Privacy by design
Your code is outside the product boundary.
Repset needs coarse session timing and your chosen movement preferences. It does not need the content of your work.
The local-first boundary
Prompts, source code, repository context, transcripts, raw IDs, and camera frames do not cross this boundary.
Collected locally
- Pseudonymous HMAC session key and coarse event time/type
- User-selected duration, modality, difficulty, quiet-office preference, exclusions, reduced motion, and Pip visibility
- Activity ID, completion method, optional rep count, points ledger, and weekly summary
Never collected by Repset
Camera lifecycle
The browser asks only after “Use camera.” MediaPipe runs in a Web Worker from bundled model and WASM assets. Frames are not recorded, persisted, or sent to a server. Tracks, workers, and canvases are released on completion, cancellation, error, or route exit.
Optional GPT-5.6 payload
Only continuous work duration, break count, recent approved activity IDs, available duration, quiet-office and standing/seated preferences, difficulty, and user-defined exclusion tags are eligible. Requests use strict structured output, store:false, and a privacy-preserving safety identifier. Raw model output is not persisted.
Retention and reset
Local data remains until reset or removal. Normal points history is append-only. An explicit full reset deletes the local database; public demo reset clears only versioned demo state. A future Vercel deployment may produce standard infrastructure logs, distinct from Repset product data.