MuscleMemory — Privacy Policy

01 Who we are

MuscleMemory is built and operated by Pinekey, an independent mobile app studio, which is the data controller for the information described here. For any privacy question or request, contact pinekey.dev@gmail.com.

Privacy officer: Byunghun Lee (이병훈) — pinekey.dev@gmail.com.

02 Information we collect

Account and profile

• Anonymous guest identity. The app generates a random identifier on your device and sends it to our server to create your guest account. Our server stores it only as a one-way hashed value (SHA-256); the identifier itself is never stored or written to our logs. So that reinstalling the app brings back the same guest account, the app also keeps this identifier in your device's backup — Android Auto Backup and Google Block Store on Android, and the iOS Keychain on iOS. There is no other way to sign in, and no name, email, phone number, or password is involved.
• Profile settings. Your age range (10s, 20s, 30s, 40s, 50s, or 60+), your country (you choose it from a list, or choose "Other"; we do not detect your location), your preferred weight unit (kg or lb), and your preferred distance unit (km or mi). We also record when your account was created.

Workouts

• Workout records. For each workout you log: its start and end time, its duration, a title if you give it one, the exercises you did (chosen from the app's built-in exercise list), and for each set the weight, reps, duration, or distance you entered and whether you completed it. This is information about your physical activity.

Device and technical

• Push token. Your Firebase Cloud Messaging token, your device platform (Android or iOS), and — if the app reports it — your device language, so we can deliver notifications in your language.
• Crash reports. Collected by Firebase Crashlytics when the app crashes (see section 04).
• Ads data. When the app shows ads, the Google Mobile Ads SDK (Google AdMob) collects your IP address (used to estimate general location), device identifiers, your interactions with the app and its ads (such as app launches, taps, and the ads you have seen), and app performance and crash diagnostics. On Android the device identifiers are your advertising ID and app set ID. On iOS the app does not request permission to track you (App Tracking Transparency), so AdMob does not receive your advertising identifier (IDFA) and uses identifiers limited to our apps instead. In the EEA, the UK, and Switzerland, Google's consent message records your ad choices. See section 04.
• Server logs. Our servers record request logs — IP address, time, the requested address, your account ID when the app is signed in, and device headers such as the user agent — for security and troubleshooting.

How we use it

To run the service (keeping your guest account, saving and syncing your workouts, and remembering your settings); to compute popular-exercise rankings; to send notifications; to keep the service secure (for example, by limiting repeated requests); to fix crashes; and to show ads that keep the app free.

Popular-exercise rankings

Every hour we recompute which exercises are most popular — this week, by age range, and by body part — worldwide and for each country. We count exercises with at least one completed set in workouts from the last 7 or 28 days, grouped by the country and age range in each person's profile. Rankings contain only exercises and their rank: they never include your name, your account, your workouts, or how many people did an exercise, and a country's or age range's ranking is published only when enough different people have contributed to it. To show you the rankings for your country and age range, the app includes them in its request.

What other users see

Nothing that identifies you. MuscleMemory has no public profiles, friends, or social features; other people only see the aggregate rankings described above.

What we do not collect

MuscleMemory does not collect your name, email, phone number, or date of birth. It does not request location permission or collect your GPS location, and it does not access your contacts, photos, camera, microphone, or data in Apple Health or Health Connect. The only permission the app asks you for is to send notifications. The app contains no analytics SDK, and on iOS it does not ask for permission to track you across other companies' apps and websites.

03 How your data is stored

• Your account, profile, workout, and push-token data are stored in our PostgreSQL database on servers we operate on Amazon Web Services (AWS) in Seoul, South Korea. If you live elsewhere, your data is transferred there over encrypted connections. The database is encrypted at rest.
• Data between the app and our servers travels over HTTPS. Your device identifier is stored only as a one-way hash.
• On your device, the app keeps your workouts, settings, and sign-in tokens so you can log workouts offline; your workouts sync with our server when you are online.

Retention and deletion

We keep your data for as long as your guest account exists. Accounts are not deleted automatically when you stop using the app, and uninstalling the app does not delete the data on our server — use account deletion for that.

You can delete your account at any time from inside the app. This is a permanent, immediate deletion on our server, not a deactivation, and it cannot be undone.

Erased immediately when you delete your account:

• Your account record and your guest identity (the hashed device identifier).
• Your profile settings — age range, country, weight unit, and distance unit.
• All of your workouts, together with their exercises and sets.
• Your push notification tokens.

Rankings never store your data as such; from the next hourly update your workouts are no longer counted.

Deleting a single workout: its exercises and sets are erased from our server right away. A deletion record — the workout's identifier, start and end time, duration, and title — is kept so the deletion syncs correctly, until you delete your account.

Backups, logs, and crash reports: automatic database backups are kept for 7 days, server logs are kept for 30 days, and crash reports are kept by Firebase Crashlytics for 90 days. Your data can remain in these copies for that time. Data collected by Google AdMob is retained by Google under its own policies.

If you cannot use the in-app option — for example because you have already uninstalled the app — email pinekey.dev@gmail.com and we will help you delete your data.

Your choices and rights

You can turn notifications off at any time in your phone's settings. Where Google's consent message applies (the EEA, the UK, and Switzerland), you can change your ad choices at any time in the app under Settings → Ad privacy settings. On Android you can reset or delete your advertising ID in your device settings. You can also ask us to access, correct, export, or delete your data, or exercise other rights you have under the law where you live (for example in the EEA, the UK, Japan, or Korea), by emailing pinekey.dev@gmail.com. Where the law requires a legal basis, we rely on our agreement with you (providing your account, workout log, and sync), our legitimate interests (rankings, keeping the service secure, fixing crashes, and showing ads), your consent for notifications, and — in the EEA, the UK, and Switzerland — your consent for ads that use your data. You can also complain to your local data protection authority.

04 Third parties

MuscleMemory relies on the following services. We use one advertising network (Google AdMob) and no analytics services, and we do not sell your data.

Service	Purpose	Data involved
Firebase Cloud Messaging · Apple Push Notification service (iOS)	Push notifications — iOS and Android	FCM token and Firebase installation ID; on iOS, your Apple push token is passed to Firebase
Firebase Crashlytics	Crash diagnostics — iOS and Android	Crash stack traces, device model, OS and app version, session data, and technical identifiers (Crashlytics installation UUID, Firebase installation ID). Kept for 90 days.
Google AdMob (iOS and Android)	In-app banner ads, and Google's consent message in the EEA, the UK, and Switzerland	IP address; device identifiers (Android: advertising ID and app set ID; iOS: identifiers limited to our apps — no IDFA, because the app does not request tracking permission); interactions with the app and the ads you see; app performance and crash diagnostics — collected and shared with Google for advertising, analytics, and fraud prevention, and encrypted in transit
Amazon Web Services (AWS) — Seoul, South Korea	Hosting our server and database, and our server logs	All account, profile, workout, and push-token data, database backups, and server logs

Firebase (Google) and AWS process this data on our behalf as service providers. Google AdMob also uses the data it collects for its own advertising, analytics, and fraud-prevention purposes under Google's policies — see how Google uses information from apps that use its services. Apple and Google also distribute the app through their stores under their own terms and privacy policies.

05 Children's privacy

MuscleMemory is a general-audience fitness app and is not directed to children under 13. We do not ask for a date of birth — only an age range such as "10s" or "20s", which does not tell us your exact age — and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has used MuscleMemory, contact us and we will delete their data.

06 Changes to this policy

MuscleMemory is a new service, and this policy may change as the app is launched and evolves — for example, if we add a feature that collects new data. Updates will be reflected on this page with a new "Last updated" date.

07 Contact

Questions or requests, including access, correction, and deletion: pinekey.dev@gmail.com. To delete your account, the fastest route is the in-app option described in Retention and deletion.