Privacy.
How Musclesmith collects, uses, and protects your data.
1. Who we are
Musclesmith is built by 288 Labs, based in California, USA. Contact: privacy@288labs.com.
2. The short version
Musclesmith is local-first and account-free. Your profile, your gym, and every set you log live on your phone. There is no sign-up, no email, and no password. Your photos never leave your device. The only data that reaches our servers is anonymous usage analytics, feedback you choose to send, and an optional workout backup keyed by a random code.
3. What we collect
Stored only on your device
- Your training profile (age, height, weight, goal, experience, gym days)
- The machines you add to your gym and their weight-stack settings
- Every workout and set you log, and your weekly plan
- Progress photos you take — these are never uploaded anywhere
Sent to our servers, at your choice
- Workout backup — after each workout the app saves a snapshot of your training log (profile numbers, machines, workout history — never photos) so you can move to a new phone. The backup is keyed by a random code generated on your device; it is not linked to your name, email, or any account, because none exist.
- Feedback — if you send a feature request or problem report from Settings, we receive the text you typed and your gym size. Nothing else.
- Importing an old workout log (AI reading) — when you paste a handwritten log, Musclesmith reads it on your device. If our parser can’t make sense of it, we offer to have it read by AI instead — and only if you agree to a prompt that appears first. Agreeing sends the pasted text to our server, which routes it through OpenRouter to a third-party AI model that converts it into dates, machines, weights and reps. Today those models are served by OpenAI and Google, both in the United States. We may change which model or provider we route to as we tune quality and cost — including open-source models run by other hosting providers — and we keep this page current; the categories of data we send do not change. The text is used once for that conversion and is not stored by us. We never send your name, email, photos, or body measurements. You can withdraw this consent at any time in Settings → Privacy.
Device + telemetry
- App version, OS version, device model
- Anonymous usage events (screens viewed, workouts started and completed, machines added) via PostHog, under a random identifier that is not connected to your name or email
- Ad-measurement events (e.g. app installed, finished onboarding, completed your first workout) sent to Meta so we can measure which ads brought people to Musclesmith. We send the event name only — never a workout, a weight, a photo, or a body measurement. Your device’s advertising identifier (IDFA) is included only if you allow tracking when iOS asks; if you don’t, measurement falls back to Apple’s privacy-preserving SKAdNetwork, which is not tied to your identity.
4. What we don't do
- No accounts, no email collection, no contact upload
- No ads inside Musclesmith — we use Meta only to measure our own ad campaigns, never to serve you ads in the app
- We do not sell your data
- Photos and body measurements are never transmitted off the device, and are never shared for advertising
5. Sub-processors
The following services handle data on our behalf:
- Cloudflare — hosts our API (feedback + workout backup). US region.
- PostHog — anonymous analytics. US region.
- OpenRouter — routes log-import AI requests to model providers (see section 3). Only reached if you agree to the prompt.
- OpenAI and Google (US) — the AI model providers we currently route log imports to. They receive only the log text you chose to import and return the structured workouts. If we route to a different provider, including one hosting open-source models, we update this list; the categories of data we send do not change.
- Meta Platforms — advertising measurement and install attribution. Receives ad-measurement event names, plus your advertising identifier only if you allow tracking. Never receives your workouts, weights, photos, or body measurements.
- Apple — App Store distribution and (via SKAdNetwork) privacy-preserving ad attribution.
6. Children
Musclesmith is a training tool for adults. We do not knowingly collect data from anyone under 13 (or 16 in some jurisdictions).
7. Retention
- On-device data — until you delete it or delete the app.
- Workout backups — kept until you overwrite them or ask us to delete (email us with your backup code).
- Feedback — kept while it's useful for building the product.
- Server logs — 30 days.
8. Your rights
Regardless of where you live, you may request access, correction, export, or deletion of any server-side data by emailing privacy@288labs.com (include your backup code for backup deletion — it's the only key we have). On-device data is under your control: delete the app and it's gone. EU / UK / EEA residents have rights under GDPR; California residents under CCPA. We honor both globally.
9. Security
All data in transit is encrypted (TLS). Server-side data is encrypted at rest. Your backup code works like a password — anyone with the code can restore your training log, so keep it private.
10. Changes
We'll post material changes here with a new date. For significant changes we'll also notify you in-app.