This Privacy Policy explains how Muhammad Saad Ullah ("we", "us", "our") collects, uses, stores, and protects information when you use the urmusclemate mobile application (the "App"). urmusclemate is a gym companion that lets you browse an exercise and anatomy library with demonstration videos, search exercises, scan a gym machine (by its printed code or by photo) to see what it trains, follow ready-made routines, and — if you create an account — log your workouts, earn XP, and compare weeks with friends. Logging, history, and import are offered on a free trial and then via an optional paid subscription (urmusclemate Pro).
We have written this policy in plain English. If anything is unclear, email us at saadmac09@gmail.com.
1. Who we are (data controller)
- Developer / publisher: Muhammad Saad Ullah
- App: urmusclemate (
com.khan.fitz) - Contact: saadmac09@gmail.com (support and privacy matters)
Muhammad Saad Ullah is the data controller for personal data processed through urmusclemate.
2. The short version
- You can **browse the exercise and anatomy library, watch videos, search, scan
a machine code, and view routines without an account** and without giving us
any personal data.
- We only collect personal data when you create an account.
- The data we collect is your **email address, a username, and the workouts
you log** — plus the small set of data described in Section 3 (XP, friends,
time zone). There is no password: you sign in with a one-time code
emailed to your address, which expires after a short time.
- The **"identify by photo" scanner sends the picture you take to our backend
and an AI provider to recognise the machine**. The photo is used only for that
recognition and is not stored. (The separate code-scan reads a printed
code entirely on your device.)
- The Regional leaderboard is opt-in: if you tap "Set my region", your
device converts one approximate location fix into a **city and country label
on-device** — only that label is stored, never your coordinates. Decline it
and the board falls back to your time zone.
- urmusclemate Pro is an optional auto-renewing subscription. Purchases are
processed by Apple/Google — we never receive your card or payment details;
we only keep a flag on your device of whether your subscription is active.
- We use no advertising and no cross-app tracking, and we **do not sell or
share your personal data** with third parties for their own purposes. Limited
product analytics may be used to understand how features are used — never to
identify you or to build advertising profiles.
- You can delete your account and all associated data at any time — from
inside the App or by request — and you can export your data as a file.
3. Information we collect
3.1 Information you provide
| Data | When | Why we need it |
|---|---|---|
| Email address | When you create an account / sign in | To create and secure your account, authenticate you, and send essential account emails (e.g. confirmation, sign-in codes) |
| One-time sign-in code | Every time you sign in | To verify that you own the email address. We email a numeric code that expires after a short time; the code itself is never stored by us after verification |
| Apple / Google sign-in (optional) | When you choose to sign in with Apple or Google | To create and authenticate your account. Apple or Google share the account email (and your name for Apple's first sign-in) with us; we never receive or store your Apple/Google password |
| Username (required) | Account creation or profile edit | Your public name on the friends board and the worldwide leaderboard. Unique — no two accounts share one — and limited to 3–24 letters, digits, or underscores |
| Profile picture (optional) | When you choose to set one in the App | We store the image in our private file storage and show it to you, to friends you accept, and next to your row on the leaderboards. You never have to set one, and you can remove it any time in the App |
| Workout logs | When you log a workout | Core feature: your training history. Includes the exercises performed, sets with reps / weight / RPE, the date and time, and optional free-text notes you add |
| Imported workout history | When you import data from another tracker (e.g. Strong or Hevy) | To bring your existing training history into the App. It is stored and treated exactly like workouts you log in the App |
3.2 Information we collect when you use an account
- Time zone — we store your device's IANA time zone (e.g. "Europe/London")
with your profile so that your daily XP and weekly streak are counted against
your own calendar day, not the server's. You can change it by changing your
device time zone; the App updates it when you next open it.
- Region (optional) — only when you choose "Set my region" on the Regional
leaderboard: one approximate location fix is converted on your device
into a city and country label (for example "Lahore, Pakistan"), and only that
label is stored with your profile. Your exact coordinates never reach our
servers and are never stored. You can decline, and you can change or revoke
location access at any time in your device settings.
- XP and level data — when you train, the App earns XP according to a fixed
formula (e.g. for completed workout sets, first workout of the day, streaks,
and one-time milestones). The amounts and dates of these events are stored
with your account so your level, streak, and milestone progress follow you
across devices.
- Friend relationships — when you add a friend by their username, we store
the connection between the two accounts, the state of the request (pending,
accepted, blocked), and the random 8-character code assigned to your profile.
Neither the username nor the code reveals your email address.
- Support reports (only if you send one) — when you use "Send feedback" in
the App, we receive the message you write plus minimal technical context to
help diagnose the issue: app version, platform (iOS/Android), operating system
version, device model, and a short in-memory log of recent app activity. You
can review and remove the log excerpt before sending. Reports are
rate-limited and are never sent automatically.
3.3 Information stored only on your device
The following are stored locally on your device (via AsyncStorage) and are never transmitted to us or to any server:
- Appearance / theme preference (light, dark, or system)
- Units preference (kilograms / pounds)
- Whether the gamification layer (XP, levels, streaks) is shown
- Your "available equipment" selection and any in-progress workout draft
- Your free-trial start date and subscription (Pro) status flag
If you delete the App, this on-device data is removed with it.
3.4 Camera and machine scanning
urmusclemate requests camera permission to help you identify gym equipment, in two ways:
- Scan a printed code — reads a printed code on a machine **entirely on your
device**; no image is captured, stored, or transmitted.
- Identify by photo — when you choose this, the photo you take is sent to
our backend and to a third-party AI image-recognition provider to
recognise the machine and show what it trains. The
image is processed only for that recognition and is not stored by us
or, per their commercial terms, retained by the provider. We do not access
your photo library.
To prevent abuse of the recognition service we keep a short-lived rate-limit record. It contains no raw IP address — only a one-way hashed identifier — and is automatically deleted within about two hours.
3.5 Subscriptions (urmusclemate Pro)
Everything in urmusclemate is currently free. If an optional auto-renewing subscription (urmusclemate Pro) is introduced in the future, purchases will be handled entirely by the Apple App Store / Google Play: we will never receive or store payment card or billing details, only a flag on the device of whether the subscription is active, and you will be able to manage or cancel it anytime in your App Store / Google Play account.
3.6 What we do NOT collect
We do not collect: precise location (your coordinates never leave your device — only the city/country label you choose to set is stored), contacts, your photo/media library, advertising identifiers, device fingerprints for tracking, health-kit / fitness-platform data, your payment card details, or browsing behaviour. urmusclemate contains **no advertising and no cross-app tracking SDKs**.
4. How we use your information
We use the information described above only to:
- Create, authenticate, and secure your account.
- Provide the core service — store and display your workout history,
statistics derived from it, XP, levels, streaks, milestones, and the
friends leaderboard.
- Send essential transactional emails (account confirmation, sign-in
codes). We do not send marketing emails.
- Maintain security and integrity — prevent abuse, debug, and protect the
service.
- Place you on the Regional leaderboard — using only the region label you
set, or your time zone if you have not set one.
- Understand how features are used — through limited product analytics
that do not identify you by name, email, or precise location.
- Comply with legal obligations where applicable.
We do not use your data for advertising, profiling for marketing, or automated decision-making that produces legal effects.
5. How your information is shared
We do not sell your personal data and we do not share it with third parties for their own purposes. We share data only with the **service providers that operate our service on our behalf**:
| Processor | Role | What they process | Safeguards |
|---|---|---|---|
| Supabase | Backend hosting, database and authentication (data processor acting on our instructions) | Your email address, username, time zone, workout logs, XP events, and friend relationships | Bound by a data processing agreement; data encrypted in transit and at rest; access controlled |
| AI image-recognition provider | Recognises gym machines for the "identify by photo" scanner | The photo you submit for recognition (transient — not stored) | Commercial API terms; submitted images are not used to train models or retained |
| Resend | Delivery of our transactional emails (one-time sign-in codes) | Your email address and the message content | Commercial terms and a data processing agreement; used only to deliver our emails |
| Analytics provider (when enabled) | Product analytics — how features are used | Anonymous usage events; never your workouts, email address, or precise location | Bound by a data processing agreement; used only to improve the App, never for advertising or cross-app tracking |
| Firebase (Google) | Static hosting for our public legal and support pages | None — these pages contain no user data | Governed by Google's privacy policy |
| Apple / Google | App distribution and in-app subscription billing | Your purchase/subscription with the store (we receive only an on-device active/inactive flag, never payment details) | Governed by the respective store's own privacy policy |
| RevenueCat (only if paid subscriptions are enabled) | Subscription management | A subscription identifier and purchase status — never your payment card details | Commercial terms and a data processing agreement; we will update this policy before any paid plan goes live |
These providers process data only to provide their service to us and are prohibited from using it for their own purposes. We only use the AI provider when you actively choose "identify by photo".
Your friends can see a little of your profile, and only by design: once a friend request is accepted, your friends can see your username, profile picture, level, training streak, and this week's XP on the shared leaderboard. They cannot see your workouts, sets, notes, or any other data. A pending request reveals only your username.
The worldwide leaderboard is public by design: every signed-in user can see the usernames, profile pictures, and this week's XP of everyone with XP that week, and your own row shows on it as well. A regional leaderboard shows the same public data limited to people in your area: if you set a region, that city/country label groups you with everyone who set the same label; if you have not set one, it falls back to your stored time zone. It is an approximate "around here" view — your exact coordinates are never used or stored. That is the point of a ranking. Your workouts, email address, and everything else remain private to you.
We may also disclose information if required by law (e.g. a valid legal request) or to protect the rights, safety, and security of our users, the public, or Muhammad Saad Ullah.
6. International data transfers
Our backend provider (Supabase) may store and process data on servers located outside your country, including in the United States. Where data is transferred out of the EEA or the UK, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum, where applicable). You may contact us at saadmac09@gmail.com for more information about these safeguards.
7. Data security
We take the protection of your data seriously:
- All data in transit between the App and our backend is encrypted using
HTTPS / TLS.
- Data stored in our backend is encrypted at rest.
- There are no passwords. Sign-in uses a **one-time code emailed to your
address** that expires after a short time; we never store a password and the
code is not stored by us after verification.
- Row-Level Security (RLS) is enforced at the database level so that each
user can access only their own data (and, by design, the small public
profile fields of their accepted friends) and never another user's.
No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard measures.
8. Legal bases for processing (GDPR / UK GDPR)
If you are in the European Economic Area, the United Kingdom, or another region with similar laws, we rely on the following legal bases:
- Performance of a contract (Art. 6(1)(b)) — processing your email
address, username, and workout logs to provide the account and logging
features you asked for.
- Legitimate interests (Art. 6(1)(f)) — keeping the service secure and
functioning, and preventing abuse. We balance these interests against your
rights.
- Legal obligation (Art. 6(1)(c)) — where we must process data to comply
with the law.
- Consent (Art. 6(1)(a)) — for the optional region label and camera access,
which you grant through your device's permission prompt and can revoke at any
time in your device settings.
9. Data retention
- We retain your **account data and workout logs for as long as your account is
active**.
- When you delete your account, your authentication record, profile
(including your username and profile picture), workouts, sets, XP events,
and friend relationships are permanently deleted (see Section 10).
Deletion cascades across our database immediately.
- The scan rate-limit record (a hashed identifier, never a raw IP) is
automatically deleted within about two hours, and any record tied to your
account is removed when you delete your account.
- Photos submitted to "identify by photo" are processed in memory for
recognition and are not stored.
- Your region label, if you set one, is stored with your profile until you
change it or delete your account. Location coordinates are never stored.
- Support reports are kept only for as long as needed to respond to and
resolve your report, and are removed with your account if you delete it.
- Routine backups, if any, are rotated on a short cycle and overwritten in the
ordinary course; residual copies in backups are removed within 30 days.
- On-device data (preferences, equipment selection, trial/subscription flag) is
removed when you uninstall the App.
10. Your rights and choices
10.1 Delete your account and data
You can permanently delete your account and all associated data at any time:
- In the App: go to Profile → Manage account → Delete account. This
immediately and permanently deletes your authentication record; your profile,
workouts, sets, XP events, and friend relationships are cascade-deleted with
it.
- On the web / by request: visit
https://urmusclemate.web.app/delete-account or email saadmac09@gmail.com
from the address tied to your account. We complete verified requests within
30 days (usually much sooner).
10.2 Export your data (portability)
You can download a copy of your account data and workout history at any time: in the App, use "Download my data" to export your workouts as a CSV file you can keep or move elsewhere.
10.3 Access, correction, and other rights
Depending on where you live (e.g. under the GDPR/UK GDPR, or the CCPA/CPRA in California), you may have the right to:
- Access the personal data we hold about you;
- Correct inaccurate data (you can edit your username and workout
entries directly in the App);
- Delete your data (see 10.1);
- Port your data (see 10.2);
- Object to or restrict certain processing;
- Withdraw consent for camera or location access (revoke it in your device
settings) at any time, without affecting prior lawful processing.
California residents (CCPA/CPRA): We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. You have the right to know, access, delete, and correct your personal information and to not be discriminated against for exercising these rights.
To exercise any right, email saadmac09@gmail.com. We will not discriminate against you for exercising your rights. You also have the right to lodge a complaint with your local data protection authority.
11. Children's privacy
urmusclemate is intended for users aged 13 and older. It is a general fitness/exercise app and is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact saadmac09@gmail.com and we will delete it.
12. No medical claims
urmusclemate provides general fitness and exercise information for educational and informational purposes. It does not provide medical advice, diagnosis, or treatment and makes no medical claims. Always consult a qualified professional before beginning any exercise program.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the App. Continued use of urmusclemate after an update means you accept the revised policy.
14. Contact us
Muhammad Saad Ullah Contact: saadmac09@gmail.com (support and privacy)
Privacy Policy: https://urmusclemate.web.app/privacy Terms of Service: https://urmusclemate.web.app/terms EULA: https://urmusclemate.web.app/eula Account deletion: https://urmusclemate.web.app/delete-account Support: https://urmusclemate.web.app/support