1. Scope and Data Categories
This policy applies to websites, apps, chat experiences, support channels, and subscription flows.
Collected data can include account/contact details, onboarding/profile data, health-related inputs, interaction history, billing metadata, device usage data, and support communications.
Where enabled and permitted by applicable law and your choices, Android advertising measurement can include the Google advertising ID, AppsFlyer installation ID, advertising click/referrer identifiers, IP address, installation/opening activity, and device/app technical information.
Where enabled and permitted, measurement also includes limited app-use milestones, such as whether a first workout was prepared, started or completed, and confirmed subscription purchases, renewals and refunds, with their event time, product and transaction references, amount and currency. A workout milestone records that an action occurred, not the workout's contents.
- Account and contact details
- Goal, level, equipment, preferred coaching style
- Injuries/soreness/sleep/energy you voluntarily provide
- Chat messages, generated workouts, check-ins, completion/skip state
- Subscription status and payment metadata
2. Health-Related and Sensitive Data
Some data (injury, soreness, recovery, wellness context) may be sensitive under applicable law.
Where required, explicit consent is used for processing health-related data voluntarily provided for personalization and safety adaptation.
3. Sources and Purposes
Data comes from your direct inputs, automatic service usage, payment/auth providers, and support channels.
Purposes include account/auth, AI coaching, personalization, billing, abuse prevention, security, support, and product improvement.
We use AppsFlyer and our analytics and advertising integrations to measure app installations, openings, limited app-use milestones and confirmed subscription transactions, understand advertising performance, and detect measurement fraud or duplicate events.
We may estimate your country from the network address received by our own server using a local country database. This does not use GPS or send your IP to the database provider. IP Geolocation by DB-IP (https://db-ip.com), licensed under CC BY 4.0. Unknown locations are handled restrictively; network country is not proof of residence or consent.
4. Legal Bases
Depending on jurisdiction, legal bases include contract performance, legitimate interests, legal obligations, and consent (including explicit consent where required).
5. AI Processing and Automated Decisions
AI systems may process your profile, recent activity, prior context, and check-ins to generate responses and workout suggestions.
Automated rules may be used for plan limits, abuse prevention, moderation, and safety controls.
6. Data Sharing
Data may be shared with processors and vendors used for hosting, payments, analytics, authentication, messaging, support, and AI infrastructure.
Where enabled and permitted, AppsFlyer may share installation and opening attribution data with our activated advertising partners, including Meta (Facebook and Instagram), TikTok and Reddit. Google also provides analytics and advertising measurement through Google Analytics (GA4/Firebase) and Google Ads.
For eligible app transactions linked to an original installation, our server sends confirmed purchase, renewal and refund events to AppsFlyer; TikTok receives its configured events through AppsFlyer. Meta and Reddit receive purchase conversions through their separate server integrations, while Google Analytics (GA4/Firebase) supplies the Google Ads conversion route. Other supported usage, renewal and refund events may be shared according to the active integration; not every event or data field is sent to every partner.
Our existing Meta and Reddit server integrations may use hashed account identifiers and, where available, hashed email addresses for matching. Hashing is not anonymization. AppsFlyer event reporting uses the installation identifier, event identifiers and technical information rather than your email address.
We are preparing an integration with OpenAI Ads (advertising in ChatGPT) to measure advertising effectiveness and detect duplicate conversion reports. This integration is not active, and we are not sending app conversion events to OpenAI Ads. This planned advertising use is separate from AI processing for coaching described above.
If enabled after the required disclosures and permissions, our server would share verified Android installations, account registrations, free-trial starts and initial paid subscriptions with OpenAI Ads. The planned data is limited to event identifiers, event type and time, mobile-app source, and verified amount and currency for a paid subscription. Event identifiers are not anonymous data.
The planned OpenAI Ads payload does not include email addresses, account identifiers used for matching, advertising IDs, your IP address, browser identifiers or workout milestones. It also excludes chat messages, workout contents, health inputs, payment-card details and store purchase receipts. We would update our disclosures and obtain the required permissions before adding other data or uses.
We do not send chat messages, workout contents, health inputs, payment-card details or store purchase receipts to these advertising measurement services. Payment providers process payment details separately to complete your purchase.
Data can also be shared where required for legal compliance, rights/safety protection, or corporate transactions.
7. International Transfers, Retention, and Security
Data may be processed outside your country; lawful transfer safeguards are applied where required.
Retention depends on data type and legal/operational needs. Data is deleted or anonymized when no longer required.
Administrative and technical controls are used, but absolute security cannot be guaranteed.
8. Your Rights
Depending on jurisdiction, rights can include access, correction, deletion, restriction, objection, portability, and consent withdrawal.
Device advertising-ID controls and previously recorded refusals remain respected. Acceptance of Terms is not itself consent to advertising tracking. Contact privacy support to exercise applicable rights.
Permission for another advertising partner, accepting Terms, or reading this policy is not permission to send events to OpenAI Ads. Before enabling this integration, we will require permission for OpenAI Ads advertising measurement and a way to withdraw it. We will not use a later permission to send events that occurred before it was granted; prior refusals remain respected.
You can contact privacy support at privacy@musclemadness.co to exercise these rights.
9. Delete Your Muscle Madness Account
You can permanently delete your Muscle Madness account and the product data linked to it from the app. This action cannot be undone.
When the in-app deletion succeeds, Muscle Madness immediately removes the account and associated profile, onboarding and health-related inputs, chats, generated or saved workouts, check-ins, completion history, subscription status, and account-linked product activity from active application storage.
If you cannot access the app, email privacy@musclemadness.co from the address linked to your account with the subject "Delete my Muscle Madness account." We may ask you to verify account ownership before deleting the data.
No ordinary account, profile, chat, or workout data is intentionally retained after deletion. We may retain only records required for legal, tax, payment-dispute, fraud-prevention, or security obligations for the applicable statutory period, then delete or anonymize them. Apple and Google may retain their own purchase records under their privacy and retention policies.
Deleting your Muscle Madness account does not cancel an active App Store or Google Play subscription. Cancel the subscription in the store first if you want to stop future renewals.
- Open the Muscle Madness app and sign in.
- Open the app menu and choose Settings.
- Select Delete account.
- Enter the account email shown in the confirmation dialog.
- Select Delete account again to permanently confirm the request.
10. Children and Policy Updates
Service is not directed to children unless a dedicated legally compliant flow is explicitly provided.
Policy may be updated over time; material updates should include a revised Last Updated date and required notice.