Privacy Policy

Website integration notice: Cloudflare serves this website and its media proxy. Supabase handles website authentication, account data and the existing waitlist. Browser storage retains functional language/theme preferences, authentication state and a pending referral with a seven-day validity window, cleared on the next referral-enabled visit. The new contact delivery handler is disabled until its server-side provider and rate limiter are configured. External hosting telemetry settings have not been verified.

Musclory ("we", "the app") respects your privacy. This policy explains what we collect, why, and your choices. This policy explains data processing; it does not replace consent where consent is required.

Who is responsible

The controller for the personal data described here is:

Commercial operator: Farah Makhlouf, sole trader, trading as Musclory, Dresden, Germany.

1. Information we collect

• Account: email and display name you provide at sign-up (or via Google/Apple sign-in).
• Profile & body details: your username, and the answers you give during setup or later in Settings: date of birth, sex, height, weight, goal weight and weekly rate, training goal, experience and diet. They are used to calculate your calorie and macro targets.
• Fitness data: workouts, sets, weights, the gym name you type, body measurements, progress photos, nutrition and water logs, goals, the data you enter to use the app. Progress photos are private unless you choose to show one on your profile.
• Social content: posts, comments, photos, videos, messages, voice messages and stickers you choose to share, and whether you appear online (you can hide this in Settings).
• Coach applications: if you apply to become a coach, the certificate and ID photos you upload and your WhatsApp number. The photos are stored privately and only reviewed by our team.
• Coach and partner payouts: if you choose to be paid by bank transfer, PayPal or crypto, the details you enter for it (name, account number, bank, PayPal email, wallet network and address) and a record of each payment we send, with its receipt. Our team reads them only to send your money.
• Payments: crypto payment is no longer offered. For crypto payments made before October 2026 we keep the plan, amount, currency, the transaction hash that was submitted and its status. For coaching subscriptions, the duration and price.
• Device tokens: a push-notification token so we can deliver notifications.
• Diagnostics: error reports (the error, the app version and the screen) linked to your account, so we can fix what broke for you. When an account is erased, its reports are kept with the link to the account removed.
• Health & fitness data from Health Connect (Android) or Apple Health (iOS), only if you connect it: steps, active energy burned, total energy burned and body weight are read, and completed workouts may be written back. The connection is off by default and requires your explicit permission.

2. How we use it

To provide and improve the app: save your training and nutrition, power your stats and coaching, deliver notifications and social features you opt into, and fix crashes. We do not sell your personal data.

2a. Health & fitness data

Not switched on in the current release. The Health Connect and Apple Health integration is built but disabled in this version of Musclory, so nothing is read from or written to either of them today. The section below describes what happens when the integration is enabled in a later release and you choose to connect it.

Health Connect / Apple Health data is used for one purpose only: to show your own activity inside the app, your step count and calories burned alongside the workouts and meals you log, so your daily energy balance is accurate. Workouts you complete in Musclory may be written back so your health app stays in sync.

• It is never sold, rented or shared with any third party, and never used for advertising.
• It is not used for any purpose other than the features described above, and never transferred for research, analytics or profiling.
• It is stored only in your own account on our backend, protected by the same row-level security as the rest of your data.
• You can revoke access at any time in Health Connect / Apple Health, or from Settings → Integrations in Musclory. Revoking stops all reading and writing immediately.
• Deleting your account deletes this data along with everything else.

3. Storage & security

Account data uses Supabase access controls. Public community content can be visible to other users; not every record is private. Access and retention details remain subject to verification. Past crypto payments were made on public blockchains from the payer's own wallet; we never received or stored card details or wallet keys.

Deleted and edited messages. When you delete a message for everyone, it stops being visible in the conversation straight away and the other person sees only that a message was deleted. You can also edit a message you sent for up to 20 minutes; the conversation then shows the new text marked as edited. In both cases a copy of what the message said before is kept for 30 days, readable by our moderation team alone, so that abuse and harassment reports can actually be investigated after the evidence has been changed or removed. After 30 days it is erased automatically by the same nightly job that erases deleted accounts. Nobody outside moderation can read it, including the person who sent it and the person who received it. For a photo, video or voice message, the file itself is deleted from our storage when you delete it for everyone; the 30-day copy keeps only the text.

Voice messages. The microphone records only while you hold the record button, or after you lock it to talk hands-free. A recording is uploaded only when you send it; if you cancel, or it is too short, it is deleted on your phone. Photos, videos and voice messages in a conversation are kept in private storage, and the app opens them with short-lived links only for the people in that conversation. Messages you sent stay in the other person's conversation if you delete your account, because they are part of their history.

Stickers. The photo you turn into a sticker is cut and framed on your phone, and uploaded only when you save the sticker. A sticker can be opened by anyone who has its link, because it is made to be sent and saved by others. Removing a sticker from your list, or deleting your account, does not remove copies already in conversations or in other people's sticker lists; your own list is deleted with your account.

Voice food search. When you search for a food by voice, your phone's own speech recognition (Google on Android, Apple on iPhone) turns what you say into text. Musclory receives only the text, never the audio.

4. Why we are allowed to process it

• To give you the app you asked for (Art. 6(1)(b) GDPR): your account, your workouts and meals, your routines, chat with a coach, and a subscription you buy. Without this data the app cannot do what you installed it for.
• Your consent (Art. 6(1)(a) and, for health data, Art. 9(2)(a) GDPR): training, body weight, body measurements, progress photos, nutrition logs and anything read from Health Connect or Apple Health are health data. We ask for that consent in the app before you enter it, and you can withdraw it at any time by deleting the data or your account. Withdrawing does not affect what we did before you withdrew.
• Our legitimate interests (Art. 6(1)(f) GDPR): keeping the service running and secure, investigating abuse reports, and fixing crashes.
• A legal obligation (Art. 6(1)(c) GDPR): keeping records we are required by German tax or commercial law to keep.

5. How long we keep it

• Your account and everything in it: until you delete it. A deleted account is hidden immediately, can be restored by signing in within 30 days, and is then scheduled for deletion. Some historical or legally required records may be retained. The retention details require legal verification.
• Deleted or edited chat messages: a copy of the previous text is kept for 30 days so an abuse report can still be investigated, readable only by our moderation team, then erased automatically.
• Error reports: kept while they are useful for fixing the problem; when an account is erased its reports stay with the link to the account removed.
• Payment records: kept while the account exists; erased with it. Where tax law requires a record to be kept, we keep only what the law requires.

6. Who else sees it

• Supabase - our database and file storage. Existing documentation describes the project as running in the EU (Ireland), the website also uses other processors; this does not establish that all data stays in the EU.
• Cloudflare - serves our website and delivers images and videos.
• Google (Firebase Cloud Messaging) - delivers push notifications. This means a device token reaches Google in the United States; the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework and on standard contractual clauses.
• Other users see what you choose to post - that is the point of the community features.

We may also disclose data where the law requires it. We do not sell your personal data, and we do not use it for advertising.

7. Your rights

Under the GDPR you can ask us for a copy of your data (Art. 15), to correct it (Art. 16), to delete it (Art. 17), to restrict how we use it (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where we rely on your consent you can withdraw it at any time. Most of this is one tap in the app: edit your profile, delete a post, export your data, delete your account. For anything else write to support@musclory.com and we answer within one month.

You also have the right to complain to a supervisory authority. Ours is:

Sächsischer Datenschutzbeauftragter
Devrientstraße 5, 01067 Dresden, Germany
datenschutz.sachsen.de

You may also complain to the authority where you live or work.

8. Children

Musclory is not directed to children. In the EU you must be at least 16 to use it, or younger only with the consent of whoever holds parental responsibility, where the country you live in allows that (some EU countries set the age at 13, 14 or 15). Elsewhere the minimum age is 13. We do not knowingly collect a child’s data, and if we learn we have, we delete it.

9. Contact

Questions? Email support@musclory.com.