PRIVACY POLICY — MUSCLE APP MOBILE APP

Last updated September 6, 2026

This Privacy Policy explains how Muscle App ("we," "us," "our") collects, uses, and protects your personal data when you use the Muscle App mobile application for iOS and Android (the "App"). We are committed to processing your data lawfully, fairly, and transparently, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish data protection law.

1. WHO WE ARE (DATA CONTROLLER)

The data controller responsible for your personal data is:

• Muscle App (Roberto Carrascoso Jordán)
• Madrid, Spain
• Contact: legal@muscleapp.fit

For any question about this policy or about how your data is processed, you can write to the email address above.

2. SCOPE OF THIS POLICY

This policy covers the mobile App. Our website at https://www.muscleapp.fit has its own Privacy Policy, which additionally covers website-only features such as trainer accounts, the public trainer marketplace, and payments. The App and the website share the same account and backend. Athletes use the mobile App; trainers manage their work on the website. The optional public athlete card is described in Section 8.6.

3. WHAT DATA WE PROCESS

3.1 Account data

When you create an account we process your email address, name, username, and (if you add them) your phone number and avatar image. If you sign in with Apple or Google, we receive the identifiers needed to authenticate you (see Section 9).

3.2 Health and fitness data

Depending on what you choose to record in the App:

• Body weight and body measurements
• Fitness goals
• Workout logs and training history
• Nutrition and meal logs
• Progress photos

This data can reveal information about your health and is treated as a special category of personal data. See Section 6.

3.3 Social data

If you use the social side of the App, we also process:

• Your workout posts: the caption and completed-workout summary you choose to publish
• The likes and comments you give and receive
• Your follow graph: who you follow, who follows you, and pending follow requests in both directions
• Your list of blocked users
• The notifications these actions generate (new follower, follow request, request accepted, like, comment)

Who can see each of these is explained in Section 8.

3.4 Messaging

If you are subscribed to a trainer, messages exchanged with that trainer through the platform are stored so we can deliver them and display your conversation history. If you block the other person, the conversation is deactivated and can no longer be used, but the messages already sent are kept.

3.5 Device and technical data

• App settings: your language, units, theme, and notification preferences.

4. DEVICE PERMISSIONS

The App asks for the following device permissions. All of them are optional — the App works without them — and you can change them at any time in your device settings:

• Camera: to scan food barcodes in the nutrition section and to take photos you choose to upload (avatar and progress photos). Barcode scanning happens on your device: only the barcode number is sent to the food database (see Section 9); camera frames are not stored or uploaded.
• Photo library: to pick images you choose to upload. We only receive the images you select.
• Notifications: for local reminders such as the rest timer and daily workout reminder. They are scheduled on your device and never leave it.

5. PURPOSES AND LEGAL BASES

We process your data for the following purposes, on the following legal bases:

• Providing the App (account, workout/nutrition tracking, social features, messaging): performance of a contract (Art. 6(1)(b) GDPR).
• Processing your health and fitness data (workouts, measurements, nutrition, progress photos): your explicit consent (Art. 9(2)(a) GDPR). See Section 6.
• Keeping the platform secure (authentication, abuse prevention): our legitimate interest in protecting the Services and their users (Art. 6(1)(f) GDPR).
• Complying with legal obligations (responding to lawful requests): Art. 6(1)(c) GDPR.

We do not sell your data. See Sections 7 and 9.

6. HEALTH AND FITNESS DATA (SPECIAL CATEGORY)

Data about your body, workouts, and nutrition can reveal information about your health. Under Article 9 GDPR, this is a special category of personal data and we process it only with your explicit consent, which you give when you choose to record this data in the App.

• You decide what health and fitness data you record. None of it is mandatory to have an account.
• If you subscribe to a trainer, that trainer can see the data needed to coach you while the subscription is in force (including the payment-overdue period before cancellation): your athlete profile, your workout sessions, your progress metrics and body measurements, and your nutrition targets and logs. When the subscription is no longer in force, that access ends.
• Your progress photos are visible only to you. They are not visible to your trainer or to any other user.
• You may withdraw your consent at any time by deleting the data in question or deleting your account (see Sections 12 and 13). Withdrawal does not affect the lawfulness of processing before withdrawal.

7. NO ADVERTISING OR BEHAVIORAL ANALYTICS

The App does not contain advertising attribution or behavioral analytics SDKs, does not access the device advertising identifier, and does not show third-party ads. RevenueCat processes purchase history for subscription metrics, receipt validation, and access management as described in Sections 9 and 10.

8. PROFILE AND CONTENT VISIBILITY

8.1 Your profile inside the App

Muscle App works like a social network. Anyone with an account can find your profile by searching for your username or your name, and see your profile card: username, name, profile picture, whether your account is private or public, your follower counts, and the number of your posts that this particular person is allowed to see. Note that your profile picture is stored in public storage: anyone holding the image URL can open it without signing in.

Other users cannot read your email address, phone number, or privacy settings. Making your account private does not hide the profile card or the follower counts; what it hides is the content: posts and workout statistics.

8.2 Private account and followers

• Relationships are follows, not friendships: following someone does not make them follow you.
• With private account on (Settings → Privacy), anyone who wants to follow you must send a request you accept or reject. Only accepted followers see your content. If you turn it off, every pending request is accepted automatically.
• Your follower and following lists are visible only to you. Other users see the counts only, never the names.
• When you follow someone or send a request, that person gets a notification with your username. You can unfollow, withdraw a request, or remove a follower at any time.

8.3 Post visibility

When you publish a post you choose who can see it:

• Public: anyone with a Muscle App account. If your account is private, this option is labelled "Followers" and only accepted followers can see it.
• My trainer only: only the trainer you are subscribed to with an active subscription.
• Only me: nobody but you.

No post is visible to people without an account. Likes and comments follow the visibility of the post.

8.4 Workout visibility

In Settings → Privacy you choose who sees your workout statistics (number of completed workouts, weekly streak, and activity calendar): Public, Followers only, or Private. If your account is private, being an accepted follower is required on top of that.

8.5 Blocking another user

You can block any user from their profile. When you block someone:

• Your conversation (if any) is deactivated: the messages already sent are kept, but neither of you can keep writing.
• Both follow relationships are deleted, in both directions.
• That person stops seeing your profile, posts, and statistics, cannot like or comment on your posts, and cannot follow you again. They stop appearing in your searches and suggestions.

Blocking does not notify the other person, and only you can see your own block list. If you unblock someone, the deleted follow relationships are not restored.

8.6 Public athlete card on the website (optional)

Your public athlete card is hidden by default, including for existing accounts. If you enable Settings → Privacy → Show my profile on the web in the mobile App and save, you authorize a page showing only your username and avatar, together with a link to the App. Anyone with the page URL can view it without an account.

The web card does not show your full name, workout activity, statistics, posts, follower counts, or health data. Your athlete activity stays inside the App under its existing visibility settings. You can withdraw this permission at any time by switching the same setting off and saving; this hides the web card without deleting your account or activity. This choice is independent of your private-account and blocking settings inside the App: a blocked person can still view a published web card without signing in.

Your avatar is already stored at a public image URL. Hiding the web card does not make that image URL private or remove copies someone may already have saved.

9. WHO WE SHARE DATA WITH

We share your data only with the service providers (processors) we need to run the platform:

• Supabase — database, authentication, and file storage.
• Google and Apple — only if you choose to sign in with your Google or Apple account (optional sign-in).
• Apple App Store, Google Play, and RevenueCat — to process in-app subscriptions and keep your entitlement status synchronized. We receive purchase status, product, store, and expiry information, not your full card details.
• Resend — delivers support and abuse-report emails. It receives the reporter's email address and the information needed to handle the report.
• Open Food Facts — when you scan a food barcode, the barcode number is sent to the Open Food Facts database to look up nutrition information. No personal data is sent with it.

These providers process your data under agreements (including the safeguards described in Section 11) that require them to protect it with the same or equal protection as described in this policy.

In addition, if you subscribe to a trainer, that trainer receives the data described in Section 6. Beyond that, the only data of yours that other users see is what Section 8 describes, and you control it through your privacy settings and the visibility of each individual post.

We do not sell your data. We may disclose data where required by law or to competent authorities under a valid legal request.

10. PAYMENTS

Athlete Premium purchases in the App are processed by Apple App Store or Google Play and managed through RevenueCat. Muscle App receives the store, product, purchase status, and entitlement dates needed to grant access, but does not receive or store your full card details.

11. INTERNATIONAL DATA TRANSFERS

Our service providers may process data outside the European Economic Area (EEA). Where that happens, the transfers are protected by appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (SCCs) entered into with those providers. You may request more information about these safeguards using the contact details in Section 1.

12. DATA RETENTION AND ACCOUNT DELETION

We keep your personal data while your account is active. You can delete your account directly in the App (Settings → Account). When your request is processed, we delete your account data and files from production systems. Database backup copies may remain for up to 7 days; files in Storage are not included in those database backups.

You can also request deletion by emailing legal@muscleapp.fit from the address associated with your account.

13. YOUR RIGHTS

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Restrict processing in the cases provided by law
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, email legal@muscleapp.fit. We may ask you to verify your identity before acting on a request.

If you believe your rights have been infringed, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): www.aepd.es.

14. LOCAL STORAGE (NO COOKIES)

The App does not use cookies. It stores your session and your app preferences locally on your device so you stay signed in and keep your settings. This local data is removed when you sign out or uninstall the App. The website's use of cookies is described in the Cookie Policy.

15. SECURITY

We apply technical and organizational measures appropriate to the risk, including encrypted connections (HTTPS), authenticated access, and database access rules that restrict each user's data to that user. No system is completely secure; if we become aware of a breach affecting your data, we will act in accordance with our GDPR obligations, including notification where required.

16. MINORS

The App is intended for people aged 18 or over. We do not knowingly process data of minors. If you believe a minor has created an account, contact us and we will delete it.

17. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where the change requires it, notify you through the App or by email and ask for your consent again where legally required.

18. CONTACT AND COMPLAINTS

For any privacy question, request, or complaint, contact: legal@muscleapp.fit

This policy should be read together with the App's Terms of Use.