1. Data Controller
The Musku app is operated by:
- Julien Legrand, sole proprietor based in Lille (France)
- Email: email@musku.app
For any question regarding this policy or your personal data, please contact us at the email above.
2. Data we collect
2.1 Data you provide directly
- Account: email, password (hashed)
- Profile: first name, last name, gender, date of birth, height, weight, experience level, goal, target training frequency
- Body measurements: weight, body fat, chest, shoulder, waist, hip, arm, thigh and calf circumferences, with their date, collected with your explicit consent and shown only to track your progress. Musku produces no diagnosis and no medical advice; this data is neither shared with third parties nor used for advertising. It can be synced with Apple Health on iPhone or Health Connect on Android, if you allow it.
- Workout data: sessions, sets, reps, loads, durations, notes
- Exercises you create: exercises you add to your account
2.2 Automatically generated data
- Activity data: last activity date (
last_active_at) - Technical data: app version, device type (iOS or Android)
2.3 Data via third-party services
- Sign in with Apple: anonymous Apple identifier, first name and (relayed) email, only if you use this sign-in method
- Sign in with Google: Google identifier, first name, last name and email, only if you use this sign-in method
- RevenueCat: RevenueCat user ID, subscription status (Premium or not)
- Brevo: email, first name, language, profile attributes, for transactional communication and newsletter
- PostHog (EU): in the app, anonymized events (screens viewed, actions performed), a random device identifier, plus your phone's brand and model and its system version, only if you accept on first launch (revocable anytime in Profile → ⚙︎ Settings → Anonymous statistics). No health data is shared. On the website, only page views and clicks on the download buttons, with no cookie and no identifier kept (see §9).
- Mouseflow and Microsoft Clarity: on the website, a recording of how you browse (pages viewed, scrolling, clicks, mouse movements), only if you accept it in the cookie banner (see §9).
2 bis. Apple Health (iOS) and Health Connect (Android)
Musku can exchange data with your phone's health app: Apple Health on iOS, Health Connect on Android. Nothing is exchanged until you turn it on. The app's settings offer two separate switches, which you can enable independently and turn off at any time.
Your workouts
Musku writes your completed workouts: workout type, date, duration and an estimate of the energy burned. It never reads them back, as it already keeps its own history.
Your measurements
This exchange goes both ways.
Musku writes the measurements you enter: your weight, your body fat and, on iOS only, your waist. Health Connect has no circumference data type, so that measurement stays inside Musku on Android.
Musku reads those same measurements to fill in the days you did not log yourself, for example a weight recorded by a connected scale. A value you entered in Musku is never overwritten, and measurements Musku wrote itself are ignored when reading.
Imported values are saved to your account, and therefore sent to our servers, exactly as if you had typed them in. That is what lets them appear on your charts and follow you from one device to another.
In every case
None of this data is shared with third parties, used for advertising, or sold. Musku provides no medical diagnosis or advice.
You can stop this exchange whenever you like, from the app's settings, or from your phone: on iOS in Settings → Health → Data Access & Devices → Musku, on Android in Settings → Health Connect → Musku.
2 ter. Claude and ChatGPT connector (Musku Premium)
With Musku Premium, you can link your account to Claude, Anthropic's assistant, or to ChatGPT, OpenAI's assistant, and ask it questions about your training. Nothing is sent to the assistant until you add the Musku connector in it yourself and confirm access with the code sent to your account email.
What the assistant can read
The assistant queries Musku whenever it needs to in order to answer your questions. It can then read:
- your training profile: first name, age, sex, experience level, goal and target frequency;
- your workouts, with their sets, reps, loads, RPE, how each set felt, and your comments;
- your exercises, personal records and program, including the days and times your workouts are scheduled.
Your email, last name and date of birth are never sent, nor are your weight, height, body measurements and body fat, including those imported from Apple Health or Health Connect. For the same reason, workout volume is calculated without your body weight.
Access is read-only: the assistant cannot create, change or delete anything in your account. Musku never sees your questions or its answers, only its requests to read data.
At Anthropic and OpenAI
What Claude reads is sent to Anthropic (United States), which handles it like the rest of your conversations, under its own terms and privacy policy.
What ChatGPT reads is sent to OpenAI (United States, or its Irish affiliate for accounts opened in Europe), which handles it like the rest of your conversations, under its own terms and privacy policy.
Neither Anthropic nor OpenAI is a Musku subprocessor: each is the provider of your account with it, and Musku has no control over what it does with this data.
What Musku keeps
To recognize the assistant, Musku keeps a record of each connection: the authorized assistant, when it was created and when it was last used. The tokens that grant access are stored only as hashes. Access renews as long as you use the connector and ends after 90 days without use. Each time a new connection is made, Musku sends you an email about it.
Cutting access
In the app, open Settings, then Claude and ChatGPT, and disconnect the access you want. You can also remove the Musku connector in the assistant's settings. Access stops on its own if your Premium subscription ends, if you change your password or email address, or if you delete your account.
3. Purposes
Your data is used to:
- Provide the workout-tracking service (sessions, progress statistics)
- Filter and order the content shown to you (generic workout templates matching the level and goal you declared). These templates are identical for every user with the same filter: they are not drawn up based on your personal situation
- Manage your Premium subscription and payments (via Apple In-App Purchases or Google Play Billing, and RevenueCat)
- Let you, if you choose to, look at your data from Claude or ChatGPT (Musku Premium, see §2 ter)
- Contact you for transactional information or, with your consent, for the newsletter
- Improve the service (anonymized error and performance analysis)
4. Legal basis (GDPR)
- Contract performance: providing the service you chose to use
- Explicit consent (GDPR art. 9(2)(a)): declared health data, namely your body measurements and body fat. These fields are optional: you can use Musku without filling them in, and you can edit or erase them at any time from the app, which withdraws your consent.
- Consent: newsletter, push notifications, anonymized app usage statistics, session recording on the website (Mouseflow and Microsoft Clarity) (all revocable at any time)
- Legitimate interest: service security, fraud prevention, cookieless website analytics
5. Retention
- As long as your account is active
- On account deletion: your personal data (profile, body measurements) is deleted immediately. Your email is anonymized. Your workout data may be retained anonymized for aggregate statistics.
- Claude or ChatGPT connection: deleted when access expires, 90 days after it was last used, or as soon as you delete your account
6. Your rights (GDPR)
Under the General Data Protection Regulation, you have the following rights:
- Access: get a copy of your data
- Rectification: correct inaccurate data (directly in the app or via email)
- Erasure: delete your account (Profile → ⚙︎ Settings → Delete my account) or write to email@musku.app
- Portability: receive your data in a readable format
- Objection: to processing based on legitimate interest
- Restriction: temporarily restrict processing
You may also file a complaint with the French CNIL if you believe your rights are not being respected.
7. Subprocessors and third-party services
We use the following services to operate Musku:
- OVH (France): API and database hosting
- Apple (Ireland/USA): Sign In with Apple authentication, In-App Purchases, push notifications
- Google (Ireland/USA): Google sign-in, Google Play Billing payments, push notifications, and Health Connect if you enable the sync
- RevenueCat (USA): subscription management
- Brevo (France): transactional emails and newsletter
- PostHog (EU): anonymized app usage statistics (only with your consent) and website page views, including download clicks (without cookies)
- Mouseflow (EU): session recording on the website, loaded only if you accept it
- Microsoft (Ireland/USA): session recording on the website with Clarity, loaded only if you accept it
Transfers outside the EU are governed by EU Standard Contractual Clauses or the Data Privacy Framework.
Anthropic and OpenAI, to which you can link your account yourself with the Musku connector, are not Musku subprocessors (see §2 ter).
8. Security
- HTTPS encryption on all communications
- Passwords stored hashed (
bcrypt) - Secure, revocable API authentication tokens
- Rate limiting on authentication attempts
- Read-only Claude and ChatGPT connector, opened by time-limited tokens stored as hashes
9. Cookies (website)
The mobile app does not use cookies.
The musku.app site sets no cookies without your consent. Two session recording tools, described at the end of this section, load only if you accept them in the banner shown on your first visit.
Its audience measurement runs on PostHog (EU cloud), configured with no cookie and no local storage: no identifier survives from one visit to the next, no profile is created, and only page views and clicks on the buttons leading to the App Store or Google Play are counted: no other clicks, no keystrokes, no session recording. This processing relies on our legitimate interest in knowing how the site is used; you can object at any time by writing to us.
Your light or dark theme choice is kept in your browser's local storage (musku-theme). It never leaves your device, is used only for that display, and does not require your agreement.
Fonts are hosted on the site itself: none is loaded from a third-party service.
Mouseflow records how you browse if you accept it: pages viewed, scrolling, clicks and mouse movements. These recordings show us where a page is unclear. They are kept for one month, stored in the European Union, in Amsterdam, and never leave it. Mouseflow masks your IP address, does not record keystrokes and sets cookies, including mf_user, kept for 90 days, which recognizes a returning visit. This processing relies on your consent.
Microsoft Clarity records how you browse in the same way if you accept session recording: we run it alongside Mouseflow to compare the two tools. The content of input fields is masked and never sent. Clarity sets cookies on the site (_clck and _clsk), and Microsoft sets others from its own domains, including MUID. Recordings are kept for 30 days, and up to 9 months for a sample. They are hosted on Microsoft's Azure cloud under a contract with Microsoft Ireland, and may be transferred to the United States under standard contractual clauses. No data is shared with Microsoft Ads. This processing relies on your consent.
If you refuse, nothing is loaded and no request is sent to Mouseflow or Microsoft. Your choice is kept for six months in your browser's local storage (musku-consent), after which we ask again. You can change it at any time from the "Cookies" link at the bottom of the page. Withdrawing your consent deletes the cookies Mouseflow and Clarity set on the site; the cookies Microsoft sets from its own domains can be deleted in your browser settings.
10. Changes
We may update this policy. Any substantial change will be notified to you in the app. The last update date is shown at the top of this page.
11. Contact
For any question: email@musku.app