MuscleIQ Privacy Policy

Draft — not legal advice. Have qualified counsel review this document before you submit MuscleIQ to the App Store or Google Play. This draft describes how the current product behaves. It is not a guarantee of compliance.

Last updated: September 7, 2026

Who we are

MuscleIQ is a consumer fitness and nutrition coaching app for iOS and Android (Expo). It estimates calories, macros, grocery-style meals, and strength sessions from numbers you enter. It is not medical advice and does not diagnose, treat, cure, or prevent disease.

Controller / operator: Kyle, operating MuscleIQ (“we,” “us”).
Contact: kyle@muscleiqapp.com

If you need a legal entity name, registered address, or a jurisdiction-specific imprint, add those here after counsel review. This draft uses the operator email as the contact method.

Who the app is for

MuscleIQ is for people 18 years of age or older. The in-app disclaimer requires you to confirm you are 18 or older. Onboarding age is limited to 18–90.

The app is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor used the app, email kyle@muscleiqapp.com and delete the install.

How MuscleIQ stores data today

MuscleIQ does not run a MuscleIQ account server. There is no cloud sync of your profile, meals, workouts, or photos to a MuscleIQ backend.

Most data stays on this device in the app’s local storage. Email, password hash, and session token use the device keychain / SecureStore when Expo provides it. If SecureStore is unavailable (for example some web sessions), those values fall back to ordinary local storage on that device.

Uninstalling the app, or using You → Delete my data on this device, removes MuscleIQ’s local data on that install. It does not cancel an App Store or Google Play subscription.

Data stored on this device

When you create a local account and use the app, MuscleIQ may store:

Category What Where Local account Email address you typed Device (SecureStore when available) Credentials Password hash (not the plain password) Device (SecureStore when available) Session Signed-in user id Device (SecureStore when available) Profile Weight, height or BMI, age, sex, activity level, goal (lose weight / gain muscle), lifting experience Device local storage Meal plans Generated grocery-style days, protein/carb swaps, scanned-meal replacements Device local storage Workout logs Set-by-set weights, rest-timer preferences, last-lift history Device local storage Goals End-goal weight and weekly weigh-in entries Device local storage Progress photos Photos you save; copied into the app’s document folder Device files + a local album list Entitlements Sandbox Pro flag in Expo Go / builds without live store keys Device local storage Preferences Units and similar settings Device local storage

The operator does not receive a copy of this on-device data unless you choose to send something off-device as described below.

Data sent off this device

1. Meal-scan photos (optional)

If you use Scan and tap analyze, the photo you chose is sent over HTTPS to a Hugging Face food-recognition API so the app can guess the food.

  • Your MuscleIQ name and email are not attached to that request in the current design.

  • An optional Hugging Face token may be configured in the app binary so the request can authenticate to Hugging Face. That token is not your MuscleIQ password.

  • Hugging Face processes the image according to their terms and privacy policy. MuscleIQ does not control how long that provider retains inference traffic.

You can skip Scan and use grocery meal plans only. Manual food pick still works if recognition fails.

2. Feedback email (optional)

You → Give feedback opens your device mail app with a mailto: message to kyle@muscleiqapp.com. The note you typed (and your email address as the sender, if your mail app adds it) is sent by your email provider, not by a MuscleIQ server. MuscleIQ does not store the draft on a backend.

3. Purchases (planned)

Today, Expo Go and builds without live store keys use a labeled Sandbox Pro unlock stored only on the device. When real in-app purchases ship, Apple App Store, Google Play, and RevenueCat (or the store APIs they wrap) will receive purchase tokens so MuscleIQ can validate a subscription. That traffic is planned, not active in the Expo Go sandbox path. When it ships, those companies will process purchase identifiers under their policies. A restore does not invent a receipt.

What we do not send today

MuscleIQ does not currently send your profile, workout logs, weigh-ins, or progress photos to a MuscleIQ server.

What we do not collect today

The current product does not include:

  • Analytics SDKs (no Amplitude, Mixpanel, Firebase Analytics, or similar)

  • Advertising SDKs or ad tracking

  • Cross-app tracking or an App Tracking Transparency prompt

  • HealthKit (iOS) or Health Connect (Android) — those integrations were removed and are not used

  • A MuscleIQ cloud account, social login, or remote backup of your journal

If that changes, this policy should be updated and store nutrition labels revised.

How long we keep data

On-device data stays until you:

  • use You → Delete my data on this device, or

  • uninstall MuscleIQ (the OS then removes the app’s local files and storage)

Meal-scan images sent to Hugging Face are retained only as that provider retains API traffic. MuscleIQ does not keep a server copy.

Feedback emails you send are retained in the operator’s inbox like ordinary email until the operator deletes them.

Store subscriptions (when live) are retained by Apple, Google, and (when configured) RevenueCat under their retention rules. Deleting local app data does not cancel those subscriptions.

How to delete your data

  1. In the app: You → Delete my data on this device. This wipes the local account, profile, meals, logs, goals, progress photos, and sandbox entitlement on this install.

  2. Uninstall MuscleIQ from the device.

  3. To stop a paid subscription (when live IAP exists): cancel in your Apple or Google subscription settings. Deleting the app does not cancel billing.

There is no MuscleIQ cloud account to request server-side deletion of profile or photos, because those are not uploaded to MuscleIQ today.

If you emailed feedback, you can ask kyle@muscleiqapp.com to delete that correspondence.

Third parties

Party Why Apple App distribution, device OS, and (when live) In-App Purchase Google Play distribution, device OS, and (when live) Play Billing Hugging Face Optional meal-scan food recognition over HTTPS Your email provider Delivers feedback you send via mailto: to kyle@muscleiqapp.com RevenueCat (planned) Purchase validation when real IAP is configured — not used for Expo Go sandbox unlock

Each party has its own privacy policy. MuscleIQ does not sell your personal information.

Security

We use reasonable measures for a local-first consumer app: HTTPS for meal scan, password hashing (not plain-text passwords), and SecureStore / device keychain for credentials when the platform provides it.

Limits you should know:

  • Data on the device can be read if the device is jailbroken, rooted, unlocked, or backed up in a way that includes app storage.

  • MuscleIQ is not a hospital-grade or encrypted-cloud product.

  • No method of storage or transmission is 100% secure.

Your choices

  • Do not use Scan if you do not want a plate photo sent to Hugging Face.

  • Do not send feedback if you do not want email to reach the operator.

  • Delete local data or uninstall to remove on-device records.

  • Cancel store subscriptions in Apple / Google settings when IAP is live.

Changes to this policy

We may update this draft as the product changes (for example when live IAP, analytics, or a backend ships). The Last updated date at the top will change. Material changes should be reflected in the hosted URL you submit to the stores and, when configured, in EXPO_PUBLIC_PRIVACY_POLICY_URL inside the app.

Governing law

Placeholder — customize before store submission. This draft assumes the operator is based in the United States, and that U.S. law may apply to disputes about this policy, except where mandatory consumer law in your country says otherwise.

Replace this section with the state/country counsel specifies (for example a specific U.S. state). Do not treat “United States” as a completed legal choice of venue.

Store listings

Apple and Google require a public HTTPS privacy-policy URL. Host this document (see docs/privacy-hosting.md), then set EXPO_PUBLIC_PRIVACY_POLICY_URL to that URL. Do not invent a URL that is not actually live.