Privacy Policy

Last updated: August 22, 2026

1. Data controller

Musclelog is a workout tracking application developed and operated by Léo Sarrazin.

For any privacy-related question or request, you can contact us at: support@musclelog.org.

2. Data we process

2.1 Account data

Musclelog uses anonymous accounts. No email address or legal name is required to create an account. However, we do process certain technical data necessary to provide the service, including:

  • An internal user identifier (UUID);
  • An optional display name and username, if you choose to set them;
  • Registered device records and associated authentication credentials (stored as hashes);
  • Session tokens (stored as hashes);
  • Account recovery data;
  • Timestamps related to account and device activity (creation, last activity).

Even without an identity, some of this technical data may constitute personal data within the meaning of the GDPR depending on context (for example, an IP address associated with a session).

2.2 Workout data

Musclelog stores the training data you record, including:

  • Exercises: name, acronym, variants, aliases, custom entries you create;
  • Workout sets: weight, reps, variant, intensification methods, optional comment;
  • Date and time of each set.

This data is processed solely to provide the workout tracking functionality. Workout data may, depending on its nature and context, contain information that relates to your physical condition. Musclelog is not a medical device and does not provide health assessments.

2.3 Technical data

When the Musclelog app communicates with our server, our infrastructure may process:

  • Your IP address;
  • Request timestamps;
  • HTTP request metadata (method, path, response code);
  • Technical device information required for authentication and device management.

3. Purposes and legal basis

We process your data for the following purposes:

  • Providing the Musclelog application and syncing your training data;
  • Authenticating your account and managing authorised devices;
  • Enabling account recovery;
  • Allowing you to export your data;
  • Technical diagnosis and error resolution;
  • Security of the service;
  • Responding to support requests.

The legal basis for processing is the performance of the service you use (Article 6(1)(b) GDPR) and our legitimate interest in securing the service (Article 6(1)(f) GDPR).

4. No advertising, analytics or tracking

Musclelog does not use:

  • Advertising networks;
  • Analytics SDKs or telemetry services;
  • Marketing trackers or cookies;
  • Any third-party data sharing for commercial purposes.

Your data is never sold.

5. Hosting

The Musclelog server is hosted by IONOS. As an infrastructure provider, IONOS may technically have access to the server environment. Your data is not intentionally shared with IONOS for any purpose other than the provision of hosting infrastructure.

Hosting region: Centre de calcul Europe, IONOS.

6. Local storage

Part of your workout data is stored locally on your device. This local storage enables offline use and allows synchronisation when connectivity is restored. This data is under your control on your device.

7. Data retention

Account and workout data is retained for as long as your account is active, or until you delete your account (see section 8).

Technical server logs (HTTP access logs) are retained for a limited duration according to our operational policy. Automatic log rotation is not yet configured in the current infrastructure setup.

8. Account deletion

You can delete your account permanently and directly from the Musclelog app:

Profile → Delete my account

You will be required to confirm your password and recovery code. The deletion is immediate and irreversible.

If you no longer have access to your account or device, you can request deletion by contacting us at: support@musclelog.org. We may ask for reasonable proof of control of the account, adapted to the Musclelog anonymous account system.

For full details on the deletion procedure, see musclelog.org/delete-account.

What is deleted

Upon deletion, the following are permanently removed:

  • All devices registered to your account;
  • All active sessions;
  • Your authentication credentials (stored as hashes);
  • Your recovery credentials;
  • Your display name and profile information;
  • Free-text comments attached to your workout sets;
  • Other personal data associated with your account.

The account becomes permanently inaccessible. No credential permits recovery after deletion.

Account tombstone

A minimal account record (containing the account identifier, username, and technical timestamps) is retained after deletion solely to preserve the uniqueness of your username and prevent it from being claimed by another account. This record contains no credentials and no link to any retained workout data.

Structured workout data

Certain structured workout data (exercise, sets, weight, reps, variant, intensification methods) may be retained for aggregate statistical purposes and improvement of Musclelog. Before retention, this data is detached from the deleted account: its internal user identifier is replaced by a new random identifier that is not stored or mapped anywhere by Musclelog. Free-text comments are deleted at this stage.

Musclelog does not claim that retained workout data constitutes an absolute anonymisation guarantee under all circumstances. Exercise names you entered personally remain part of the retained dataset.

Server logs

Server infrastructure logs are not individually purged per account deletion. They are retained for a limited duration according to our operational policy. Automatic log rotation is not yet configured in the current infrastructure setup.

Data stored locally on your device can be removed by uninstalling the app or clearing its data from your device settings.

9. Your rights (GDPR)

Under the GDPR, you have the following rights:

  • Access: request a copy of your personal data;
  • Rectification: request correction of inaccurate data;
  • Erasure: request deletion of your data (see section 8);
  • Restriction: request limitation of processing in certain circumstances;
  • Portability: export your data — available directly from the Musclelog app;
  • Objection: object to processing based on legitimate interest, where applicable;
  • Withdrawal of consent: where processing is based on your consent.

To exercise any of these rights, contact us at support@musclelog.org. We will respond within the timeframe required by applicable law.

If you are located in France, you also have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés). Users in other EU/EEA countries may contact their national supervisory authority.

10. Security

All communications between the Musclelog app and our server use HTTPS. Authentication credentials are stored in hashed form and never in plain text. We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or disclosure.

No system can guarantee absolute security. In the event of a data breach affecting your personal data, we will comply with applicable notification obligations.

11. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of Musclelog after a revision constitutes acceptance of the updated policy.

12. Contact

For any question or request related to this Privacy Policy: support@musclelog.org