Legal

What leaves your device

Last updated 28 August 2026 · verified against the code on that date

reps. counts your squats and push-ups through the webcam, and the counting happens in your browser. That claim is the most valuable thing about this product, so this page states it precisely rather than generously: the table below lists everything that leaves your device, where it goes, and why. If a row is not here, it does not happen.

Data flow

Camera frames

Nowhere. Processed in your browser and discarded frame by frame.

The pose model runs on-device (MediaPipe WASM). No video is recorded, uploaded or stored.

lib/pose/poseLandmarker.ts

A request for the pose model and its runtime

cdn.jsdelivr.net and storage.googleapis.com

The ~9 MB model and WASM download from those two hosts. They see your IP address and the time of the request, never a frame. Cached in your browser for 30 days after the first load.

lib/pose/poseLandmarker.ts · src/sw.ts

Run results

Our database

Ticker, difficulty, reps counted, target, whether you survived, and the time — so the ladder, your history and the run receipt exist. Sent only when a run finishes.

routes/api/scores/+server.ts

Your IP address, at the moment a run is submitted

ipapi.co, once

Resolved to a two-letter country code for the "countries playing" stat. We store the country code. We do not store the IP address.

lib/server/geo.ts

Account identifiers

Our database

Email address (sign-in codes are sent through SendGrid), or your Google or X profile fields — id, handle, display name, avatar URL — plus the session token that keeps you signed in.

routes/api/auth/** · lib/server/email.ts

Page views and in-game events

Our database, and Google Analytics 4

A random anonymous id kept in your browser marks first-party events (no cookie, no fingerprinting). The same page views are mirrored to Google Analytics, which sets its own cookies and receives your IP.

lib/robinhood/track.svelte.ts · app.html

A push subscription

Our database, and your browser’s push service

Only if you opt in to beat reminders. Stored so we can send them; deleted when you unsubscribe.

routes/api/push/subscribe/+server.ts

The replay GIF

Your device

Rendered in your browser from the skeleton overlay, with the head region covered. It leaves only when you share or save it yourself. The run receipt image on a shared link is drawn on our server from the stored numbers, not from video.

lib/media/gifEncoder.ts · lib/pose/faceBlur.ts · routes/api/og/run/[id]

What	Where it goes	Why, and what is kept
Camera frames	Nowhere. Processed in your browser and discarded frame by frame.	The pose model runs on-device (MediaPipe WASM). No video is recorded, uploaded or stored. lib/pose/poseLandmarker.ts
A request for the pose model and its runtime	cdn.jsdelivr.net and storage.googleapis.com	The ~9 MB model and WASM download from those two hosts. They see your IP address and the time of the request, never a frame. Cached in your browser for 30 days after the first load. lib/pose/poseLandmarker.ts · src/sw.ts
Run results	Our database	Ticker, difficulty, reps counted, target, whether you survived, and the time — so the ladder, your history and the run receipt exist. Sent only when a run finishes. routes/api/scores/+server.ts
Your IP address, at the moment a run is submitted	ipapi.co, once	Resolved to a two-letter country code for the "countries playing" stat. We store the country code. We do not store the IP address. lib/server/geo.ts
Account identifiers	Our database	Email address (sign-in codes are sent through SendGrid), or your Google or X profile fields — id, handle, display name, avatar URL — plus the session token that keeps you signed in. routes/api/auth/** · lib/server/email.ts
Page views and in-game events	Our database, and Google Analytics 4	A random anonymous id kept in your browser marks first-party events (no cookie, no fingerprinting). The same page views are mirrored to Google Analytics, which sets its own cookies and receives your IP. lib/robinhood/track.svelte.ts · app.html
A push subscription	Our database, and your browser’s push service	Only if you opt in to beat reminders. Stored so we can send them; deleted when you unsubscribe. routes/api/push/subscribe/+server.ts
The replay GIF	Your device	Rendered in your browser from the skeleton overlay, with the head region covered. It leaves only when you share or save it yourself. The run receipt image on a shared link is drawn on our server from the stored numbers, not from video. lib/media/gifEncoder.ts · lib/pose/faceBlur.ts · routes/api/og/run/[id]

Does the camera video ever get uploaded?

No. As of 28 August 2026, no code path in reps. records, uploads or stores webcam video or still frames. The pose model (MediaPipe Pose Landmarker, 33 body landmarks) runs inside your browser; the only outputs that persist are rep counts and the numbers in the table above. The one qualification: the model itself is downloaded from two third-party hosts, which see your IP address once.

Cookies and local storage

Two first-party cookies: one keeps you signed in, one remembers your language for a year. A third, short-lived one exists only during a Google or X sign-in, to tie the return trip to the request you started. Local storage holds guest progress, your language, sound preference and the anonymous analytics id. Google Analytics sets its own cookies on this domain. Clear any of them in your browser settings; nothing breaks except that you are signed out.

Public surfaces

Your handle, avatar and scores appear on the ladder and on any run link you share. Those pages are marked not to be indexed by search engines. The server-drawn receipt image on a shared run shows your handle, the chart and your numbers — never video.

Service providers

Hosting and the database are run on infrastructure providers under our account; SendGrid sends sign-in codes; ipapi.co resolves a country; Google Analytics receives page views; jsDelivr and Google Cloud Storage serve the pose model. Each processes data only to provide that service.

Children

reps. is not directed at children under 13, or under the minimum age in your jurisdiction. Do not use the service if you are under that age.

Who is responsible, and how to reach them

reps. is built and operated by the Vitals Protocol team. The legal entity, its registered address and a monitored contact address for privacy requests are pending counsel review and will be published here when confirmed. Until then, reach the team on X at @playrepsxyz.

This policy is a working document for a free demo and is not a substitute for counsel-reviewed terms. See also the terms of use and how counting works.