Passwords and sessions
Passwords are bcrypt-hashed. Login tokens are stored hashed and expire after 30 days. Changing your password signs out other devices; "Log out everywhere" does it on demand.
Product
Repyra is one web app that behaves like a phone app under 900 px and a desktop app above it. Here is each part, honestly, including the limits.
Daily plan
Your split comes from the days per week you can train and the muscle you care about most. Then each day is adjusted: skipped Tuesday? Felt sore? Protein low all week? The volume and the note change.
If the AI is unavailable, a rule-based planner builds the same structure (warm-up, five to seven exercises, cardio, cool-down). You never open the app to a blank day.
Workout mode
Tap Set done and the rest countdown starts from the rest time in the plan. It beeps at 3-2-1 and vibrates at the end. Weight and reps steppers are prefilled from last time.
When you did every set at the top of the rep range, you get a specific suggestion for today's weight. Beat your best set or estimated 1RM and you get a PR toast. Finish and you get confetti, because you earned it.
Food
235 built-in Indian and gym foods, Gujarati dishes included, with aliases in regional names. Pick a food, set the portion with the stepper, watch the macros update, add it to the right meal. Your frequent foods float to the top after a few days.
Packaged food: scan the barcode (Open Food Facts lookup). Restaurant thali: take a photo and let the AI estimate, then edit anything that looks wrong. Meals you repeat can be saved and added in one tap, and the AI can build a day of meals for your targets.
Exercise guide
Every exercise opens a guide. 3D: a rigged human model performing the movement with the working muscles glowing; rotate, zoom, front/side/top, change speed. 2D: a side-view diagram of the start and end positions. Poster: a 1080×1350 card with steps and common mistakes to download or share. Video: search YouTube, or paste a link to pin a video to that exercise on your account.
The library has all 40 moves with search and a muscle filter. The 3D model needs internet the first time; after that it is cached on your phone.

Progress
Weight log with a 14-day table and streak. Personal records per exercise. Body measurements: weight, waist, chest, arm, thigh, hip, neck and body fat, with a change summary and a waist chart.
Progress photos are stored in a private folder on the server, re-encoded with camera and location data removed, and only you can open them. Compare any two side by side. 16 badges are computed from what you really logged, not from opening the app.
Coach chat
"Is this pain normal?" "What do I eat at a wedding?" "Can I train legs twice this week?" The coach answers with your profile, today's plan and today's food in front of it, in English, Gujarati or Hindi.
It is not a doctor and it will say so. For pain that lasts, it tells you to see a physiotherapist rather than inventing a diagnosis.

Reminders
Water every N hours inside a window you choose, until the target is hit. Workout at your gym time on training days only. Meal logging at 9, 13 and 20 if nothing has been logged. Monday weigh-in. A 21:00 "still time today" nudge when the day is short.
They show as toasts while the app is open and as system notifications after you tap Enable notifications. On iPhone that works after installing to the Home Screen.
For gyms
An owner creates the gym with a one-time platform code and gets an invite code for members. Members who sign up with it belong to that gym only: a different gym never sees them.
Trainers see each member's last seven days of workouts and protein, assign a Monday-to-Sunday program, create one-time password-reset links for members without email, and get a measurement summary. Owners can also change roles, disable members and rotate the invite code.

Privacy and security
Passwords are bcrypt-hashed. Login tokens are stored hashed and expire after 30 days. Changing your password signs out other devices; "Log out everywhere" does it on demand.
Re-encoded on upload with EXIF and GPS removed, capped at 1280 px, stored outside the web root, streamed only to you (or a trainer you have allowed).
Your profile, today's log and the text or photo you send are passed to the AI provider to produce the plan, estimate or reply, then the answer is checked and normalised before you see it. Keys never leave the server.
Owners and trainers of your gym see training and nutrition summaries and measurements. Photos only if you turn on sharing. Nobody outside your gym sees anything.
Profile has Data export (a ZIP with everything, photos included) and Delete account (password plus the word DELETE). No form, no waiting period.
HTTPS with HSTS when hosted, a strict content security policy, no third-party trackers on the app. The full details are in the privacy policy.
What it needs
Nothing exotic, but a few things only work on a secure address.