1. Data Controller
The Musku app is operated by:
- Julien Legrand, sole proprietor based in Lille (France)
- Email: email@musku.app
For any question regarding this policy or your personal data, please contact us at the email above.
2. Data we collect
2.1 Data you provide directly
- Account: email, password (hashed)
- Profile: first name, last name, gender, date of birth, height, weight, experience level, goal, target training frequency
- Body measurements: weight, body fat, chest, shoulder, waist, hip, arm, thigh and calf circumferences, with their date, collected with your explicit consent and shown only to track your progress. Musku produces no diagnosis and no medical advice; this data is neither shared with third parties nor used for advertising. It can be synced with Apple Health on iPhone or Health Connect on Android, if you allow it.
- Workout data: sessions, sets, reps, loads, durations, notes
- Exercises you create: exercises you add to your account
2.2 Automatically generated data
- Activity data: last activity date (
last_active_at) - Technical data: app version, device type (iOS or Android)
2.3 Data via third-party services
- Sign in with Apple: anonymous Apple identifier, first name and (relayed) email, only if you use this sign-in method
- Sign in with Google: Google identifier, first name, last name and email, only if you use this sign-in method
- RevenueCat: RevenueCat user ID, subscription status (Premium or not)
- Brevo: email, first name, language, profile attributes, for transactional communication and newsletter
- PostHog (EU): in the app, anonymized events (screens viewed, actions performed) and a random device identifier, only if you accept on first launch (revocable anytime in Profile → ⚙︎ Settings → Anonymous statistics). No health data is shared. On the website, page views only, with no cookie and no identifier kept (see §9).
2 bis. Apple Health (iOS) and Health Connect (Android)
Musku can exchange data with your phone's health app: Apple Health on iOS, Health Connect on Android. Nothing is exchanged until you turn it on. The app's settings offer two separate switches, which you can enable independently and turn off at any time.
Your workouts
Musku writes your completed workouts: workout type, date, duration and an estimate of the energy burned. It never reads them back, as it already keeps its own history.
Your measurements
This exchange goes both ways.
Musku writes the measurements you enter: your weight, your body fat and, on iOS only, your waist. Health Connect has no circumference data type, so that measurement stays inside Musku on Android.
Musku reads those same measurements to fill in the days you did not log yourself, for example a weight recorded by a connected scale. A value you entered in Musku is never overwritten, and measurements Musku wrote itself are ignored when reading.
Imported values are saved to your account, and therefore sent to our servers, exactly as if you had typed them in. That is what lets them appear on your charts and follow you from one device to another.
In every case
None of this data is shared with third parties, used for advertising, or sold. Musku provides no medical diagnosis or advice.
You can stop this exchange whenever you like, from the app's settings, or from your phone: on iOS in Settings → Health → Data Access & Devices → Musku, on Android in Settings → Health Connect → Musku.
3. Purposes
Your data is used to:
- Provide the workout-tracking service (sessions, progress statistics)
- Filter and order the content shown to you (generic workout templates matching the level and goal you declared). These templates are identical for every user with the same filter: they are not drawn up based on your personal situation
- Manage your Premium subscription and payments (via Apple In-App Purchases or Google Play Billing, and RevenueCat)
- Contact you for transactional information or, with your consent, for the newsletter
- Improve the service (anonymized error and performance analysis)
4. Legal basis (GDPR)
- Contract performance: providing the service you chose to use
- Explicit consent (GDPR art. 9(2)(a)): declared health data, namely your body measurements and body fat. These fields are optional: you can use Musku without filling them in, and you can edit or erase them at any time from the app, which withdraws your consent.
- Consent: newsletter, push notifications, anonymized app usage statistics, ChatGPT Ads measurement pixel on the website (all revocable at any time)
- Legitimate interest: service security, fraud prevention, cookieless website analytics
5. Retention
- As long as your account is active
- On account deletion: your personal data (profile, body measurements) is deleted immediately. Your email is anonymized. Your workout data may be retained anonymized for aggregate statistics.
6. Your rights (GDPR)
Under the General Data Protection Regulation, you have the following rights:
- Access: get a copy of your data
- Rectification: correct inaccurate data (directly in the app or via email)
- Erasure: delete your account (Profile → ⚙︎ Settings → Delete my account) or write to email@musku.app
- Portability: receive your data in a readable format
- Objection: to processing based on legitimate interest
- Restriction: temporarily restrict processing
You may also file a complaint with the French CNIL if you believe your rights are not being respected.
7. Subprocessors and third-party services
We use the following services to operate Musku:
- OVH (France): API and database hosting
- Apple (Ireland/USA): Sign In with Apple authentication, In-App Purchases, push notifications
- Google (Ireland/USA): Google sign-in, Google Play Billing payments, push notifications, and Health Connect if you enable the sync
- RevenueCat (USA): subscription management
- Brevo (France): transactional emails and newsletter
- PostHog (EU): anonymized app usage statistics (only with your consent) and website page views (without cookies)
- OpenAI (USA): ChatGPT Ads measurement pixel on the website, loaded only if you arrive from a ChatGPT ad and accept it
Transfers outside the EU are governed by EU Standard Contractual Clauses or the Data Privacy Framework.
8. Security
- HTTPS encryption on all communications
- Passwords stored hashed (
bcrypt) - Secure, revocable API authentication tokens
- Rate limiting on authentication attempts
9. Cookies (website)
The mobile app does not use cookies.
The musku.app site sets no cookies by default, and therefore shows no consent banner. The only exception is the ChatGPT Ads pixel described at the end of this section: it is offered to you, never imposed.
Its audience measurement runs on PostHog (EU cloud), configured with no cookie and no local storage: no identifier survives from one visit to the next, no profile is created, and only page views are counted: no clicks, no keystrokes, no session recording. This processing relies on our legitimate interest in knowing how the site is used; you can object at any time by writing to us.
Your light or dark theme choice is kept in your browser's local storage (musku-theme). It never leaves your device, is used only for that display, and does not require your agreement.
The site also loads a third-party hosted resource (Google Fonts, for typography), which therefore receives your IP address.
If you arrive on the site from a ChatGPT advertisement (the address then contains utm_source=chatgpt), a dialog asks whether you accept the OpenAI measurement pixel. If you accept, it loads, stores an identifier in your browser and reports your visit to OpenAI (USA) so that we can tell whether the ad brought you here. If you refuse, nothing is loaded and no request is sent to OpenAI. Your choice is kept in your browser's local storage (musku-ads-consent) so we do not ask again; you can change it at any time by clearing this site's data in your browser. This processing relies on your consent.
10. Changes
We may update this policy. Any substantial change will be notified to you in the app. The last update date is shown at the top of this page.
11. Contact
For any question: email@musku.app