PRIVACY POLICY

Last updated August 8, 2026

This Privacy Policy explains how Muscle App("we," "us," "our") collects, uses, and protects your personal data when you use our website and services at https://www.muscleapp.fit (the "Services"). We are committed to processing your data lawfully, fairly, and transparently, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish data protection law.

1. WHO WE ARE (DATA CONTROLLER)

The data controller responsible for your personal data is:

• Muscle App (Roberto Carrascoso Jordán)
• Madrid, Spain
• Contact: legal@muscleapp.fit

For any question about this policy or about how your data is processed, you can write to the email address above.

2. WHAT DATA WE PROCESS

2.1 Account data

When you create an account we process your email address, name, username, and (if you add one) your avatar image.

2.2 Athlete profile — health and fitness data

If you use the Services as an athlete, we may process, depending on what you record:

• Body weight and body measurements
• Fitness goals
• Workout logs and training history
• Nutrition and meal logs
• Progress photos

This data can reveal information about your health and is treated as a special category of personal data. See Section 4.

2.3 Messaging

Messages exchanged between athletes and trainers through the platform are stored so we can deliver them and display your conversation history. If you block the other person, the conversation is deactivated and can no longer be used, but the messages already sent are kept.

2.4 Payment data

Payments are handled by Stripe, our payment processor. We never store your card numbers. We keep only the information needed to manage your subscription (such as subscription status and Stripe customer references).

2.5 Trainer profile data

If you use the Services as a trainer, we process your professional profile: bio, experience, specialties, social media links, and the training plans and prices you offer. Trainer profiles are public — see Section 5.

2.6 Social data

If you use the social side of the app, we also process:

• Your posts: the text, any images you upload, and — if you choose so when posting — the summary of the linked workout
• The likes and comments you give and receive
• Your follow graph: who you follow, who follows you, and pending follow requests in both directions
• Your list of blocked users
• The notifications these actions generate (new follower, follow request, request accepted, like, comment)

Who can see each of these is explained in Section 5.

3. PURPOSES AND LEGAL BASES

We process your data for the following purposes, on the following legal bases:

• Providing the Services (account, subscriptions, messaging, trainer marketplace): performance of a contract (Art. 6(1)(b) GDPR).
• Processing your health and fitness data (workouts, measurements, nutrition, progress photos): your explicit consent (Art. 9(2)(a) GDPR). See Section 4.
• Processing payments and preventing fraud: performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).
• Keeping the platform secure (authentication, abuse prevention): our legitimate interest in protecting the Services and their users (Art. 6(1)(f) GDPR).
• Complying with legal obligations (tax, accounting, responding to lawful requests): Art. 6(1)(c) GDPR.

We do not use your data for advertising, and we do not sell your data. See Section 6.

4. HEALTH AND FITNESS DATA (SPECIAL CATEGORY)

Data about your body, workouts, and nutrition can reveal information about your health. Under Article 9 GDPR, this is a special category of personal data and we process it only with your explicit consent, which you give when you choose to record this data in the app.

• You decide what health and fitness data you record. None of it is mandatory to have an account.
• If you subscribe to a trainer, that trainer can see the data needed to coach you while the subscription is in force (including the payment-overdue period before cancellation): your athlete profile, your workout sessions, your progress metrics and body measurements, and your nutrition targets and logs. When the subscription is no longer in force, that access ends.
• Your progress photos are visible only to you. They are not visible to your trainer or to any other user.
• You may withdraw your consent at any time by deleting the data in question or requesting deletion of your account (see Sections 8 and 9). Withdrawal does not affect the lawfulness of processing before withdrawal.

5. PROFILE AND CONTENT VISIBILITY

5.1 Trainer profiles (public on the internet)

The following trainer profile information is not public by default:

• Contact details (phone / email): shown only if you enable the option in your profile settings (opt-in).
• Number of active clients: shown only if you enable the option in your profile settings (opt-in).

The legal basis for publishing your trainer profile is the performance of your contract with us: offering your services publicly on the marketplace is the core function of a trainer account. If you do not want a public profile, do not create a trainer account.

5.2 Your profile inside the app

Muscle App works like a social network. Anyone with an account can find your profile by searching for your username or your name, and see your profile card. This applies to every account, athlete accounts included. The card shows:

• Username, name, and profile picture
• Whether your account is private or public
• Your follower count and the number of accounts you follow
• The number of your posts that this particular person is allowed to see

Your account type (athlete, trainer, or both) and the date you signed up are not part of that card, but they are not hidden either: any signed-in user can read those fields of your account record.

Other users cannot read your account email address, your account phone number, or your privacy settings: read access to those fields was never granted to other signed-in users. The contact details a trainer chooses to publish are a separate, deliberate disclosure by that trainer — see 5.1. Note that your profile picture is stored in public storage: anyone holding the image URL can open it without signing in.

Making your account private does not hide the profile card or the follower counts. What it hides is the content: posts and workout statistics. See 5.3, 5.4, and 5.5.

5.3 Private account and followers

• Relationships are follows, not friendships: following someone does not make them follow you.
• If you turn on private account in Settings → Privacy, anyone who wants to follow you has to send a request, and you decide whether to accept or reject it. Only accepted followers see your content.
• If you turn the private account off, every pending request is accepted automatically.
• Your follower and following lists are visible only to you.Other users see the counts only, never the names. The same applies in reverse: you cannot browse somebody else's follower list.
• When you follow someone or send them a request, that person gets a notification with your username. The same happens when someone accepts your request.
• You can unfollow, withdraw a sent request, or remove a follower at any time.

5.4 Post visibility

When you publish a post you choose who can see it:

• Public: any user with a Muscle App account. If your account is private, this option is labelled "Followers" and only the followers you have accepted can see it.
• My trainer only: only the trainer you are subscribed to with an active subscription.
• Only me: nobody but you.

No post is visible to people without an account. Likes and comments follow the visibility of the post: whoever cannot see the post cannot see or add likes or comments on it either.

The photos in your posts are not stored in public storage. They are served through temporary signed links generated only for viewers who are already allowed to see the post, and those links expire: a link that leaks stops working.

5.5 Workout visibility

In Settings → Privacy you choose who sees your workout statistics (number of completed workouts, weekly streak, and activity calendar): Public, Followers only, or Private. If your account is private, being an accepted follower is required on top of that. Your trainer sees them while your subscription with that trainer is active.

5.6 Blocking another user

You can block any user from their profile. When you block someone:

• Your conversation is deactivated: the messages already sent are kept, but neither of you can keep writing.
• Both follow relationships are deleted, in both directions.
• That person stops seeing your profile, your posts, and your statistics. They cannot like or comment on your posts, and they cannot follow you again.
• You stop seeing their posts and their statistics. Their profile card stays reachable for you, so that you can undo the block.
• They stop appearing in your searches and suggestions.

Blocking does not notify the other person, and only you can see your own block list: nobody can find out who has blocked them. That asymmetry is deliberate. If you unblock someone, the follow relationships that the block deleted are not restored: you both have to follow each other again.

6. WHO WE SHARE DATA WITH

We share your data only with the service providers (processors) we need to run the platform:

• Supabase — database, authentication, and file storage.
• Stripe — payment processing and payouts to trainers.
• Google and Apple — only if you choose to sign in with your Google or Apple account (optional OAuth login).

In addition, if you subscribe to a trainer, that trainer receives the data described in Section 4. Beyond that, the only data of yours that other users see is what Section 5 describes, and you control it through your privacy settings and the visibility of each individual post.

We do not sell your data. We do not share it with advertisers. We do not use third-party analytics. We may disclose data where required by law or to competent authorities under a valid legal request.

7. INTERNATIONAL DATA TRANSFERS

Our service providers may process data outside the European Economic Area (EEA). Where that happens, the transfers are protected by appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (SCCs) entered into with those providers. You may request more information about these safeguards using the contact details in Section 1.

8. DATA RETENTION

We keep your personal data for as long as your account is active. If you ask us to delete your account, we will delete your personal data within a reasonable period, except for data we must keep to comply with legal obligations (for example, invoicing and tax records) or to establish, exercise, or defend legal claims.

To request deletion, email legal@muscleapp.fit from the address associated with your account.

9. YOUR RIGHTS

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Restrict processing in the cases provided by law
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, email legal@muscleapp.fit. We may ask you to verify your identity before acting on a request.

If you believe your rights have been infringed, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): www.aepd.es.

10. COOKIES

We use only essential cookies (session and payment security). We do not use analytics or marketing cookies. For full details, see our Cookie Policy.

11. SECURITY

We apply technical and organizational measures appropriate to the risk, including encrypted connections (HTTPS), authenticated access, and database access rules that restrict each user's data to that user. No system is completely secure; if we become aware of a breach affecting your data, we will act in accordance with our GDPR obligations, including notification where required.

12. MINORS

The Services are intended for people aged 18 or over. We do not knowingly process data of minors. If you believe a minor has created an account, contact us and we will delete it.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where the change requires it, notify you through the Services or by email and ask for your consent again where legally required.

14. CONTACT AND COMPLAINTS

For any privacy question, request, or complaint, contact: legal@muscleapp.fit

This policy should be read together with our Terms and Conditions and our Cookie Policy.