Privacy Policy

Last updated: 18 July 2026

Muscle Train (“we”, “the service”) is a training-program generator and workout tracker available at muscletrain.app. This page explains what personal data we collect, why we need it, and what control you have over it.

For any privacy question or request, write to [email protected].

What we collect

Account data

Your email address and username. If you register with a password, we store only a cryptographic hash of it — never the password itself. If you sign in with Google or Apple, we store the identifier that provider gives us instead of a password. We also keep your registration date and whether your email is confirmed.

Training profile

The details you enter so programs can be generated: age, sex, height, body weight, fitness level, training goal and available equipment.

Training data

Programs you generate or build by hand, completed workouts (exercises, sets, reps, weight, hold time, perceived difficulty, notes), body-weight entries, goals, 1RM test results and progression progress.

Feedback

If you use the feedback form: your message and its category, and — only if you choose to provide them — your email address and any screenshots you attach.

Technical data

Cookies (listed below) and standard server logs.

We do not collect payment data, we do not build advertising profiles, and we do not sell your data to anyone.

Cookies

Strictly necessary — always set, the site cannot work without them:

access_token — keeps you signed in (expires after 7 days)
csrf_token — protects forms against cross-site request forgery
cookie_consent — remembers your cookie choice
short-lived state cookies during Google / Apple sign-in

Optional — analytics cookies, set only if you agree. You can change or withdraw your choice at any time via “Cookie settings” in the footer.

Local storage — the sign-in page remembers which method you used last (mt_last_login_method) so it can mark it on the button. It stays in your browser, is never sent to us, and clearing your browser data removes it.

Profile photo

You can optionally upload a profile photo. It is resized and stored in Cloudflare R2 (object storage) and served over Cloudflare's CDN; the image URL is public, so anyone who has the link — or sees your photo in the app or the activity feed — can view it. We don't store the photo on our own server or in the database (only a reference to it). Remove it any time from your cabinet.

Activity feed

The app has an optional community feed. Sharing is off by default — your activity appears in the feed only if you turn it on (Feed page → “Share my activity”). When enabled, other signed-in users can see when you complete a workout, reach a goal, finish a program or advance a progression: your username, the item’s name and light details (e.g. exercise count, difficulty). We never put weights, body weight or other numbers in the feed. Turn sharing off any time to stop adding new events.

Third parties

Google — if you sign in with Google, Google provides us your email address and name. If reCAPTCHA is active on the feedback form, Google also processes technical signals to distinguish people from bots.
Apple — if you sign in with Apple, Apple provides your email address, which may be a private relay address.
Email delivery — our mail provider sends account-confirmation messages.
Hosting — our server provider stores the data.

These providers process data under their own privacy policies.

Why we process your data

to provide the service — generate programs and store your training history (performance of our agreement with you);
to keep accounts secure and prevent spam and abuse (our legitimate interest);
to send account-confirmation email (performance of our agreement);
optional analytics — only on the basis of your consent.

How long we keep it

We keep your data for as long as your account exists. Programs and logs you delete are marked as deleted and removed during routine cleanup. If you ask us to delete your account, we remove your personal data.

Your rights

view and correct your data directly in the app;
export your training history yourself as CSV — Progress → “Export progress”;
ask us to delete your account and data;
withdraw cookie consent at any time;
ask what data we hold about you.

Write to [email protected] and we will respond as soon as we can.

Children

The service is not intended for children under 16.

Changes to this policy

We may update this page; the “last updated” date above will change accordingly. Significant changes will be announced in the app.