Privacy Policy

1. How Masheen Handles Your Data

Masheen is offline-first: you can log and track workouts on your device without an account, and that data is stored locally. When you create an account and go online, Masheen syncs your training data to our servers so you can back it up, use it across devices, and take part in social features such as the activity feed, clubs, rivalries, and leaderboards.

2. Accounts and Authentication

Creating an account is optional and enables cloud sync and social features. You can sign up with your email address (and a password) or with Sign in with Google or Sign in with Apple. When you use a social sign-in, we receive a unique identifier and, where you permit it, your name and email address to create your profile. We do not receive your social account password.

3. Information We Collect

3.1 Account & Profile Data

If you create an account, we store your email address, display name, and optional profile details (such as an avatar, bodyweight for DOTS scoring, and any bio you add). Some profile information and activity are visible to other users when you use the social features.

3.2 Training Data

When you are signed in, your workouts, routines, sets, personal records, streaks, and body measurements sync to our servers so they are backed up and available across your devices. You control what you share to the social feed.

3.3 Analytics & Crash Data

The App uses Firebase Analytics and Firebase Crashlytics to collect anonymous usage statistics and crash reports so we can fix bugs and improve the App. This may include device type, operating system version, app version, and general usage patterns. The Website uses Google Analytics 4 to understand aggregate visitor traffic (such as page views and referrers).

3.4 Subscription Data

If you subscribe to Masheen Pro, your purchase is processed by the Apple App Store or Google Play. We use RevenueCat to manage subscription status via an app user ID. We do not receive or store your card or payment details — those are handled entirely by Apple or Google.

3.5 Plan Codes on the Website

The workout plan builder on the Website can give you a short code that takes a plan to the App. To make the code we store the answers you gave the builder (goal, experience, training days, session length, equipment, focus areas, areas to work around, and unit), any exercises you swapped, and the builder's version. We do not ask for or store a name, an email address, or an account with a plan code. Anyone who has the code can open the plan. Plan codes are deleted 180 days after they are made.

4. How We Use Information

• Provide cloud sync, backup, and cross-device access to your training data
• Power social features: profiles, the feed, kudos, comments, clubs, rivalries, and DOTS leaderboards
• Improve app stability and fix crashes
• Understand aggregate usage to improve the App and Website
• Manage Masheen Pro subscription entitlements

5. Data Sharing

We do not sell, rent, or trade your personal information. Information is shared only with the service providers that operate Masheen — such as our hosting provider, Firebase (Google), RevenueCat, and, if you use them, Google and Apple sign-in — and only to the extent needed to provide the service. These providers are bound by their own privacy policies. Content you choose to post to social features (for example, a shared workout or a leaderboard entry) is visible to other users by design.

6. Health & Fitness Data

Masheen lets you track fitness-related data such as workouts, bodyweight, and body measurements, and can optionally read or write data through Apple Health / Health Connect with your explicit permission. We treat this data with care. Your health and fitness data:

• Is never sold or used for advertising
• Is used only to provide the features you use (tracking, analytics, and any social content you choose to share)
• Can be exported or deleted by you

7. Data Retention & Deletion

We keep your account and synced data for as long as your account is active. You can delete your account from within the App, which permanently removes your synced training data, profile, and social content (posts, comments, clubs you own) from our servers within 30 days. Locally stored data is removed when you uninstall the App. Content-moderation records (reports and blocks) are kept for up to 12 months to enforce our Terms and meet legal obligations. Anonymous analytics and crash data are retained according to our providers' standard retention periods (up to 14 months for Google Analytics). We may retain limited records where required to comply with legal, tax, or dispute-resolution obligations.

8. Security

We use reasonable technical and organizational measures to protect your information in transit and at rest. No method of transmission or storage is completely secure, but we work to protect your data and limit access to it.

9. Children's Privacy

Masheen is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe a child has provided us information, please contact us and we will remove it.

10. Legal Bases for Processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases of the GDPR:

• Performance of a contract — to create your account and provide cloud sync, backup, social features, and subscription entitlements.
• Consent — for optional Apple Health / Health Connect access and, where applicable, analytics; you can withdraw consent at any time.
• Legitimate interests — to keep the service secure, prevent abuse, moderate user content, and improve the App, balanced against your rights.
• Legal obligation — to comply with applicable law and respond to lawful requests.

11. International Data Transfers

We are based in Latvia (European Union), and our service providers — including Google/Firebase, Google Analytics, and RevenueCat — may process and store data on servers in the United States and other countries. Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. By using the App you understand your data may be processed in the United States.

12. Your Privacy Rights

Depending on where you live, you have rights over your personal data. Under the GDPR (EEA/UK) these include the rights to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority (in Latvia, the Data State Inspectorate).

Under the California Consumer Privacy Act (CCPA/CPRA), California residents have the rights to know what personal information we collect, to access and delete it, to correct it, and to opt out of its "sale" or "sharing." We do not sell or share your personal information, and we do not use it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

You can exercise most rights directly in the App (edit your profile, export your data, block or report content, or delete your account). To make any other request, email hello@musthaveappscorp.com; we will verify and respond within the timeframe required by law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be indicated by an updated revision date. Continued use of the App or Website after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact Must Have Apps SIA at hello@musthaveappscorp.com, or by post at Valguma iela 18 - 16, Rīga, LV-1048.