Privacy Policy

This policy explains what Make My Muscle™ collects, why, who we share it with, where it is kept and the choices and rights you have, wherever you live. Effective date: 4 November 2026.

1. Who we are

Make My Muscle™ ("the app", "we", "us") is run by Muscle Mantra Projects Pvt Ltd, SCO 413-414, First Floor, Sector 35 C, Chandigarh, India. We decide how your personal data is used: we are the "data fiduciary" under Indian law and the "controller" under the EU and UK GDPR.

Contact: support@makemymuscle.com.

Grievance Officer: Aadit Sachdeva (support@makemymuscle.com, +91 95921 02114; SCO 413-414, First Floor, Sector 35 C, Chandigarh, India).

Users in the European Union and the United Kingdom can contact us directly at support@makemymuscle.com.

2. Who this policy covers and the laws we follow

The app is available worldwide; the shop is open in India only. This policy applies to everyone who uses the app, and these laws apply depending on where you live:

• India: the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000 where relevant.
• European Union and European Economic Area: the General Data Protection Regulation (EU GDPR).
• United Kingdom: the UK GDPR and the Data Protection Act 2018.
• United States: state privacy laws such as California's CCPA/CPRA and similar laws in other states (see section 10).

Where a law gives you more protection than this policy describes, that law applies.

3. What we collect

• Account: your name, username, email address and how you sign in (email, Google or Apple).
• Profile: gender, goal, training level, and your date of birth. We work out your age from your date of birth each time it is needed; we don't store your age.
• Body measurements: height, weight and weigh-ins you log, a goal weight if you set one, and any body measurements you enter (chest, waist, hips, arms, thighs and, optionally, body fat).
• Workouts: exercises, sets, reps, weights, durations, personal records and any notes you write on them (private to you), plus your favourite exercises, the workouts you build, and your streaks and badges (worked out from your workouts). Also any exercises you add yourself (a name, body part, equipment, how you log it and optional notes, private to you).
• Injuries or limitations you add (body area, side, how careful to be, dates and an optional note), used only to adjust your plans and, if you allow AI features, Mayhem's advice.
• Nutrition: foods and supplements you log (and how much, in the unit you chose), your own saved foods, supplements and recipes, your daily supplement list, calorie and macro targets, and any allergies you save.
• Community foods: foods you choose to share with everyone (name, brand, barcode and nutrition values). They are stored with your account ID so only you can change or remove them, but your name is never shown with them. If you delete your account they stay in the list for everyone, no longer linked to you.
• Run and walk: your location and route, only while you are recording a run or walk, plus distance, pace, steps (from your phone's motion sensor) and, if you allow it, heart rate from Apple Health or Health Connect. Heart rate is never shown to friends: it is kept with your own copy of the run, which only you can see. If you set a privacy zone, its centre stays on your phone and is never uploaded. Location is never collected in the background except while a run or walk you started is recording, and it stops the moment you finish. Indoor and treadmill sessions use no location: only the time, the distance, speed and incline you type, and steps from Apple Health or Health Connect if you connected them.
• Steps on Home: if you switch on step counting, today's steps and calories burned are read from Apple Health, Health Connect or your phone's motion sensor and stay on your phone.
• Apple Health (iPhone) or Health Connect (Android), optional: only the types you switch on, one by one. We can read steps, active energy, heart rate and body weight (and on iPhone, workouts from a watch or another app: only their times, so a session you also log here isn't counted twice), and save your finished workouts, runs and walks and the weigh-ins you log. What we read from Apple Health or Health Connect is shown in the app and stays on your phone. It reaches our servers only when you save it yourself: heart rate on a run or walk you save (kept private to you; heart rate is never shown to friends), weigh-ins you add to your weight log with Sync, or, if you join a weekly steps challenge, that week's daily step totals (see Weekly challenge below). Apple Health and Health Connect data is never used for advertising or sold, and never included in usage or crash reports.
• Photos: a profile photo, if you add one. Your profile picture, name and username can be seen by other signed-in Make My Muscle™ members, for example in search, friends lists, challenges and comments. You can change or remove it at any time in your profile. Progress photos (front, side, back), if you add them, are private to you: nobody else can see them, and location and camera details are removed from them before upload. Activity images you create are made on your phone and saved to your Photos only when you ask. The app opens your camera or photo library only when you choose to take or pick a photo.
• Notifications: workout reminders and rest-timer alerts are scheduled on your phone. If you allow push notifications (friend requests, challenges, kudos and comments, the weekly challenge), we store a notification token for your device with its platform and app version so we can send them, and your choice of which kinds you get. Notifications carry no health data. The token is deleted when you sign out or delete your account.
• Social: friends, friend requests, challenges, kudos and comments on friends' activities, likes, leaderboard numbers (weekly volume, workouts and streak) and workouts you choose to share.
• Shopping (India): your shopping region, basket and wishlist, saved delivery addresses (name, phone number, address and PIN code), and your orders (items, prices, delivery address, payment status and tracking). If you ask to be told when the shop opens in your region, your email address.
• Plans and Mayhem, our AI coach (our mascot, Mad Mayhem): plans you save. If you accept the AI consent, the messages you send Mayhem and a short summary (your goal, level and weight, today's workout and plan, today's food totals, the exercise you have open mid-workout and its sets, steps and calories burned, and your targets) are sent to answer you (see section 6). We keep a count of how many messages you sent each day, to apply the daily limit, but not the conversation itself. When you talk to Mayhem, your phone turns your speech into text (on iPhone, on the phone itself); only the text is sent, never a recording. The microphone is used only while you hold or tap the mic. Without the AI consent, or until AI features are switched on, Mayhem answers from the app on your phone.
• Meal photo estimates: if you accept the AI consent and use Snap a photo, the photo (made smaller on your phone first) is sent for analysis (see section 6) and is not kept by us. Only the foods you confirm are logged.
• Weekly #MakeMyMuscle challenge, if you join one: your display name and score on its leaderboard, which everyone signed in can see. For a steps week, your daily step totals for that week (from Apple Health, Health Connect or your phone's step counter; steps typed in by hand are not counted) are sent to our server to score you. For a distance week, our server scores the runs and walks you record in the app that week from their distance, time and GPS route, to check they weren't in a vehicle; routes are never shown to others. Leaving before the week ends removes your entry and those step totals. If you win, we contact you in the app or by email about the prize.
• Friend challenges: our server works out your score from your own workouts, runs, walks and food logs in the challenge window and shows it to the people in the challenge.
• App usage: we measure app usage to run and improve the service. When you open the app we note the time (at most once an hour) and the day, and our servers count totals such as sign-ups, workouts, food logs, runs and walks, challenge entries, orders and AI coach messages. These counts are for us only: no advertising, no third-party tracking, and we never sell them. Deleting your account deletes your part.
• Usage and crash reports (optional, off until you switch them on): which screens and features are used (for example that a workout was started or a product viewed) and, if the app crashes, a crash report with the device type and app version, through Google Firebase Analytics and Crashlytics. They never include your health data, name or email. You can switch them on or off in Settings › Privacy & consent.
• Safety and support: reports you make about other people's content, the people you block (visible only to you), and problem reports you send us, with your app version and device type.
• Device and technical data: what our service providers' servers see when the app connects (such as IP address, device type and app version), used to run and secure the service, including checks that requests come from the real app (Firebase App Check). We don't use advertising trackers.
• Our website counts page visits: the page, where the visit came from and any campaign tags. It uses no cookies and stores nothing that identifies you.

4. Health, fitness and location data: your explicit consent

Health and fitness data (body measurements, workouts, nutrition, heart rate and Apple Health or Health Connect data) and precise location are sensitive. We use them only with your separate, explicit consent, which is never bundled into agreeing to these terms:

• Health and fitness data: asked for on its own when you sign up. It is needed for the training and nutrition features.
• Precise location: asked for on its own the first time you start a run or walk. Optional.
• AI features (Mayhem and meal photo estimates): asked for on its own, naming Anthropic and exactly what is sent, the first time you use them. Optional.
• Mayhem's premium voice: asked for on its own, naming ElevenLabs, the first time it would read a reply to you, and only once we switch it on. Optional; without it your phone reads replies with its own voice.
• Apple Health / Health Connect: chosen type by type in Settings › Apple Health (iPhone) or Settings › Health Connect (Android). Optional. Switching a type off there stops us using it straight away; to remove the permission itself, use iPhone Settings › Health › Data Access & Devices › Make My Muscle™, or on Android the Health Connect app › App permissions › Make My Muscle™ (turning Health Connect off in the app removes its permissions too).

You can withdraw any of these at any time in Settings › Privacy & consent. Withdrawing doesn't affect what we did before. If you withdraw health and fitness consent, we stop using that data and you can delete your account.

5. Why we use your data, and our legal bases

We use your data only for these purposes. Under the EU and UK GDPR each one needs a legal basis, shown in brackets; under Indian law we rely on your consent or a legitimate use the law allows.

• To run the app you signed up for: your account, profile, training, plans, run and walk tracking, progress, friends and challenges (contract: we need it to provide the service).
• Health and fitness data, precise location, Apple Health / Health Connect and the AI features (your explicit consent, which you can withdraw).
• To work out targets and suggestions, such as calorie targets, plans and coach answers (contract; with health data, your explicit consent).
• To show your friends your weekly leaderboard numbers and what you choose to share with them, and, only if you choose, to show your stats to other users through a public profile or the global leaderboard (contract, and your choice in Settings › Social privacy).
• To handle shopping in India: your basket, orders, delivery and invoices (contract; keeping tax records is a legal obligation).
• To run the weekly challenge: score entries on our server, check for cheating, confirm the winner and deliver the prize (contract, under the challenge's official rules).
• To measure app usage and improve the service (legitimate interests: knowing how many people use which features helps us keep the app running and make it better; only totals leave our database, and you can object, see section 9).
• Optional usage and crash reports (your consent).
• To keep the service and the community safe: security, fraud and cheating checks, and reviewing reports of abusive content (legitimate interests, and legal obligations where they apply).
• To meet legal duties, such as tax law and lawful requests from authorities (legal obligation).

We do not sell your personal data, we don't "share" it for cross-context behavioural advertising, and we don't use it for advertising. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects; coach answers and targets are suggestions you can ignore.

6. Who we share it with

Our service providers process your data only on our instructions and under contracts that protect it:

• Google (Firebase and Google Cloud): sign-in, database, file storage, server functions, App Check, usage analytics and crash reports.
• Resend (email delivery): your email address and the content of account and support emails.
• Anthropic (Claude): for Mayhem, the AI coach, and meal photo estimates, only after you accept the AI consent and once AI features are switched on. Your messages and the short summary in section 3, or a meal photo, go to our own server and on to Anthropic's Claude API to produce the answer. Your name, email, phone number and location are not sent. Under Anthropic's commercial terms, what we send isn't used to train its models, and Anthropic deletes API inputs and outputs within 30 days by default (it may keep some longer only where the law requires or to enforce its usage policies).
• ElevenLabs: only once we switch on Mayhem's premium voice and you agree to it. When premium voice is on, Mayhem's reply text is sent to ElevenLabs to create audio: the text of his reply (nothing else about you) goes from our own server to ElevenLabs, and the audio comes straight back to your phone. We don't keep the audio. Without it, your phone makes his voice itself and nothing is sent.
• Razorpay: processes online payments in India. You pay on Razorpay's checkout, which opens inside our app; the card, UPI or bank details you enter go to Razorpay and never to us or the seller. Razorpay also receives your name, email address and phone number for the payment, and its checkout collects information about your device and how you use it, to process the payment and prevent fraud, under Razorpay's own privacy policy. We receive only the payment status and reference.
• Apple: if you use Sign in with Apple or connect Apple Health.
• Google Sign-In: if you sign in with Google.
• Google Health Connect: if you connect it on Android. It runs on your phone; the data stays there.
• Open Food Facts: when you scan or type a barcode that isn't in our own list, the barcode number (nothing about you) is sent to Open Food Facts, a free public food database, to look the product up.
• Speech recognition: when you talk to Mayhem, your phone's own speech service turns it into text. On iPhone, Apple's speech recognition turns it into text (on Apple's servers when you're online, on the phone when offline), under Apple's privacy policy. On Android it's your phone's speech service (usually Google's), which may send the audio to its provider to recognise it. We never receive the recording.

Others who receive data:

• Muscle Mantra Projects Pvt Ltd, the seller: when you place an order, your order details, name, phone number, email address and delivery address go to the seller so it can pack, ship, invoice and support your order (see section 14).
• Couriers: the seller gives the courier your name, phone number and delivery address so it can deliver.
• Your friends: your weekly leaderboard numbers (volume, workouts and streak) — you can turn this off in Settings › Social privacy — and anything else you share with them (for example runs set to "Friends", or workouts you share to their feed: exercise, sets, reps, volume and time, never your notes). Heart rate is never shown to friends.
• Other users: if you set your profile to Public, anyone signed in can see your stats and shared workouts; if you join the global leaderboard (off by default), your name, username and weekly numbers, visible to everyone signed in, including people you have blocked. In a weekly challenge, your display name and score on its leaderboard, and your name if you win.
• Authorities, when the law requires it, and a buyer of our business if it is ever sold (under this policy).

7. Where your data is stored, and international transfers

We are based in India and our providers store and process data in several countries:

• Your account and app data: Google Firestore in the European Union (multi-region eur3: Belgium and the Netherlands).
• Photos and exercise videos: Google Cloud Storage in the United States (us-central1).
• Our server functions (for example orders, scores and the AI coach): Google Cloud in India (Mumbai, asia-south1).
• AI features: Anthropic, in the United States; Mayhem's premium voice: ElevenLabs, in the United States; speech to text: Apple (iPhone) or your phone's speech service (Android).
• Account and support emails: Resend, in the United States.
• Payments: Razorpay, in India.

So your data is transferred outside India, and may be transferred outside the country where you live. From the EU, EEA and UK, transfers to India and the United States are protected by the European Commission's Standard Contractual Clauses (and the UK Addendum) in our providers' data processing terms, and by the EU-US Data Privacy Framework where a provider is certified. From India, the DPDP Act allows these transfers except to countries the Government of India restricts. You can ask us for a copy of the safeguards (section 9).

8. How long we keep it

• While your account is open, we keep your data so the app works.
• When you delete your account in the app, we delete your account and app data straight away.
• Copies in our providers' backups are overwritten within 30 days.
• Copies on your phone (basket, wishlist, cached catalogue, offline drafts) are removed when you sign out or delete your account.
• Orders: order records and GST invoices are kept for 8 years after the order, because Indian tax law requires the seller to keep them. They hold the order details and the name and delivery address used; your email address, phone number and the link to your account are removed from the order record when you delete your account. Invoices already issued are kept unchanged and show your name, delivery address and phone number. You can delete your account once any order in progress is delivered or cancelled.
• Usage totals (counts per day) don't identify anyone and are kept to compare over time.
• Reports other people made about your content are kept as moderation records.
• Apple Health / Health Connect: deleting your account doesn't remove anything already saved in Apple Health on your iPhone or Health Connect on your Android phone; you manage that in those apps.

9. Your rights

Wherever you live, you can:

• Access and download your data: Settings › Privacy & consent › Download my data gives you a copy in a common machine-readable format (JSON), which you can take to another service.
• Correct it: edit your profile at any time, or ask us.
• Delete it: Settings › Delete account. If you can't use the app, follow the steps at https://makemymuscle.com/account-deletion or email us from the address on your account. We delete it within 30 days and confirm by email.
• Withdraw consent at any time: Settings › Privacy & consent.
• Object to our use based on legitimate interests (for example usage measurement), or ask us to restrict how we use your data: email us and we will stop unless the law allows us to continue.
• Complain: to our Grievance Officer (Aadit Sachdeva, support@makemymuscle.com, +91 95921 02114, SCO 413-414, First Floor, Sector 35 C, Chandigarh, India; also in the app under Settings › Help & support). We acknowledge every complaint within 24 hours and resolve it within 15 days. Complaints about content showing nudity or sexual acts, or impersonating someone, are acted on within 24 hours.
• Nominate someone (India): you can name a person to exercise your rights if you die or can't act yourself. Email support@makemymuscle.com with their details.

You can also complain to a data protection authority: in India, the Data Protection Board of India; in the EU or EEA, the supervisory authority where you live or work; in the UK, the Information Commissioner's Office (ICO).

To use any right, write to support@makemymuscle.com from the email address on your account. We reply within one month (or sooner where your law requires), may ask you to confirm it's you, and never charge you or treat you differently for using your rights.

10. United States residents

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Texas):

• We collect the categories of personal information in section 3 (identifiers, customer records, commercial information, internet or other electronic activity, geolocation during runs and walks, health and fitness data, and inferences such as calorie targets; no audio recordings), from you and your phone, for the purposes in section 5, and disclose them only to the service providers and others in section 6.
• Sensitive personal information (account sign-in, precise location, health data) is used only to provide the service you asked for.
• We do not sell your personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months. We don't knowingly collect information from anyone under 18.
• You have the right to know, access, correct and delete your personal information, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information, and not to be discriminated against for using these rights. You may use an authorised agent. Email support@makemymuscle.com; we respond within 45 days. If we refuse, you can appeal by replying to our answer, and then contact your state's attorney general.

11. Security and breaches

We protect your data with access rules that let only you (and friends you choose) see it, encrypted connections, checks that requests come from the real app, and our providers' security. If a personal data breach happens, we will tell the Data Protection Board of India and affected users without delay, and within the 72 hours the Rules require; for users in the EU or UK, we will tell the competent authority within 72 hours where the law requires it, and you without undue delay if the risk to you is high.

12. Children

Make My Muscle™ is for adults aged 18 and over, everywhere. We check age from your date of birth when you sign up. If we find that an account belongs to someone under 18, we delete it and its data.

13. Not medical advice

Targets, plans, coach answers and product suggestions are general information, not medical advice. Talk to a doctor before starting a new training or diet programme, especially if you have a health condition, are pregnant or take medication.

14. Shopping

Products in the Marketplace are sold and shipped by Muscle Mantra Projects Pvt Ltd (registered address: SCO 413-414, First Floor, Sector 35 C, Chandigarh, India; GSTIN: 04AAKCM7344L1Z4; PAN: AAKCM7344L; FSSAI licence: 13017001000141). Payments are processed by Razorpay. The shop is open in India only; elsewhere you can ask to be told when it opens. For questions about an order, contact the seller's Grievance Officer: Aadit Sachdeva, support@makemymuscle.com, +91 95921 02114, SCO 413-414, First Floor, Sector 35 C, Chandigarh, India.

15. Changes to this policy

We will update this policy when the app or the law changes, and change the effective date above. If a change needs your agreement, the app will show you the new version and ask again.

16. Contact

Questions: support@makemymuscle.com. Grievance Officer: Aadit Sachdeva (support@makemymuscle.com, +91 95921 02114; SCO 413-414, First Floor, Sector 35 C, Chandigarh, India). This policy is governed by the laws of India, and the courts of Chandigarh, India, have jurisdiction, without affecting your right to complain to your data protection authority or to go to the courts where you live.