1. Who we are

Braden Pty Ltd ("we", "us") operates Muscles, an AI workout generator, on the web and, when available, our Android app. This policy explains what we collect, why, who handles it, and what you can do about it. Questions: support@getmuscles.app.

2. What we collect

• Account: your email address and name, and your sign-in method (email and password, or Google).
• Fitness and health-related information you give us: goals, fitness level, equipment, body type and measurements, injuries or limitations, weekly workout frequency, workouts and results, nutrition entries, recovery and sleep entries, and progress photos. You choose what to enter. Treat it as sensitive: we do.
• Plan and billing status: your plan, its status and period, and your Stripe customer and subscription reference or, if you subscribe through Google Play, the purchase reference Google gives us, and any free Premium time on your account (the 7-day trial every new account gets, or invite months). We never see or store your card number; Stripe or Google takes it.
• Invites: if you join through a friend's invite link, we record that they invited you, so we can give each of you the free Premium time the invite offers.
• Usage counts: how many AI generations you have used, so we can apply your plan's allowance.
• App activity (signed-in members): a few actions, such as opening the upgrade page, choosing a plan, returning from checkout, and sharing a workout or invite link, and, for a new account, the campaign link it first arrived from (for example utm_source=reddit) or the site that linked to us (kept in your browser and sent only if you create an account). We use this only to see which of our posts bring members and where the app can improve. Page views by visitors are counted by Vercel Web Analytics without cookies.
• Shared workouts: if you share a workout, anyone with its link can see that workout (name, description, exercises and settings), not your name, email or other details.

3. How we use it

To run your account, build and save your workouts, show your progress, apply your plan, take payment, answer support requests, keep the service secure and prevent abuse. We do not sell your information.

4. AI features

When you ask for a workout or another AI answer, our servers (not your device) send a prompt to our AI provider, currently Alibaba Cloud Model Studio (Qwen models), and return the answer to you. If it is unavailable, the prompt may go to a backup provider instead: Moonshot AI, Groq or OpenAI. The prompt contains what you asked for and the parts of your profile it needs (for example level, goals, equipment and any limitations you entered). It does not contain your name or email address. AI answers can be wrong and are not medical advice: see our Terms.

5. Who handles your information

• Supabase stores your account, data and files (a private storage area, with access limited to you) and signs you in. Our database is hosted in Sydney, Australia.
• Vercel serves the website.
• Stripe processes subscription payments on the web, and Google Play processes subscriptions bought in our Android app, when available.
• Alibaba Cloud Model Studio generates AI answers, with Moonshot AI, Groq and OpenAI as backups, as described above.
• Google provides sign-in if you choose it and, only if you allow it, advertising measurement (section 6).

These providers may process information outside Australia. They act for us under their own terms. We may also disclose information where the law requires it or to protect safety.

6. Advertising measurement (Google), only if you allow it

If you click Allow on the notice, we add Google's advertising tag to the pages you visit. It sets cookies and tells Google about your visit, and about a completed subscription, so we can see which ads work. If you click No thanks, or do not choose, the tag is never loaded. You can change your choice here at any time.

Your choice now: not allowed. Change my advertising choice

7. How long we keep it, and deleting it

We keep your information while your account exists. You can delete your account yourself from the Delete Account page: your profile, workouts, entries and photos are erased straight away and your sign-in is removed. Stripe and Google keep their own payment records for as long as the law requires.

8. Your rights

You can ask us to give you a copy of your information, correct it or delete it, and you can delete it yourself as above. Email support@getmuscles.app. If you are in Australia and are not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the European Economic Area you also have the rights of access, rectification, erasure, portability and objection under the GDPR, and the right to complain to your data protection authority.

9. Security

Connections are encrypted. Each account can read and change only its own rows, your files are private and shared by short-lived links, and payment card details never reach us. No system is perfectly secure.

10. Children

Muscles is not directed at children. If you believe a child has given us information, email support@getmuscles.app and we will delete it.

11. Changes

If we change this policy we will update the date above and, for a material change, tell you in the app or by email.

12. Contact

Braden Pty Ltd, support@getmuscles.app.