1. Data Controller
The Musku app is operated by:
- Julien Legrand, sole proprietor based in Lille (France)
- Email: email@musku.app
For any question regarding this policy or your personal data, please contact us at the email above.
2. Data we collect
2.1 Data you provide directly
- Account: email, password (hashed)
- Profile: first name, last name, gender, date of birth, height, weight, experience level, goal, target training frequency
- Body measurements: weight, body fat, chest, shoulder, waist, hip, arm, thigh and calf circumferences, with their date, collected with your explicit consent and shown only to track your progress. Musku produces no diagnosis and no medical advice; this data is neither shared with third parties nor used for advertising. It can be synced with Apple Health on iPhone or Health Connect on Android, if you allow it.
- Workout data: sessions, sets, reps, loads, durations, notes
- Exercises you create: exercises you add to your account
2.2 Automatically generated data
- Activity data: last activity date (
last_active_at) - Technical data: app version, device type (iOS or Android)
2.3 Data via third-party services
- Sign in with Apple: anonymous Apple identifier, first name and (relayed) email, only if you use this sign-in method
- Sign in with Google: Google identifier, first name, last name and email, only if you use this sign-in method
- RevenueCat: RevenueCat user ID, subscription status (Premium or not)
- Brevo: email, first name, language, profile attributes, for transactional communication and newsletter
- PostHog (EU): anonymized events (screens viewed, actions performed) and a random device identifier, only if you accept on first launch (revocable anytime in Settings → Anonymous statistics). No health data is shared.
2 bis. Apple Health (iOS) and Health Connect (Android)
Musku can exchange data with your phone's health app: Apple Health on iOS, Health Connect on Android. Nothing is exchanged until you turn it on. The app's settings offer two separate switches, which you can enable independently and turn off at any time.
Your workouts
Musku writes your completed workouts: workout type, date, duration and an estimate of the energy burned. It never reads them back, as it already keeps its own history.
Your measurements
This exchange goes both ways.
Musku writes the measurements you enter: your weight, your body fat and, on iOS only, your waist. Health Connect has no circumference data type, so that measurement stays inside Musku on Android.
Musku reads those same measurements to fill in the days you did not log yourself, for example a weight recorded by a connected scale. A value you entered in Musku is never overwritten, and measurements Musku wrote itself are ignored when reading.
Imported values are saved to your account, and therefore sent to our servers, exactly as if you had typed them in. That is what lets them appear on your charts and follow you from one device to another.
In every case
None of this data is shared with third parties, used for advertising, or sold. Musku provides no medical diagnosis or advice.
You can stop this exchange whenever you like, from the app's settings, or from your phone: on iOS in Settings → Health → Data Access & Devices → Musku, on Android in Settings → Health Connect → Musku.
3. Purposes
Your data is used to:
- Provide the workout-tracking service (sessions, progress statistics)
- Filter and order the content shown to you (generic workout templates matching the level and goal you declared). These templates are identical for every user with the same filter: they are not drawn up based on your personal situation
- Manage your Premium subscription and payments (via Apple In-App Purchases or Google Play Billing, and RevenueCat)
- Contact you for transactional information or, with your consent, for the newsletter
- Improve the service (anonymized error and performance analysis)
4. Legal basis (GDPR)
- Contract performance: providing the service you chose to use
- Explicit consent (GDPR art. 9(2)(a)): declared health data, namely your body measurements and body fat. These fields are optional: you can use Musku without filling them in, and you can edit or erase them at any time from the app, which withdraws your consent.
- Consent: newsletter, push notifications, anonymized usage statistics, website analytics cookies (all revocable at any time)
- Legitimate interest: service security, fraud prevention
5. Retention
- As long as your account is active
- On account deletion: your personal data (profile, body measurements) is deleted immediately. Your email is anonymized. Your workout data may be retained anonymized for aggregate statistics.
6. Your rights (GDPR)
Under the General Data Protection Regulation, you have the following rights:
- Access: get a copy of your data
- Rectification: correct inaccurate data (directly in the app or via email)
- Erasure: delete your account (Settings → Delete account) or write to email@musku.app
- Portability: receive your data in a readable format
- Objection: to processing based on legitimate interest
- Restriction: temporarily restrict processing
You may also file a complaint with the French CNIL if you believe your rights are not being respected.
7. Subprocessors and third-party services
We use the following services to operate Musku:
- OVH (France): API and database hosting
- Apple (Ireland/USA): Sign In with Apple authentication, In-App Purchases, push notifications
- Google (Ireland/USA): Google sign-in, Google Play Billing payments, push notifications, and Health Connect if you enable the sync
- RevenueCat (USA): subscription management
- Brevo (France): transactional emails and newsletter
- PostHog (EU): anonymized usage statistics (only with your consent)
Transfers outside the EU are governed by EU Standard Contractual Clauses or the Data Privacy Framework.
8. Security
- HTTPS encryption on all communications
- Passwords stored hashed (
bcrypt) - Secure, revocable API authentication tokens
- Rate limiting on authentication attempts
9. Cookies (website)
The mobile app does not use cookies.
The website.musku.app site sets cookies that are strictly necessary for it to work (including storing your consent choices); these do not require your agreement.
It also uses Google Tag Manager to load audience-measurement tools. Those trackers are only activated after you consent through our consent banner (Sirdata platform). You can change your choices at any time via the "Cookie settings" link in the footer.
The site also loads a third-party hosted resource (Google Fonts, for typography), which therefore receives your IP address.
10. Changes
We may update this policy. Any substantial change will be notified to you in the app. The last update date is shown at the top of this page.
11. Contact
For any question: email@musku.app