations. If any provision of this Privacy Policy is found by the arbitrator or (if proper) a court of competent jurisdiction to be invalid, the remaining provisions shall not be affected thereby and shall continue in full force and effect, and such provision may be modified or severed from this Privacy Policy to the extent necessary to make such provision enforceable and consistent with the remainder of this Privacy Policy. There is no joint venture, partnership, employment or agency relationship created between you and us as a result of this Privacy Policy, the Terms and/or your use of our App and/or the services. You agree that this Privacy Policy shall be construed as if drafted jointly by the parties hereto and in the event an ambiguity or question of intent or interpretation arises, no presumption or burden of proof shall arise favoring or disfavoring any party by virtue of the authorship of any provisions of this Privacy Policy.

19. CONTACT US

If you have questions or comments about this Privacy Policy, please contact us at [email protected]. You may attach logs if you are reporting a bug or have feedback.

© 2025 Carlin Labs, LLC. All rights reserved.