Privacy Policy

Draft version · last updated September 2026

The short version: your body photos never leave your device — they're not uploaded to us or anyone else. Your account email and your workout data sync to our database so they're safe across devices. Food photos go to Google Gemini only when you actively use food analysis, and we don't store them. We don't sell your data.

1. Who is responsible for your data

MuscleUp [legal entity name, address, Israel] is the controller of the personal data described here. Contact: privacy@muscleup.app.

2. What we collect, and why

Account

If you create an account, we store your email address and an encrypted password credential so you can sign in and sync across devices. We never store your password in plain text.

Your training data (synced)

When you're signed in, your app data is synced to our database so it isn't lost and can follow you to another device. This includes things like your onboarding answers (goal, experience, schedule, equipment, and body details such as height and weight if you entered them), your program and workout history, food-log entries, coach-chat history and app settings. We use it only to run and improve the Service for you.

Our database is hosted by Supabase, which processes the data on our behalf.

Payments

Payments are processed by our payment provider, PayPal, which receives your payment details directly. We receive only what's needed to manage your subscription (for example, its status and renewal date) — never your full card number.

3. Body photos — never uploaded

Progress photos are stored only on your device and are never uploaded. They are not sent to our servers, not synced to your account and not included in cloud backups we control. Deleting the app deletes them. Nothing is shared unless you tap Share yourself.

Because we never receive your body photos, we can't recover them for you if your device is lost or the app is deleted.

4. AI features and Google Gemini

AI features (currently in beta) — the coach chat and food-photo analysis — use Google Gemini with an API key you provide. Requests go directly from your device to Google.

Food photos are sent to Google Gemini for analysis only when you actively use the analysis feature, and are not stored by us.
Coach chat messages, along with a short summary of your plan so the coach can answer usefully, are sent to Google Gemini when you send a message.
Your Gemini API key stays on your device. It is never synced to our database and is never included in a data export.

Google's handling of these requests is governed by Google's own terms and privacy policy for the Gemini API. If you don't add a key, no data is sent to Gemini.

5. What stays on your device

Besides photos, the app keeps a local copy of your data on your device so it works offline. If you use MuscleUp without signing in, your data stays on your device only.

6. Who we share data with

We don't sell your personal data and don't use it for third-party advertising. We share it only with service providers that help us run MuscleUp, under contracts that limit their use of it:

Supabase — database and authentication hosting.
Our payment provider (PayPal) — subscription billing.
Google (Gemini API) — only for AI features you actively use, via your own key.

We may also disclose data if the law requires it.

7. International transfers

Our providers may process data outside your country (including outside Israel and the EU). Where required, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses. [Provider regions to be confirmed before launch.]

8. How long we keep it

We keep your synced data while your account is active. If you delete your account, we delete your synced data within 30 days, except where we must keep limited records (for example, billing records) by law.

9. Your rights

Depending on where you live — including under the Israeli Protection of Privacy Law and, for people in the EU/UK, the GDPR — you can ask to access, correct, export or delete your personal data, object to or restrict certain processing, and withdraw consent at any time. You can export your data and clear everything on your device from the app's Settings. To delete your cloud data too, email privacy@muscleup.app (in-app cloud deletion is coming). You also have the right to complain to your data-protection authority (in Israel, the Privacy Protection Authority).

10. Security

Data in transit is encrypted (HTTPS). Access to our database is restricted so each account can reach only its own data. No system is perfectly secure, but we work to protect your data and will notify you as required by law if a breach affects it.

11. Children

MuscleUp isn't intended for anyone under 16, and we don't knowingly collect their data.

12. Changes

If we change this policy, we'll post the new version here and tell you about significant changes in advance.

13. Contact

Privacy questions or requests: privacy@muscleup.app. Everything else: support@muscleup.app.