Privacy Policy - Mesolab

1. Introduction

Welcome to Mesolab ("we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile and web applications (collectively, the "Service").

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Username and password: Used to authenticate your account; passwords are stored as hashes
Email address (if provided): Associated with your account
Sign in with Apple (if used): Apple account identifier, shared or relay email, and authorization information needed to sign in and revoke access on deletion

2.2 Training Data

We collect detailed workout and training information that you enter, including:

Exercises performed, sets, reps, and weights lifted
Workout dates, times, and duration
Rest periods and notes about your workouts
Personal training programs and mesocycle information
Exercise history and progression data
RIR (reps in reserve), pump, joint pain and workload feedback you choose to enter
Training preferences, equipment and optional body-silhouette selection

2.3 Bodyweight Data

If you choose to log bodyweight measurements, we collect:

Bodyweight values and measurement dates
Progress tracking and historical data

2.4 HealthKit Integration (iOS Only)

On iOS, with your explicit permission, Mesolab saves completed strength-training workouts to Apple Health. This integration is write-only: Mesolab does not request read access to Health data and does not import bodyweight from Health.

You can decline or revoke Health permission and continue using Mesolab. Health data is not used for advertising, marketing or data mining, or sold to third parties.

2.5 Usage Information

We automatically collect certain technical information:

Device type and operating system
Browser type (for web users)
IP address
Timestamps of requests and error logs
Account-linked product interactions, such as onboarding, workout completion and purchase synchronization, used to operate and improve the Service
Crash summaries from the iOS app (the type of failure, its code and the app build number, with no content from your training), and whether the app was installed from the App Store, TestFlight or a development build, used to find and fix problems

2.6 Purchases

Apple processes App Store payments. RevenueCat helps us verify purchases and restore access using your account identifier, purchased product, subscription status and expiration information. Mesolab does not receive your full payment-card details.

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide and maintain the Service: Processing your data to deliver workout tracking and related features
To authenticate you: Verifying your identity and protecting your account
To personalize your experience: Tailoring recommendations, training programs, and insights
To monitor and improve the Service: Understanding usage patterns and fixing issues
To comply with legal obligations: Responding to lawful requests and preventing fraud
To sync with HealthKit: Saving a completed workout record to Apple Health with your permission

4. Data Retention

We retain your data as long as your account is active. Specifically:

Active accounts: Your training data, bodyweight, and account information are retained indefinitely while your account exists
Account deletion: When you delete your account, your account and associated training data are removed from our active database. Apple purchase records remain subject to Apple’s retention requirements; deleting Mesolab does not cancel a subscription
Backup retention: Backup copies may be retained for up to 90 days for disaster recovery purposes, then permanently deleted
Logs: Technical logs (IP addresses, error logs) are retained for up to 30 days

5. Data Security

We take the security of your data seriously:

All data is transmitted over HTTPS encrypted connections
Your password is securely hashed and never stored in plain text
API access requires authentication via JWT tokens
Your training data is private to your account, except content you choose to export or share through the web app’s opt-in Competition Groups

While we implement industry-standard security measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your information.

6. Sharing Your Information

We do not sell, trade, or rent your personal information to third parties. Your data may be shared only in the following circumstances:

Service providers: Render (API hosting), Turso (database), Vercel (web hosting), and RevenueCat (purchase verification and subscription status) process information needed to operate the Service
Sharing you choose: Exported workout cards go to the destination you select. Competition Groups and shared activity feeds are available in the web app; the native iOS app has no shared feed or messaging
Legal requirements: When required by law, court order, or government request
HealthKit: Completed workouts are saved to Apple Health only with your permission on iOS

7. Your Rights and Choices

You have the following rights regarding your data:

Access: You can access all your personal data through your account
Export: You can export training history and feedback from web Settings, or share a workout card from the iOS app
Correction: You can update or correct your information at any time
Deletion: You can delete your account from Profile → Delete Account in the iOS app, or from web Settings; contact support if you cannot access your account
HealthKit permissions: On iOS, you can revoke HealthKit access through the Health app settings

8. Children's Privacy

Mesolab is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information immediately.

9. Third-Party Services

Our Service may contain links to third-party websites and services. This Privacy Policy applies only to Mesolab. We are not responsible for the privacy practices of third-party services. Please review their privacy policies before providing any information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of material changes by posting the updated policy and changing the "Last updated" date. Your continued use of the Service after changes constitute your acceptance of the updated Privacy Policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Email: support@mesolab.app