Privacy Policy

MuscleIT (the app at app.muscleit.fit and the MuscleIT mobile app) is run by MuscleIT, a brand operated by David Willson John Britto, Madurai, Tamil Nadu, India ("we", "us"). Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for your personal data. For users in the EEA and the UK we are the "controller" under the GDPR and UK GDPR.

Questions about this policy: support@muscleit.fit.

• Account: your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your Google name, email and profile picture. You give us this at signup.
• Profile: date of birth, gender, height, weight, fitness goal, training type (Gym, Home or Both), workout days and preferred units (kg or lbs). Phone number and bio are optional. You give us this in onboarding and Profile.
• Training: your workout plans, weekly schedules, rest days, the exercises you pick or create, check-ins, sets, reps, weights lifted, streaks and progress history. These are created as you use the app.
• Subscription: trial start and end dates, plan, renewal date, payment status and the transaction reference from Google Play.
• Support: messages you send us and our replies.
• Technical: IP address, device and browser type, app version, error logs, sign-in timestamps and your push notification token. These are collected automatically from your device.
• Waitlist: if you join the launch waitlist on our website, including through the chat guide, your email address and your consent. We store the email encrypted and use it only to tell you when MuscleIT launches. You can ask us to remove it at any time at support@muscleit.fit.
• Website visits: when you open our website we count the page view. To tell whether the same device came back on the same day, we use a code made from your IP address and browser type that changes every day. We do not store your IP address or set cookies for this, and we do not follow you from site to site. We do not count visitors who send a Do Not Track or Global Privacy Control signal.

We never receive or store your full card or bank details, or the details of any payment app. Payments are handled entirely by Google Play.

• To run your account: sign you in, keep you signed in, and let you recover your account.
• To provide the app: suggest a starting weekly plan from your onboarding details, give coach prompts that help you push your reps and weights and stay motivated, send push notifications such as workout reminders, coach prompts and subscription notices (you can turn them off in your phone's settings), record check-ins, calculate muscle coverage and progress, and show the male or female anatomy model that matches the gender you choose.
• To manage your subscription: run the 7-day free trial, process payments, and show your renewal date.
• To support you: answer questions and handle deletion or correction requests, and send account emails such as verification, password reset and deletion confirmation.
• To keep the app safe and working: prevent abuse, fix errors, and protect accounts.
• To meet legal duties: keep tax and payment records and respond to lawful requests.

We process your data on the basis of your consent, which you give when you create an account, and for the legitimate uses the DPDP Act allows, such as complying with law. Plan suggestions and coach prompts come from rules built into the app. MuscleIT does not use any AI service, does not use your data for advertising, and does not send marketing emails.

We share data only with providers that help us run MuscleIT, and only what each needs.

• Supabase runs our database and sign-in, hosted in the United States. It holds your account, profile, training and subscription data.
• Vercel hosts the website and web app, and handles technical data.
• Google Play distributes the app and bills subscriptions. It shares subscription and payment status with us.
• Google Sign-In lets you sign in with Google if you choose. It shares your name, email and profile picture with us.
• Google Firebase Cloud Messaging delivers push notifications. It handles your push notification token and the notification content.
• GoDaddy provides our business email (support@ and no-reply@muscleit.fit). It handles your name, email and message content.
• Neon hosts the database of our website, which holds the launch waitlist. The emails are stored encrypted there.

We may also disclose data if applicable law, a court or a government authority requires it, or to protect someone's safety. If MuscleIT is ever sold or transferred, your data would move only under this policy and we would tell you first.

Your MuscleIT data is stored on Supabase servers in the United States, and some providers above may process data in other countries. They protect it with industry-standard security, and we do not transfer data to any country the Government of India restricts.

• Account, profile and training data: while your account is open. When you delete your account, we erase it immediately. Backups that contain your data are overwritten within 30 days.
• Subscription and payment records: for as long as tax and accounting law requires, even after you delete your account.
• Support messages: up to 12 months after your request is closed.
• Technical logs: for short periods, normally no more than 90 days.
• Inactive accounts: if you do not sign in for 3 years, we may delete your account. We will email you at least 48 hours before we do.
• Website visit counts: page views and the daily anonymous codes, for up to 90 days, then they are deleted.

Under the DPDP Act you can:

• Access a summary of the personal data we hold about you and who we have shared it with.
• Correct or update inaccurate or incomplete data. Most of it you can edit yourself in Profile.
• Erase your data by deleting your account (see Delete your account and data).
• Withdraw consent at any time, as easily as you gave it. Withdrawing means we can no longer provide the app to you, so we will close your account.
• Raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.
• Nominate someone to exercise these rights for you if you die or become unable to.

To use any right, email support@muscleit.fit from your registered email address. We will reply within 30 days, and never later than 90 days.

If you are in the EEA, the UK or California, you have more rights. See sections 13 and 15.

• Name: David Willson John Britto
• Email: grievance@muscleit.fit
• Address: Madurai, Tamil Nadu, India

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.

Passwords are hashed, data travels over encrypted connections (HTTPS), and database access rules make sure each account can only read its own data. No system is completely secure. If a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.

MuscleIT has no minimum age, but the law in many countries treats anyone under 18 as a child. If you are under 18, you may use MuscleIT only with the consent and supervision of a parent or legal guardian. We process a child's data only to provide the app, never for tracking, behavioural monitoring or advertising. A parent or guardian can ask us to access, correct or delete a child's data at support@muscleit.fit.

We use only what is needed to keep you signed in and remember your settings. We do not use advertising or tracking cookies. On your phone, MuscleIT asks only for permission to send notifications. It does not access your camera, photos, location, contacts or health data from other apps.

The chat guide on our website stores no chat messages and sets no cookies. Its answers are written in advance, not generated by AI. The only thing it can save is the email address you choose to enter for the waitlist.

If we make a material change, we will tell you in the app or by email before it takes effect. The date at the top shows the latest version.

If you are in the European Economic Area (EEA), the United Kingdom (UK) or another place with similar laws, we need a legal basis to use your personal data. These are the ones we rely on:

• To provide the app (account, profile, training and subscription data): we need it to carry out our contract with you, the Terms you accept when you sign up.
• Health-related details (such as weight, height, date of birth and training history): these can count as health data. We use them only with your explicit consent, which you give when you enter them. You can withdraw it at any time by editing or deleting the data, or by deleting your account.
• Push notifications and the launch waitlist: your consent. You can turn notifications off in your phone settings, and you can ask to leave the waitlist at any time.
• Payments and records: we must keep some records to meet tax and accounting laws (a legal obligation).
• Support, security and fixing errors: our legitimate interest in answering you, keeping accounts and the service safe, and making the app work well. You can object to this (see section 13).
• Counting website visits: our legitimate interest in understanding how many people use the website. You can object, or send a Do Not Track or Global Privacy Control signal and we will not count you.

If you are in the EEA or the UK, you have these rights over your personal data. To use any of them, email support@muscleit.fit from your registered email address. We will reply within one month.

• Access a copy of the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Erase your data. You can delete your account in the app, or ask us by email.
• Restrict how we use your data while a question about it is settled.
• Object to uses that are based on our legitimate interests.
• Data portability: ask for the data you gave us in a common, machine-readable format.
• Withdraw consent at any time, as easily as you gave it. This does not affect what we did before you withdrew it.
• Complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). We would be glad if you contacted us first at support@muscleit.fit.

We do not make decisions about you by automated means that have legal or similarly significant effects. Plan suggestions and coach prompts come from rules built into the app, and you can change any plan yourself.

MuscleIT is run from India. Your data is stored on Supabase servers in the United States, and some of the providers in section 4 may process it in other countries.

When personal data from the EEA or the UK is sent to a country that does not have an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) or the EU-US Data Privacy Framework, as our providers offer them. You can ask us for more information about these safeguards at support@muscleit.fit.

If you live in California, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you extra rights. This is how they apply to MuscleIT. Other US states have similar laws, and we handle those requests in the same way.

What we collect

In the last 12 months we collected these categories of personal information:

• Identifiers: name, email address, IP address, device and push notification token.
• Customer records and commercial information: subscription status, trial and renewal dates, and the Google Play transaction reference.
• Internet and device activity: device and browser type, app version, error logs and sign-in times.
• Sensitive personal information: your account sign-in details (the password is stored only as a secure hash) and the health-related details you enter, such as weight, height and training history.
• Other information you give us: date of birth, gender, fitness goal, training plans, check-ins and support messages.
• Inferences: things worked out from your training, such as your muscle coverage and progress.

We collect this from you, from your device, and from Google if you sign in with Google. We use it for the reasons in section 3.

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use sensitive personal information for anything beyond providing the app. We have not sold or shared personal information in the past 12 months.

Your California rights

• Know what personal information we collect, use and disclose, and ask for a copy.
• Delete personal information we collected from you, with some exceptions the law allows.
• Correct personal information that is wrong.
• Opt out of the sale or sharing of your personal information. We do not sell or share it, so there is nothing to opt out of.
• Limit the use of sensitive personal information. We only use it to provide the app.
• Not be treated unfairly for using these rights.

To use these rights, email support@muscleit.fit from your registered email address. We may need to confirm your identity first. An authorised agent can make a request for you with your written permission. We reply within 45 days.

Support: support@muscleit.fit · Grievances: grievance@muscleit.fit · Madurai, Tamil Nadu, India