Mule Kick is a strength-training web app (a progressive web app, or PWA) operated by its founder as a US-based business ("we," "us"). This policy explains, in plain language, what data we collect, why, who touches it, and what control you have over it.
1. What We Collect
Account data. Your email address (used to sign in and to send emails you've earned, like your weekly training briefing).
Profile data. What you tell us during setup and afterward: display name, sex, birth year, height, bodyweight, training experience level, goals, available training days and session length, equipment, preferred units, and any injury notes.
Workout data. Everything you log while training: exercises, weights, reps, RPE/effort, tempo, rest times, personal records, failed sets, pain flags (site, movement, severity), session duration, and program history. Metrics we derive from your logs (estimated 1-rep-max trends, weekly volume) are stored too.
Readiness check-ins. Your daily 1–5 ratings for sleep, soreness, stress, and motivation, plus any free-text notes.
Body metrics (optional). Bodyweight history, measurements, and progress photos if you add them. If you connect a Withings scale, this includes body-composition measurements (body-fat %, muscle mass, water, visceral fat).
Wearable data (optional). Only if you connect a wearable (Oura, Whoop, Fitbit, Polar, or Withings): HRV, resting heart rate, sleep, recovery/strain scores, respiratory rate, SpO2, skin-temperature deviation, steps, calories, workout heart rate, and body composition. We never see this unless you connect a device, and disconnecting stops syncing and destroys the tokens.
Funnel and usage events. Which steps of signup and the app you reach (e.g. "quiz completed," "trial started"), so we can see where the product loses people.
Coach messages. The coaching notes generated for you, and the training facts used to generate them.
We do not collect payment card numbers (payments are handled by Stripe — we never see your card), precise location, or your contacts.
2. How We Use Your Data
- To run the product: prescribe workouts, autoregulate loads from your logs and readiness, track PRs, show progress.
- To generate coach text: a summary of your training facts and readiness (including your free-text notes) is sent to an AI model to produce your coach notes and weekly briefing (see Anthropic, below).
- To email you your weekly briefing and essential account emails.
- To measure whether our advertising works — only with your consent, and never using your health data (see Section 3).
- To improve the program-selection engine using only anonymized, aggregate statistics — never your raw logs, never anything tied to your identity.
We do not sell your data. We do not share your workout, readiness, wearable, or body data with advertisers — ever.
3. Advertising Measurement (Meta) — Your Choice
If you click one of our ads or visit the site, we ask whether you'll allow the Meta (Facebook) pixel. This is genuinely optional — decline and the app works exactly the same.
If you allow it, we share limited signals with Meta so we can tell which ads lead to real signups: page views, funnel milestones (registration completed, trial started, subscription purchased), your IP address and browser info, and your email address in hashed (one-way scrambled) form for matching. Meta sets cookies in your browser for this.
What we never share with Meta: your workouts, readiness scores, HRV, sleep, body composition, injury notes, coach messages, or any other health or training data. Ad measurement carries only "did an ad turn into a customer" — nothing about your body.
Changing your mind: your choice is stored in a cookie (`mk_consent`). Clear the cookie (or use your browser's site-data controls) and you'll be asked again; decline and the pixel never loads.
4. Who Processes Your Data
We use a small number of service providers:
- Supabase — authentication + database hosting (Postgres). Receives the data in Section 1, encrypted in transit and at rest; wearable tokens are additionally encrypted at the app layer.
- Stripe — payments and subscription billing. Receives your email and payment details when you subscribe; we receive only subscription status, never your card number.
- Anthropic (Claude) — generates your coach notes and briefing. Receives a summary of your training facts, readiness scores, and your free-text notes. Per Anthropic's API terms, API inputs are not used to train their models.
- Meta — ad measurement, only with your consent, as described in Section 3.
- Resend — sends transactional email. Receives your email address and the briefing content.
- Vercel — hosts the app. Receives standard web-request data (IP, browser) like any host.
- Wearable providers (Oura, Whoop, Fitbit, Polar, Withings) — only if you connect one. We pull data from them with your authorization; we don't send them your Mule Kick data. Their privacy policies govern their apps.
5. Where Your Data Lives
Mule Kick is US-based and your data is stored on US infrastructure. Using the app from outside the US means transferring your data to the US.
6. Data on Your Device
The app stores some data locally (for offline logging and fast loading) using standard browser storage. Cookies we set: sign-in/session cookies (strictly necessary) and the `mk_consent` cookie recording your ad-measurement choice. If — and only if — you allow ad measurement, Meta's pixel sets its own cookies (see Section 3).
7. How Long We Keep Data
We keep your data while your account is active — your training history is the product. If you delete your account, your data is deleted (below). Provider logs age out on their standard schedules.
8. Your Rights: Export and Delete
You don't have to ask — the app gives you both:
- Export: download a complete copy of your data from the app at any time (profile, training logs, cardio, readiness check-ins, body metrics, wearable data, and coach messages).
- Delete: delete your account from the app. This permanently removes your profile, logs, check-ins, body metrics, wearable data, and coach messages, and destroys any wearable tokens. Deletion is not recoverable.
You can also disconnect a wearable without deleting your account. For anything else, email us.
9. Security
Data is encrypted in transit (TLS) and at rest. Database access is enforced per-user with row-level security, so your rows are readable only by you. Wearable tokens are encrypted at the app layer before storage. No system is perfectly secure, but we treat your health data as sensitive.
10. Age Requirement
You must be at least 18 years old to use Mule Kick. We don't knowingly collect data from anyone under 18; if we learn we have, we'll delete it.
11. Changes to This Policy
For material changes we'll notify you in the app or by email before they take effect, and update the date above.
12. Contact
Questions or requests: support@mulekick.app