MindMuscle Privacy Policy
MindMuscle is a mental-training app used by coaches and the athletes they work with. This policy explains what we collect, why, who can see it, and how you can delete it. We keep the app deliberately small: there is no advertising, no analytics or tracking SDK, and we never sell or rent personal information.
1. Who this policy covers
There are two kinds of accounts. Coaches sign in with a phone number and create training content. Athletes join with an invite code from their coach and complete the training their coach assigns. Many athletes are minors — see Children.
2. What we collect
Account information
- Phone number — required for coaches to sign in (a one-time code is sent by SMS). Athletes never need a phone number to join; they may optionally add one later so they can recover their account on a new device.
- Display name and your role (coach or athlete).
- A passkey credential identifier if you choose to sign in with a device passkey. The passkey itself stays on your device; we only store the identifier needed to recognise it.
Training data created by athletes
- Training sessions and completed drills, with timestamps.
- Mood ratings (a 1–5 scale) and any optional notes you add with them.
- Journal entries you write in the app.
- Feedback messages your coach sends you.
- Team membership and your progress-sharing preference for each team.
Content created by coaches
- Drills, including any audio or video instructions you upload.
- Programs, assignments, teams, and invite codes.
- Feedback messages you send to athletes.
Technical information
- A Firebase authentication identifier for your account and the timestamps on the records above.
- When the app checks for an over-the-air update, the update service receives basic information about the app (platform, app version, update channel). It does not receive your name, phone number, or training data.
- Notification settings. If you allow notifications, we store your notification switches and, for each device you use, a push token, the device platform (such as iOS), the device’s time zone, and whether you are currently signed in on it. The push token lets us send alerts to that device; the time zone lets us send them at the right local time. Only you can read this record in the app, and our server uses it to deliver alerts.
Athletes’ daily and streak reminders are scheduled on the device itself and are not sent from our servers. A cached copy of your current session is also kept on your device. We do not collect precise location, contacts, photos (other than media a coach deliberately uploads for a drill), or advertising identifiers.
3. How we use it
- To sign you in and keep your account secure.
- To deliver assigned training to athletes and show coaches how athletes are doing.
- To keep coaches and athletes connected (invite codes, teams, feedback).
- To operate, maintain, and improve the app and respond to support requests.
We do not use your information for advertising or profiling, and we do not sell it.
4. Who can see your information
Your coach. If you are an athlete, the coach you are connected to can see your name, your training sessions and completions, your mood ratings and notes, your journal entries, and the feedback exchanged with you. This is how coaching works in the app, so please write in the journal with that in mind.
Your team. Teammates can see your progress on a team only if you turn on “Share my progress with the team” for that team in Settings. It is off until you turn it on.
Your athletes. If you are a coach, athletes you connect with can see your name and the content you assign to them.
Service providers. The app runs on Google Firebase (authentication, the database, file storage, and server functions on Google Cloud) and uses Expo’s update service to deliver app updates. These providers process data on our behalf under their own privacy and security commitments and are not permitted to use it for their own purposes. SMS sign-in codes are delivered through Firebase and your mobile carrier.
Push notifications. Alerts to coaches are delivered through Expo’s push notification service and Apple’s Push Notification service. An alert’s text can include the athlete’s name, that they finished a session or that their streak is at risk, and, for a low-mood alert, the mood rating they gave. Depending on the coach’s device settings, that text may appear on the coach’s lock screen. A coach can turn each kind of alert off in Settings.
Legal reasons. We may disclose information if required by law or to protect the safety of users. We do not otherwise share personal information with third parties.
5. Children
MindMuscle is designed to be used under the supervision of a coach, and many athletes are under 18. We collect only what the training features need from athletes — a display name chosen when joining, and the training records described above. No phone number, email address, photo, or location is required from an athlete.
Athletes can only join through a coach’s invite code. Coaches and the clubs, schools, or organisations they work for are responsible for obtaining a parent or guardian’s consent before inviting an athlete under 13 (or under the age required in your country) and for telling the athlete’s parent or guardian that the coach will be able to read the athlete’s journal and mood entries.
Parents and guardians may review their child’s information through the child’s app, have it deleted at any time using Delete Account in the app, or contact us (see Contact) to have the account removed. If we learn we have collected personal information from a child without appropriate consent, we will delete it.
6. Storage and security
Data is stored on Google Cloud infrastructure through Firebase and protected by server-side security rules so that only you, and the coach or athletes you are connected to, can read your records. Data is encrypted in transit. No system is perfectly secure, so please keep your device and sign-in method safe.
7. Retention and deleting your account
We keep your information for as long as your account exists.
You can delete your account at any time from inside the app: open Settings → Delete Account and confirm. This permanently removes:
- your account and sign-in (including your phone number, if any);
- your notification settings and every device push token stored for you;
- for athletes: all sessions, completions, mood entries, journal entries, feedback received, coach connections, and your place on any team;
- for coaches: all drills and uploaded media, programs, assignments, teams, invite codes, feedback sent, and athlete connections.
Deletion is immediate and cannot be undone. Records that belong to other people are not deleted — for example, an athlete’s own journal is not removed when their coach deletes a coach account; the connection between them is. Copies may persist briefly in our hosting provider’s routine backups before being purged.
8. Your choices and rights
- Edit your display name and preferences in Settings.
- Turn team progress sharing on or off per team.
- Delete your account and data from the app at any time.
- Depending on where you live, you may also have rights to access, correct, export, or restrict the use of your personal information. Contact us and we will help.
9. Changes to this policy
If we make material changes we will update the effective date above and, where appropriate, let you know in the app.
10. Contact
Questions or requests about privacy: support@mindmuscle.app