Privacy policy
Version 1, in effect since 06/11/2026
This policy explains, in plain language, what data Repace uses, what for, with whom, for how long and how you exercise your rights. It applies to the Repace app on iPhone and Android and to the repaceapp.com site.
1. Who looks after your data
The controller (the company that decides how your data is used) is AR TOUR LTDA, a single-member limited company, CNPJ 34.321.028/0001-42, owner of the Repace app and this site. Contact: privacidade@repaceapp.com.
The data protection officer (the person who handles requests from you and from Brazil's National Data Protection Authority, the ANPD) is Artur Fernandes Moreira, by email at privacidade@repaceapp.com (LGPD, art. 41).
2. Where Repace stands today
Repace is still being tested, before it reaches the App Store and Google Play. Today the app handles sign-up, the account and the profile. This version describes only what the app and the site already do. Features that do not exist yet (for example, saving runs on the server, the feed, races, supporters, SOS and paid plans) only start using data after a new version of this policy that says what each one uses and with which companies.
3. Summary
- Your account data stays in Brazil, on a server in São Paulo.
- We never sell your data and we show no ads.
- You download a copy of your data and delete your account inside the app.
- Teenagers' data is never used for advertising.
- This site uses no cookies.
4. The data the app uses today
The legal basis is the reason Brazil's LGPD accepts for using each piece of data: performance of the contract (the service you sign up for when you create the account, art. 7, V); legal obligation (the law requires it, art. 7, II); legitimate interest (an interest of Repace that does not override your rights, art. 7, IX); consent (your permission, separate for each purpose).
| Data | What for | Legal basis | How long |
|---|---|---|---|
| @, name, photo, city and state, bio and Instagram @ | your Repace profile | performance of the contract | while the account exists |
| Email and password | signing in and receiving account codes and notices | performance of the contract | while the account exists; the password is never stored as text |
| Phone number | confirming by code that the account belongs to a person and preventing fake accounts | performance of the contract and legitimate interest (security) | while the account exists |
| Date of birth and the age range provided by the phone's store (Apple or Google) | applying the minimum age and the rules for teenagers | legal obligation (Law 15.211/2025) | while the account exists |
| Running accessibility feature, only if you select one | counting your runs correctly | your specific consent (sensitive data, art. 11, I) | until you unselect it or delete the account |
| Emergency contacts: name and phone number of up to 3 people you add | keeping the contacts you chose, for the invitation you send yourself through your WhatsApp | legitimate interest | until you remove the contact or delete the account |
| Your permissions, with the date and the version of the text | proving what you accepted and respecting what you turned off | legal obligation | while the account exists |
| Who you follow, who follows you and who you blocked | following people and blocking | performance of the contract | while the account exists |
| Devices and sessions | keeping you signed in and showing where the account is open | performance of the contract | while the account exists; ended sessions, 6 months |
| Access logs (date, time and IP address, the number of your internet connection) | complying with the law and investigating abuse | legal obligation (Marco Civil da Internet, art. 15) | 6 months, kept confidential |
| Reports and moderation decisions | moderation, appeals and the transparency report | legal obligation and legitimate interest | while the account exists; afterwards, without your name |
| @ changes (the old @ and the date) | the limit of 2 changes every 14 days and holding the old @ for you | performance of the contract | 14 days |
| "It's me" request (the @ and the email you left) | answering the request for the @ held for you | legitimate interest | deleted after 30 days if the request does not go forward |
| Cryptographic summary of the device, phone number and email of banned accounts (no name, photo or other data) | preventing banned people from creating a new account to escape the ban | legitimate interest (security) | 5 years after the banned account is deleted; deleted earlier if the appeal is accepted |
The profile photo, once approved and stripped of the hidden data in the file (such as location), is kept at a public address, as on other social networks. With a private profile, the Instagram @ only shows to people you accepted.
5. Teenagers
- People under 13 cannot create an account, and none of their data is kept.
- From 13 to 15, the account is linked to a parent or guardian, who approves the link.
- From 13 to 17, everything starts in the most protective mode: private profile and features that show the person turned off.
- Teenagers' data is never used for advertising or to build a consumer profile.
6. Who we share data with
We never sell your data. The companies below process data on behalf of Repace, only for the contracted service:
| Company | What it receives | What for | Where |
|---|---|---|---|
| Supabase | account data | database, sign-in, files and backups | São Paulo, Brazil; system technical logs are kept in Europe |
| Twilio, with WhatsApp (Meta) | your phone number and the code | sending the confirmation code by WhatsApp or SMS | United States |
| Resend | your email address and the message text | sending code and account emails | United States |
| Cloudflare (Turnstile) | technical data about the device and connection, at the moment of the check | protecting sign-up against bots | global network |
| Vercel | technical data of site visitors, such as IP address and browser | hosting and delivering this site, and counting visits without cookies (section 11) | United States and global network |
| Google (Google Workspace) | the emails you send to Repace addresses | receiving and answering your emails | United States and global network |
The age range comes from the phone's own store (Apple or Google) to the app; Repace does not send your data to the store for this. The services that only alert the team when Repace goes down or gets close to a limit receive no data about app users. Authorities only receive data with a court order or when the law requires it.
7. Data that leaves Brazil
Some services in section 6 are outside Brazil. The LGPD only allows this transfer in the cases of art. 33. The basis for each company, today:
| Company | Basis for the transfer (LGPD, art. 33) |
|---|---|
| Twilio, with WhatsApp | the standard contractual clauses approved by the ANPD (art. 33, II, "b"; ANPD Resolution No. 19/2024) |
| Google (Google Workspace) | the standard contractual clauses approved by the ANPD (art. 33, II, "b"; ANPD Resolution No. 19/2024) |
| Supabase (system technical logs), Resend, Cloudflare and Vercel | the transfer needed to perform the service you asked for when you created your account or visited the site (art. 33, IX, with art. 7, V) |
Repace asks the companies that do not offer them yet for the ANPD standard clauses. When one of them starts offering them, the basis changes, in a new version of this policy.
8. How long we keep data and what happens when you delete your account
You ask for deletion in the app (Settings, Account, Your information, Delete my account) or by email, as explained on the Delete account page. The account disappears for others right away and you are signed out on all devices. You have 30 days to change your mind: just sign in again. On day 31, the account, your photo and all data linked to it are deleted, and you get an email confirming it.
Only what the law or people's safety requires is kept, without your name: access logs, for the 6 months the law requires; reports and moderation decisions, with a marker in place of your account, for the transparency report; what an authority asked us to preserve, until it confirms; and, if the account was banned, the cryptographic summary from section 4, for 5 years.
9. Your rights and how to exercise them
Under the LGPD, art. 18, you can at any time:
| Right | How to ask |
|---|---|
| Know whether we use your data and access it | Download my data, in Settings, Account, Your information: the link reaches your email within 7 days, one request every 30 days. By email, the full answer comes within 15 days (art. 19, II) |
| Correct data | in your own profile; the date of birth only through support, with proof |
| Take your data to another service | the same Download my data file |
| Delete your data and account | Delete my account or the Delete account page |
| Withdraw a permission | turn it off in Settings; it applies from then on |
| Know who we share data with | section 6 of this policy |
| Ask for review of a decision made only by automated means | at ajuda@repaceapp.com (art. 20) |
| Complain | to the data protection officer, at privacidade@repaceapp.com, and to the ANPD, at www.gov.br/anpd |
With a suspended or deactivated account, you can still download your data and ask for deletion. With a banned account, you ask for the copy or the deletion at privacidade@repaceapp.com. People without an account (for example, an emergency contact) ask at the same address.
10. Security and incidents
Data is protected by access rules in the database (each person only reads what is theirs), by strong passwords checked against lists of leaked passwords, by two-step verification and by access logs. If a security incident happens that may cause relevant risk or harm, Repace notifies the ANPD and the people affected within 3 business days, in plain language: what happened, which data, what has been done, what you can do and the data protection officer's contact.
11. This site
This site uses no cookies and stores nothing in your browser. It has no ads, no forms and asks for none of your data. Vercel, the company that hosts the site, processes technical connection data such as your IP address to deliver the pages and protect the site against attacks.
To count visits, the site uses Vercel's own measurement (Vercel Web Analytics), without cookies: it records the page visited, the site the person came from, country and region, device type, operating system and browser, and counts each visit by a summary of the request that is discarded after 24 hours, without storing the IP address. None of this is used for advertising. Legal basis: legitimate interest (knowing how many people visit the site).
Emails you send to ajuda@repaceapp.com, privacidade@repaceapp.com or juridico@repaceapp.com arrive through Google Workspace and are kept while the matter is open and for as long as the law requires for the case.
12. Changes and versions
Every change to this policy becomes a new version, with a number and a date, published at this same address. The version history is at the end of this page. When a change is important, Repace gives notice in the app and by email 30 days before the new version applies; the exception is a change the law requires sooner, when the notice comes with it, with the reason. A new purpose that depends on permission only starts after you give it.
13. Language
This policy is written in Portuguese. Translations are a courtesy; if there is any difference, the Portuguese text prevails.
14. Contact Repace
- Data protection officer: Artur Fernandes Moreira, privacidade@repaceapp.com
- Support: ajuda@repaceapp.com
- Legal matters, court orders and requests from authorities: juridico@repaceapp.com
- Company: AR TOUR LTDA, single-member limited company, CNPJ 34.321.028/0001-42
- Brazil's National Data Protection Authority (ANPD): www.gov.br/anpd
Version history
- Version 1, in effect since 06/11/2026: First published version.