Privacy Policy

1. Introduction

Mesostrength (“we”, “us”, or “our”) operates the Mesostrength web application and the Mesostrength apps for iOS and Android. This Privacy Policy explains how we collect, use, and protect your information when you use our service, on the web or in either mobile app.

2. Information We Collect

We collect the following types of information:

• Account information: Your email address and display name. A random display name is generated when you sign up, which you can change at any time.
• Training data: Workout logs, mesocycles, templates, exercises, sets, reps, weights, and recovery feedback you enter into the application.
• Coach conversations: The messages you send the AI coach and the replies it gives, the facts it saves about you once you approve them, and your coach profile: training age, sex, height, bodyweight, equipment access, primary goal, and any injuries you list.
• Payment information: Web subscriptions are processed by Lemon Squeezy. Subscriptions purchased inside our iOS or Android app are processed by Apple or Google, with entitlements managed through RevenueCat. We never receive or store your card details. We receive confirmation of your purchase status from these providers.
• Analytics data: We use PostHog to collect page views, product usage events (such as workouts completed), device and browser information, and IP addresses for analytics purposes. See Section 5 for details.

3. How We Use Your Information

• To provide and maintain the Mesostrength service
• To personalize your training experience and adjust volume recommendations
• To generate AI coach replies and the changes the coach proposes to your program
• To process payments through Lemon Squeezy, Apple, or Google
• To send transactional emails such as trial expiry notifications
• To analyze aggregated usage patterns and improve the product

4. Cookies and Local Storage

We use cookies and browser local storage as follows:

• Authentication cookies: Managed by Supabase Auth to maintain your login session.
• Local storage: Used to remember your preferences such as theme settings and cookie banner dismissal.

We do not use advertising cookies or cross-site tracking of any kind.

5. Analytics and Tracking

We use PostHog for website and product analytics. PostHog collects:

• Page views and navigation patterns
• Product usage events (e.g. workouts completed, mesocycles created)
• Device and browser information
• IP address

Session recording is not enabled. We do not sell your personal data. Analytics data is used solely to improve the website and product. Analytics data may be processed in the EU. You can request deletion of your analytics data by contacting us at support@mesostrength.com.

6. Third-Party Services

We use the following third-party services to operate Mesostrength:

• Supabase: Database, authentication, and infrastructure.
• Lemon Squeezy: Payment processing.
• RevenueCat: Subscription and entitlement management for purchases made in the mobile apps.
• Apple and Google: Payment processing for subscriptions purchased inside the iOS and Android apps.
• Vercel: Hosting.
• PostHog: Product analytics (EU instance).
• Resend: Transactional email delivery.
• Anthropic: The AI provider that generates the coach's replies. Section 10 lists exactly what is sent to Anthropic each time you message the coach.
• OpenAI: The provider that turns voice input into text when you speak to the coach instead of typing. Section 10 lists exactly what is sent to OpenAI.

7. Data Storage and Security

Your data is stored securely on Supabase infrastructure in regional datacenters located in Frankfurt, Germany (EU), with encryption at rest and in transit. We use row-level security to ensure that each user can only access their own data. While we take reasonable measures to protect your information, no method of transmission over the Internet is 100% secure.

8. International Data Transfers

Your account and training data are stored in the EU, in Frankfurt, Germany.

Some of the providers listed above operate outside Thailand and outside the European Economic Area, and process your data in the countries where they are based. In particular, Anthropic and OpenAI process the data described in the Data Sharing section in the United States. Each provider handles that data under its own data processing terms.

9. Data Retention

We retain your account and training data for as long as your account is active. When you delete your account, all associated data is permanently deleted. We retain a record of email addresses that have claimed a free trial to prevent trial abuse; no other data is retained after account deletion.

Coach conversations are kept for as long as your account exists and are permanently deleted when you delete your account. There is currently no way to delete a single coach conversation on its own. Individual facts the coach has saved about you can be deleted at any time from your account settings.

10. Data Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties. We share data only with the third-party service providers listed above, solely for the purpose of operating the service.

Each time you send a message to the AI coach, we send the following to Anthropic so it can generate a reply:

• Your message, and the recent messages in that conversation, including the coach's own earlier replies
• Your coach profile: training age, sex, height, most recently logged bodyweight, equipment access, primary goal, and the injuries you listed
• The facts the coach has saved about you
• A summary of your current training: the name of your active mesocycle, which week you are in, your units, your weekly sets against the ceiling for each muscle group, and recent volume adjustments
• Training data the coach looks up while answering: workouts, sets, weights, reps, exercise history, recovery feedback, adjustment history, program structure, and bodyweight history
• Which screen you were looking at, when that context is attached to your message

If you use voice input in the coach, we send the audio recording to OpenAI to convert it to text, together with a short list of training terms and the exercise names in your active mesocycle so that they are spelled correctly. We do not store the recording.

Mesostrength staff can read any coach conversation. We do this for support, safety, and quality review. Every conversation an administrator opens is recorded in an audit log.

11. Legal Bases for Processing

Where the GDPR applies, we rely on the following legal bases:

• Providing the service, your account and your training data: performance of a contract
• Generating AI coach replies: performance of a contract
• Processing payments and keeping billing records: performance of a contract and compliance with a legal obligation
• Transactional email such as trial expiry notices: performance of a contract
• Preventing repeat free trials: legitimate interest
• Security, abuse prevention and administrator audit logs: legitimate interest
• Product analytics: legitimate interest. We do not ask for consent before analytics runs, and nothing on the site gates it. You can object to this processing by contacting us at the email address below.

12. Your Rights

We are committed to compliance with the General Data Protection Regulation (GDPR) and applicable data protection laws. You have the right to access, correct, export, or delete your personal data at any time through your account settings. You may also request a complete data export or account deletion by contacting us at the email address below. If you believe your data protection rights have not been adequately addressed, you have the right to lodge a complaint with your local data protection supervisory authority.

13. Not Medical Advice

Mesostrength provides training tools and volume recommendations based on your input. This content is not medical advice. Consult a qualified healthcare professional before starting or modifying any exercise program.

The AI coach adjusts training. It does not diagnose, it does not name conditions, and it does not give medical or nutritional treatment advice.

14. Children's Privacy

Mesostrength is not intended for users under the age of 16. We do not knowingly collect personal information from children under 16.

15. AI Coach

Mesostrength includes an AI coach that answers questions about your training and can propose changes to your program. Its replies are generated by a third-party AI model, not written by a person, and they can be wrong or incomplete. Section 6 names the provider, Section 10 lists what we send to that provider on each message and states that our staff can read coach conversations, and Section 9 covers how long those conversations are kept.

The coach never changes your data on its own. Every change it proposes, including any fact it wants to remember about you, is shown to you first and takes effect only when you approve it.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by updating the “Last updated” date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

17. Contact

The data controller for the personal data described in this policy is an individual trading as Mesostrength, not a company:

If you have questions about this Privacy Policy, please contact us at support@mesostrength.com.

18. YouTube API Services

Mesostrength operates an internal tool that uses YouTube API Services to publish the company's own videos to its own YouTube channel and to read performance figures for those videos. The tool is not part of the Mesostrength application and is not available to users.

By using that tool we agree to be bound by the YouTube Terms of Service. The Google Privacy Policy applies to data handled through those APIs.

What is stored: an access token for the company's own YouTube channel, held only on the operator's own machine, plus the identifiers and performance figures of videos the company itself published. No data about any other person, channel or viewer is collected, and no end-user data is processed through these APIs.

How it is removed: the stored authorization can be revoked at any time in the tool's settings, which deletes the token. Access can also be revoked at https://myaccount.google.com/permissions. A request about stored data can be sent to the contact address given above.