Privacy Policy
MuscleMap requires an account. This explains exactly what we collect, where it lives, and who can ever access it — which, by design, is only you.
Last updated
1. The short version
MuscleMap requires an account. Your email address (used to sign in) and your training data — workout history, favourites, settings, program progress, and bodyweight log — are stored in our database, provided by Supabase, Inc., our backend provider, and protected by row-level access rules enforced by the database itself: your account can only ever read or write its own row, never another user’s. We do not sell your data, and we do not use cookies, third-party analytics, or advertising trackers of any kind. The only other data that ever leaves your device is payment information, which goes directly to our payment processor, Stripe — never to us — and the small set of anonymous, non-cookie usage counts described in Section 6, which cannot identify you.
2. Information we collect
Creating and using an account means we collect:
- your email address, used to sign in and for essential account communications, such as a password-reset link;
- a securely hashed version of your password, generated and verified by our authentication provider — we never see or store your password in plain text;
- your training data: workout history, exercise choices, sets, reps, and weights logged, bodyweight entries, favourites, saved routines, program progress, and app preferences;
- basic billing metadata if you subscribe to a paid plan (see Section 5) — never your full payment card number.
3. Information we do not collect
We do not collect, and have no access to:
- your device’s location, contacts, photos, or other device data;
- browsing activity outside the app;
- your full payment card number (see Section 5).
4. Where your data is stored
Your account and training data are stored in a database hosted by Supabase, Inc. Access is restricted by row-level security rules enforced by the database itself, not just by the app’s code — your account can only ever read or write the row that belongs to it. You can export a full backup at any time (Settings → Export backup), erase your training data (Settings → Erase everything), or request deletion of your account entirely by contacting us at musclemap.dev@gmail.com.
A copy of your own training data is also kept in the browser you are using, in its local storage, so that sets logged where there is no signal — most gyms — are not lost if you close the app before the connection comes back, and so the app still opens on your own data when our server cannot be reached. Alongside it we keep the plan your account was last on, so a subscription still works offline. Both are copies of your own data and nothing else, neither leaves that device except to sync back to your own account, and both are deleted when you sign out.
5. Payment information
If you subscribe to a paid plan, your payment details are collected and processed directly by Stripe, Inc., our payment processor. We receive confirmation that a payment succeeded and basic billing metadata (such as the plan and renewal date) — never your full card number. Stripe’s handling of your payment data is governed by Stripe’s own privacy policy.
6. Anonymous usage analytics
MuscleMap records a small number of anonymous usage events — for example, which screen was opened, or that a checkout was started — so we can see which parts of the app people actually use and improve it. Each event carries a random identifier generated in your browser and stored in its local storage, never a cookie, and it is never linked to your account, your email, or anything else that could identify you.
We do not use any third-party analytics service (such as Google Analytics), web beacons, fingerprinting, or advertising trackers of any kind, and this usage data is never sold or shared with anyone.
7. Children’s privacy
MuscleMap is not directed at children under 13, and we do not knowingly create accounts for, or collect personal information from, anyone under 13. If you are a parent or guardian and believe your child under 13 has created an account or provided us with personal information, contact us at musclemap.dev@gmail.com and we will delete it.
8. Your choices and rights
You are in control of your data: export it any time as a backup file (Settings → Export backup), erase your training data (Settings → Erase everything), or request deletion of your account and all associated data by contacting us at musclemap.dev@gmail.com. If you are in a jurisdiction that grants you specific data rights (such as the EU’s GDPR or California’s CCPA), contact us at the same address with any request or question.
9. Changes to this policy
We may update this Privacy Policy from time to time; the "Last updated" date above will change when we do. If a future version of the Service changes what data we collect, we will update this policy before that change takes effect and seek any consent required by law.
10. Contact us
Questions about this Privacy Policy or your data? Email us at musclemap.dev@gmail.com.