Musclog

AI-powered fitness & nutrition tracking — free & open source.

Smart workout tracking
AI photo nutrition logging
Detailed progress charts
100% private & on-device
Try it live
AndroidiOSWeb
Download the AppGoogle Play Store QR CodeScan to download for Android
MusclogLift, Log, Repeat

Privacy Policy

Last updated: April 25, 2026

Data Protection

Comprehensive technical and organizational measures safeguard your data.

Local-First Storage

Your data is stored primarily on your device, not our servers.

Security First

Advanced encryption and access controls protect your information.

This Privacy Policy describes Our policies and procedures on the collection, use, storage and disclosure of Your information when You use Musclog. It applies both to the Musclog application and to the Musclog website, although the categories of data processed in each context are different. This Privacy Policy also explains Your privacy rights and how the law protects You.

Scope of This Privacy Policy

Musclog is made available through both an application and a public website. Because those two services operate differently, the applicable privacy practices are summarized separately below and described in more detail throughout this Privacy Policy.

Within the Musclog Application

The Musclog application is designed primarily as a local-first product. Most user data remains stored on your device and is not transmitted to our servers.

  • All data you enter into the application is stored locally on your device.
  • The application does not require an account and does not provide cloud synchronization.
  • We do not have access to your health or fitness data stored within the application.
  • Sensitive data stored by the application is encrypted at rest using AES.

On This Website

The website processes a narrower set of data, primarily relating to website operation, language preference, analytics, and cookie consent management.

  • This website uses Vercel Analytics to measure anonymous, cookieless traffic data without requiring consent.
  • This website uses Google Analytics 4 only after you provide explicit consent through the cookie banner.
  • Your language preference is stored locally in your browser and is not transmitted to our servers.
  • Your cookie consent choice is stored locally in your browser and is not transmitted to our servers.

Interpretation and Definitions

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

  • Account: means a unique account created for You to access our Service or parts of our Service.
  • Application: refers to Musclog, the software program provided by Musclog.
  • Company: (referred to as either "Musclog", "We", "Us" or "Our" in this Agreement) refers to Musclog.
  • Device: means any device that can access the Service such as a computer, a cellphone or a digital tablet.
  • Personal Data: While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You.
  • Service: refers to the Musclog application and the Musclog website, unless stated otherwise in the relevant section.
  • Service Provider: means any natural or legal person who processes the data on behalf of Musclog.
  • Usage Data: Usage Data is collected automatically when using the Service, including device information, IP address, browser type, and diagnostic data.
  • You: means the individual accessing or using the Service, or Musclog, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You.

Types of Data Collected

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

  • First name and last name
  • Usage Data

Google OAuth Data

Our application integrates Google OAuth for the following purposes:

  • To obtain your name to personalize your user experience.
  • To access Google Generative AI capabilities to enhance application features.
  • All data is stored offline on your device and not uploaded to our servers.
  • We do not share your data with third parties for marketing or other purposes.
  • Google OAuth is optional and can be disabled in the application settings.

Usage Data

Usage Data is collected automatically when using the Service. Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data. When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data. We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.

Information Collected while Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

  • Activity recognition data to track your workouts and fitness activities.
  • Body sensor data to monitor heart rate, steps, and other health metrics.
  • Internet access to connect to our servers and provide online functionalities.
  • Calendar data to integrate with your schedule and plan your workouts.
  • External storage access to read and write workout data and other information.
  • Permission to receive boot completed notifications to restart any scheduled tasks after your device reboots.
  • System alert window permission to display important notifications over other apps.
  • Vibrate permission to provide haptic feedback during workouts and notifications.
  • Wake lock permission to keep the app running during workouts and prevent the device from sleeping.
  • Health data such as active calories burned, body fat, bone mass, heart rate, height, lean body mass, nutrition, steps, total calories burned, and weight to provide comprehensive fitness tracking.

Optional AI Features and Third-Party LLM Providers

The Musclog application can be used fully offline, except for optional requests to external nutrition data sources. By default, Musclog does not send your workout, nutrition, health, or profile data to our servers.

Musclog also offers optional AI features that require you to configure your own provider, such as OpenAI, Google Gemini, Apple Intelligence on iOS, or a local/self-hosted LLM endpoint. These features are disabled unless you explicitly enable them.

If you choose to use an AI feature, the data that you decide to submit will be sent to the provider or endpoint you configure. If you use a self-hosted local model under your own control, that data may remain within your own environment. If you use a third-party hosted endpoint, including a hosted local-model service, that provider may process the data in accordance with its own terms and privacy practices. Musclog does not control how external providers process data you send to them.

Musclog may also offer a Musclog free-tier LLM option. When you use that option, your request is routed through Cloudflare AI Gateway and then forwarded using a Musclog-managed free-tier OpenAI or Google Gemini API key. If you choose to use this feature, you should understand that your request may be processed through Cloudflare and by the downstream model provider selected by Musclog for that request.

At present, Musclog supports OpenAI, Google Gemini, Apple Intelligence on iOS, compatible local or self-hosted LLM endpoints, and the Musclog free-tier LLM route. You should review the applicable privacy policies before enabling third-party providers or accepting the free-tier option, including: Cloudflare Privacy Policy, OpenAI Privacy Policy, Google Privacy Policy, and Apple Privacy Policy.

Voluntary Training Data Contribution

If you own a WT9011DCL BLE sensor device, connect it to the app, and use it to track your reps, Musclog will generate local sensor recording files on your device. These files are only created when this specific device is actively used for rep tracking. They are stored exclusively on your device and are never uploaded, synced, or transmitted to any server automatically — there is no opt-in or opt-out toggle, and no automatic data sharing of any kind.

If you would like to contribute your data to help improve Musclog's fitness tracking models, you may share these files manually — for example, by email or through a cloud storage service such as Google Drive. There is no in-app mechanism for this; any sharing is entirely at your own initiative and discretion.

Data you voluntarily share in this way may be used to train, test, and improve machine learning models. The resulting model may be released publicly as open-source software. By choosing to share your data, you acknowledge that it may become part of a publicly accessible dataset, and you grant permission for it to be copied, stored, processed, and distributed as part of the model development process. You should only share data that you have the right to share and that you are comfortable making publicly available.

Use of Your Personal Data

  • To provide and maintain our Service, including to monitor the usage of our Service.
  • To provide optional AI-powered features only when you explicitly enable them and configure your own provider or endpoint.
  • To manage Your Account: to manage Your registration as a user of the Service.
  • For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased.
  • To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication.
  • To provide You with news, special offers and general information about other goods, services and events.
  • To manage Your requests: To attend and manage Your requests to Us.
  • For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets.
  • For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service.

Sharing Your Personal Data

  • With Service Providers: We may share Your personal information with Service Providers to monitor and analyze the use of our Service, to contact You.
  • For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition.
  • With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
  • With business partners: We may share Your information with Our business partners to offer You certain products, services or promotions.
  • With other users: when You share personal information or otherwise interact in the public areas with other users, such information may be viewed by all users.
  • With Your consent: We may disclose Your personal information for any other purpose with Your consent.

Retention of Your Personal Data

Musclog will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. Musclog will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at Musclog's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction. Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer. Musclog will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You. Our Service may give You the ability to delete certain information about You from within the Service. You may update, amend, or delete Your information at any time by signing in to Your Account, if you have one, and visiting the account settings section that allows you to manage Your personal information. You may also contact Us to request access to, correct, or delete any personal information that You have provided to Us. Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Musclog may disclose Your Personal Data in the good faith belief that such action is necessary to:

  • Comply with a legal obligation
  • Protect and defend the rights or property of Musclog
  • Prevent or investigate possible wrongdoing in connection with the Service
  • Protect the personal safety of Users of the Service or the public
  • Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security. We employ comprehensive technical and organizational measures to safeguard your personal data from unauthorized or unlawful processing, as well as accidental loss, destruction, or damage. These measures include advanced encryption protocols for data in transit and at rest, stringent access controls, and regular security assessments.

Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers. If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page. We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Google Play Store Data Safety Labels

Our data safety labels on the Google Play Store are meticulously aligned with the disclosures provided in this privacy policy. We are committed to maintaining a high standard of transparency and ensuring full compliance with all Google Play Store requirements and guidelines. The data collected is strictly utilized to provide or enhance the functionality and features of your application. This data usage is confined to improving user experience and application performance, and under no circumstances is it used for any purposes outside this scope, such as marketing or selling to third parties. Access to any user data is strictly regulated and can only occur after obtaining explicit consent from the user.

Anonymous Crash Reporting — Database Failure Exception

Musclog lets you opt in or out of anonymous bug reports through the app settings. That preference is stored locally in your device's database. In the rare event of a critical database failure — for example, when a database migration fails to complete — the app cannot access the local database to read your preference. In this specific circumstance only, Musclog will send one anonymous crash report to our error-tracking service (Sentry) to help us identify and fix the issue. The report contains no personal data: only the type of error, the database schema version numbers (before and after the failed migration), your device model, and your app version. This exception exists solely to surface critical failures that would otherwise be invisible to us, and does not affect normal operation.

Website Analytics

This website uses Vercel Web Analytics, a cookieless and privacy-first analytics service. It collects no personal identifiers and uses no cookies — visitors are identified only by an anonymous hash that resets every 24 hours. No consent is required for this tool under the ePrivacy Directive.

This website also uses Google Analytics 4 (GA4), a service provided by Google LLC, to collect anonymized data about how visitors interact with the site. Analytics cookies are only set after you explicitly consent by clicking "Accept" in the cookie banner.

When you consent to GA4, Google Analytics may collect:

  • Pages visited and time spent on each page
  • General geographic location (country or city level, not precise location)
  • Browser type, device type, and operating system
  • Referring website or search engine
  • Anonymous interaction events (e.g. link clicks)

Legal basis for GA4: Consent (GDPR Art. 6(1)(a)). You may withdraw your consent at any time by clicking "Cookie settings" in the page footer. Withdrawal of consent will prevent any further collection and does not affect the lawfulness of processing carried out before withdrawal.

GA4 data is retained in Google Analytics for 14 months by default. Google acts as a data processor under a Data Processing Agreement. For more information on how Google handles data, see the Google Privacy Policy.

Your consent choice is stored locally in your browser (localStorage) and is never sent to our servers. It is used solely to remember your preference between visits.

Contact Us

If you have any questions about this Privacy Policy, You can contact us by email: [email protected]