Privacy Policy
The short version: Your progress photos never leave your device. We don't sell your data. We don't share it with advertisers. MuscleTrack is built to help you, not to monetize your fitness journey.
1. Who We Are
MuscleTrack ("we," "us," or "our") is a mobile fitness tracking application available on iOS. This Privacy Policy explains how we collect, use, and protect information when you use the MuscleTrack app.
Contact: contact@muscletrack.app
2. Information We Collect
Information you provide directly:
- Name, age, height, weight, and fitness goals (entered during onboarding)
- Email address (used for Firebase Authentication)
- Workout logs, exercise sets, weights, reps
- Body measurements (circumference per muscle group)
- Body composition metrics (weight, body fat estimates)
- Progress photos (stored locally on your device only)
Automatically collected information:
- App usage data (anonymous crash reports via Firebase)
- Device type, iOS version, and app version (for crash diagnosis)
- Purchase and subscription status via RevenueCat (no card details — handled by Apple)
3. Progress Photos — Local Storage Only
Progress photos are stored exclusively on your device using iOS local file storage (getApplicationDocumentsDirectory()). They are never uploaded to our servers, never sent to Firebase, and never shared with any third party. If you delete the app, your photos are deleted with it. Back them up using iCloud or your preferred method.
4. Firebase Authentication
We use Firebase Authentication (provided by Google LLC) to manage user accounts. When you sign in, Firebase collects and stores your email address and authentication tokens. This is used only for account access and data sync across your devices.
Supported sign-in methods: Email/password, Sign in with Google, Sign in with Apple.
Firebase's privacy policy: firebase.google.com/support/privacy
5. Firestore Data Sync
Workout logs, muscle measurements, and body metrics are silently synced to Firebase Firestore after you log in. This enables backup and multi-device access. Data is stored under your user ID at the path users/{uid}/. Sync failures are silent — local data is always the source of truth.
Your Firestore data is accessible only to you (authenticated by your account).
6. RevenueCat — Payments & Subscriptions
MuscleTrack Pro subscriptions are handled through RevenueCat, which processes and manages in-app purchases via Apple's App Store. We never see or store your payment card information. RevenueCat receives your App Store receipt and subscription status.
RevenueCat's privacy policy: revenuecat.com/privacy
7. How We Use Your Information
- To provide and improve the MuscleTrack app
- To sync your data across devices when you're logged in
- To process subscription purchases and manage Pro access
- To diagnose crashes and fix bugs
- We do not use your data for advertising
- We do not sell your data to third parties
- We do not share your personal data with other users
8. Data Retention
Your account data is retained as long as your account exists. You can delete your account and all associated data at any time by contacting us at contact@muscletrack.app. Firebase Authentication and Firestore data will be permanently deleted within 30 days of your deletion request.
Progress photos stored locally on your device are deleted when you delete the app or manually remove them.
9. Children's Privacy
MuscleTrack is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at contact@muscletrack.app.
10. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and data
- Data portability (export your data)
- Object to certain uses of your data
To exercise any of these rights, contact us at contact@muscletrack.app.
11. Security
We implement industry-standard security practices. Firebase data is encrypted in transit (TLS) and at rest. Authentication tokens are stored securely using iOS Keychain. No system is 100% secure, but we take reasonable steps to protect your data.
12. Third-Party Services Summary
- Firebase Authentication — Google LLC — account sign-in
- Firebase Firestore — Google LLC — cloud data backup and sync
- Firebase Crashlytics — Google LLC — anonymous crash reporting
- RevenueCat — RevenueCat Inc. — subscription management
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top. Continued use of MuscleTrack after changes means you accept the updated policy.
14. Contact Us
If you have questions about this Privacy Policy or your data:
Email: contact@muscletrack.app