RepBeit隐私政策
我们保存什么、为什么保存，以及你如何控制自己的记录。
适用于 RepBeit App 与这些公开网页。条款版本 8。
账号和同步
登录后，你的训练、饮食、体重、设置和已保存的户外路线会同步到 RepBeit 的服务器（测试期间是开发者家里的一台 Mac），用来在你的设备之间保存和恢复。我们用自己生成的用户编号区分账号，登录方式（Apple、Google、邮箱）只用来确认是你。
邀请制内测
登录后需要邀请码激活，才能使用同步、助手、餐食识别和社区。每个激活账号有一个邀请码，最多邀请 3 人；用完或撤销后不能再兑换。删除账号不会退还已使用的邀请名额。未登录仍可在本机记录训练和饮食。
食物照片识别
登录并用邀请码激活账号后，食物识别才会把照片发到识别服务器（测试期间是开发者的 Mac）。为了评测和改进识别模型，服务器会保存：你上传的餐食照片、模型给出的识别结果、你确认或修改后的结果、这台手机随机生成的设备编号，以及经过登录验证的用户编号（用来知道照片属于哪个账号；不保存照片的位置信息）。这些数据只在 RepBeit 项目内部用于评测和改进食物识别模型（可能用作训练数据），不会公开、出售或提供给其他公司作独立用途；网络传输由 Cloudflare 等基础设施服务商处理。未登录或未激活时，照片和记录只留在本机，不上传识别或备份；激活后账号同步保存记录。只有你在「饮食」里添加的照片才会上传识别；不想上传的话，可以不拍照、直接手动记录。删除账号时会自动清理已关联的照片及备份中的账号内容，失败会自动重试。早期无法关联账号的匿名上传不能仅凭账号定位，需要另行提供设备编号核对归属。
RepBeit 助手
你发给 RepBeit 助手的文字和照片，以及回答需要用到的记录摘要（目标、今天和最近几天吃了什么、最近的训练、体重、你的器械），会经过我们的服务器发给 Anthropic 的 Claude 模型生成回答。Anthropic 只作为服务提供方处理这些内容。我们的服务器只记录每次调用的时间和用量（用来控制次数和成本），不保存你说的话、照片和回答。助手会把聊天里提到的身体情况、偏好和安排记成几条简短的笔记，存在你的账号里、跟着同步，以后回答时一起带上；可以在「我的 → AI 助手」里查看、修改、删除或关掉。连上日历后，问到什么时候练时会带上那几天什么时候忙（只有起止时间，不带活动的内容）。助手给出的记录、计划和目标都要你点确认才会写入。
社区规则与举报
社区禁止色情、仇恨、骚扰、暴力威胁、垃圾信息和泄露他人隐私。文字经过基础规则过滤，公开照片和新头像先人工审核，规则过滤不能识别所有违规内容。动态菜单、评论、消息或用户主页可以举报，也可以屏蔽用户；管理员可以移除内容、暂停账号云端服务。举报只提交相关内容，私信只提交被举报的一条；当前服务中的未处理举报证据保留 30 天，处理后清除证据和补充说明；备份按最近 14 份成功快照轮换。申诉和隐私请求请使用 repbeit.com/support。
健康数据
连接 Apple 健康后，iPhone 读取训练和体重，用来补全打卡和进步记录，不向「健康」写入。Apple Watch 训练时读取心率和能量消耗，并把训练和能量消耗保存到「健康」，只用来显示和保存你的训练记录。
不是医疗建议
App 和助手给的饮食、训练建议只是一般的健身参考，不能代替医生。怀孕、生病、受伤、进食障碍或在用药时，请先咨询医生。
删除数据
登录后，「设置 → 账号」里可以删除账号：服务器上的账号数据、关联的餐食照片和已有备份里的账号内容会删除，这台手机上的记录也一起清空。清理失败时服务器会保存请求并自动重试，尚未完成会明确告知；恢复备份也会排除已删除账号；为此保留最小删除记录和防滥用标记。
位置与社区可见范围
户外路线只有保存后才会跟随账号同步；发布动态时，只有主动开启位置分享，才会附带坐标。社区头像、简介和公开动态可被其他已激活用户查看；仅自己可见的动态不会对外展示。私信和群消息保存在服务器上，没有端到端加密。举报私信时只向管理员提交该条消息，不提交整个会话。
服务商、用途与保存
账号验证由 Supabase 及你选择的登录服务商处理；Cloudflare 处理网站和 API 的网络传输，包括网络请求和 IP 地址；客服邮件由 Apple iCloud Mail 处理，用于回复你的请求，邮件往来需另行请求清理；Anthropic 处理主动发给助手的内容。测试期间账号数据存放在开发者的 Mac Studio，备份在外置硬盘上，保留最近 14 份成功快照，目前快照未额外加密。账号记录和用于改进模型的餐食照片在你保留账号期间保存，删除账号时清理；当前服务中的举报证据保留 30 天，处理后清除；旧备份随快照轮换清除。我们不出售个人数据，不利用 Apple 健康数据投放广告，也不在这些网页使用广告追踪脚本。
你的选择与联系
你可以不登录而只在本机记录；拒绝相机、照片、位置、日历或健康权限仍可手动记录。可以在系统设置撤销权限，在 App 里导出个人数据或删除账号。隐私、更正、删除请求及审核申诉请到支持页面查看联系方式。App 和服务仍在内测，请勿把它当作紧急求助渠道。
Privacy policy
What we keep, why we keep it, and how you control your records.
Applies to the RepBeit app and these public pages. Terms version 8.
Your account and sync
Once you sign in, your training, food, weight, settings and saved outdoor routes sync to the RepBeit server (during testing, a Mac at the developer’s home) so they are kept and restored across your devices. Accounts are told apart by a user id we make; the sign-in method (Apple, Google, email) only confirms it is you.
Invite-only beta
After signing in, activate with an invite code to use sync, the assistant, meal recognition and community. Each activated account can invite up to 3 people. Used-up or revoked codes cannot be redeemed. Deleting an account does not refund an invitation. Without signing in, you can still log training and food on this device.
Meal photo recognition
After signing in and activating with an invite code, meal recognition sends your photo to the recognition server (during testing: the developer’s Mac). To evaluate and improve the model, the server keeps the meal photos you upload, the model’s answer, the result you confirm or edit, a random device id made on this phone, and your verified user id (so we know which account a photo belongs to; no photo location is kept). This data is used only inside the RepBeit project to evaluate and improve food recognition (possibly as training data); it is never published, sold, or provided to other companies for independent use; infrastructure providers such as Cloudflare process network transfers. Without signing in and activating, photos and records stay on this device, with no recognition upload or backup; activated accounts use account sync to keep records. Only photos you add on the Food page are uploaded; to keep a meal off the server, log it by hand instead of taking a photo. Deleting your account also removes associated photos and account contents in backups, with automatic retries on failure. Early anonymous uploads without an account association need a device id to verify ownership separately.
RepBeit Assistant
What you send the assistant — words and photos — and the summary of your records an answer needs (goals, what you ate today and lately, recent workouts, weight, your equipment) go through our server to Anthropic’s Claude model, which writes the answer. Anthropic handles them only as the service provider. Our server keeps only the time and size of each call (to limit use and cost), not your words, photos or the answers. The assistant keeps a few short notes of the body limits, likes and plans you mention in chat, stored in your account and synced, and sends them along with later questions; you can see, change, delete or turn them off in Me → AI assistant. With a calendar connected, a question about when to train sends when you are busy on those days (start and end only, never what the events are). Nothing the assistant suggests — a meal, a plan, a goal — is saved until you confirm it.
Community rules and reports
Sexual content, hate, harassment, threats, spam and disclosure of other people’s private information are prohibited. Text passes a basic rule filter; public photos and new profile photos require human review. Rules cannot detect every violation. Report posts, comments, messages or profiles, and block users through their menus. Moderators may remove content or suspend account cloud services. A report submits only relevant content; a message report submits only that message. Unresolved report evidence in the live service is kept for 30 days; evidence and additional details are cleared upon resolution. Backups rotate through the latest 14 successful snapshots. For appeals or privacy requests, visit repbeit.com/support.
Health data
When you connect Apple Health, the iPhone reads workouts and weight to fill in check-ins and progress; it does not write to Health. During a workout, Apple Watch reads heart rate and active energy and saves the workout and active energy to Health, only to show and keep your training records.
Not medical advice
Food and training suggestions from the app and the assistant are general fitness guidance, not a doctor’s advice. If you are pregnant, ill, injured, have an eating disorder or take medicine, ask a doctor first.
Deleting your data
Once signed in, Settings → Account lets you delete your account: your server account data, associated meal photos, and account contents in existing backups are deleted, along with this phone’s records. If cleanup fails, the server keeps the request and retries; pending cleanup is stated clearly. Restoring a backup also excludes deleted accounts; minimal deletion and abuse-prevention markers are retained for this purpose.
Location and community visibility
Outdoor routes sync with your account after you save them. A post includes coordinates only when you enable location sharing. Community profiles and public posts are visible to other activated users; private posts are author-only. Direct and group messages are stored on the server and are not end-to-end encrypted. Reporting a message submits that message to a moderator, not the entire conversation.
Providers, purposes and retention
Supabase and your selected sign-in provider handle authentication. Cloudflare handles website and API traffic, including requests and IP addresses. Apple iCloud Mail handles support correspondence so the developer can respond; request deletion of correspondence separately. Anthropic processes content you choose to send to the assistant. During the beta, account data is stored on the developer’s Mac Studio; an external drive retains the latest 14 successful backup snapshots. Snapshots are not additionally encrypted. Account records and meal photos used to improve the model are kept while you retain your account and cleared during account deletion. Report evidence in the live service is kept for 30 days and cleared upon resolution; older backups expire through snapshot rotation. We do not sell personal data, use Apple Health data for advertising, or run advertising trackers on these pages.
Your choices and contact
You can keep local records without signing in. Manual recording remains available if you decline camera, photo, location, calendar or Health permissions. Revoke permissions in system settings, export personal records in the app, or delete your account. Visit the support page for privacy, correction, deletion requests and moderation appeals. The app and services are in beta and are not an emergency channel.