LEGAL
Privacy Policy
LAST UPDATED 15 SEPTEMBER 2026 · EFFECTIVE 1 JANUARY 2026
1. Introduction
MustDuo LLC (“we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use the MustDuo mobile app, our website at mustduo.com, and the MustDuo tracker and accessories (together, the “Services”).
2. Company Information
3. What We Collect
We collect the following to run the app and your plan:
Account details: your name, email address and date of birth, and a user ID. If you sign in with Apple or Google, we receive the name and email they share.
Your training: your goal, level, training days, equipment, weekly plan, workouts, sets, reps, weights, personal records, streak and rewards.
Body weight, only if you choose to add it in Edit Profile.
Messages you send to Naya, our AI coach.
Diagnostics: crash reports, and an activity log of what the app did (for example workouts started, errors and sync events). The log is stored under your account, can include your email address, and is deleted after 15 days.
Device identifiers used to deliver notifications and to measure how the app is used.
Tracker data, if you join the optional rep counting improvement program described in Section 9. This includes rep counts, your corrections and motion data from the tracker.
4. How We Use Your Data
To run the app and your plan, to let Naya coach you, to send reminders you allow, to fix bugs and crashes, and to understand which features are used.
We do not sell your data, show ads, or track you across other companies’ apps or websites.
5. Naya and OpenAI
Naya’s replies are generated by OpenAI on our behalf. When you message Naya, we send your message, your recent chat, and training context: first name, goal, level, training days, equipment, weekly plan, recent workouts and records, streak, level and rewards, your body weight if you added it, and the current exercise during a workout.
When you finish a workout, its summary is sent the same way to write your workout recap.
OpenAI processes this only to generate the response, and under OpenAI’s API terms it is not used to train their models. You can read how this works in the app under Settings, How Naya works.
6. Apple Health and Google Fit
With your permission, MustDuo reads steps, active energy, sleep and workouts to show your activity, and writes your finished workouts and active energy to Apple Health. Apple Health data stays on your iPhone. It is not sent to our servers or to Naya, and it is never used for advertising.
If you choose to connect the app to Google Fit, data is shared with that service only if you explicitly enable the integration. Data accessed through Apple HealthKit or Google Fit is never used for marketing, advertising or data mining, and is never shared with third-party data brokers.
7. Location
Location is used only for the optional left-behind alert, which tells you when you leave a place where your MustDuo tracker is still sitting. It is available only after you pair a tracker and turn the alert on. Your location is processed on your iPhone and is not sent to us.
8. Bluetooth and the MustDuo Tracker
Bluetooth is used only to connect the optional MustDuo tracker.
If you turn on Tracker data sharing, rep counts, your corrections and motion data from the tracker are uploaded over Wi-Fi to improve rep counting. You can turn this off in Settings, Permissions. Section 9 describes this program in full.
9. Improving Rep Counting (Optional Program)
To make our rep counting more accurate, the App offers an optional program you can join when you first pair a tracker, or later under Settings → Permissions. If you opt in, the App records how your tracker counted your sets and whether you corrected those counts, and uploads these records to our secure cloud servers over Wi-Fi after your workout.
We use this data to evaluate and improve our rep counting algorithms, including training machine learning models. The data is linked to your account so we can honor deletion requests, but it is never used for advertising, never sold, and never shared with third-party data brokers. This program does not use your location and does not read any data from Apple Health.
Participation is off by default. You can leave the program at any time under Settings → Permissions, which stops all future collection. If you delete your account, the data you shared through this program is deleted along with it, consistent with Section 11 (User Rights and Controls).
10. Legal Bases for Processing (EEA and UK)
If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
Performance of a contract: to create and operate your account, deliver the Services, and support your Hardware.
Your explicit consent: for health-related data, for optional integrations such as Apple Health and Google Fit, and for the rep counting improvement program described in Section 6.
Our legitimate interests: to secure the Services, prevent misuse, and improve product performance, where those interests are not overridden by your rights.
Legal obligation: where we are required to retain or disclose information by law.
Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing carried out before the withdrawal.
11. Data Storage and Security
Storage: User data is stored on secure cloud servers, including Firebase. Sensor data from the Hardware is processed in the App and stored both locally on your device and on our cloud servers.
Security: We use industry-standard security measures, including encryption during data transmission (e.g., HTTPS, SSL) and AES-256 encryption at rest. Data stored on our servers is protected by access controls and regular security audits. We use secure cloud providers (like Firebase) that maintain physical and digital security certifications.
Data Retention: We retain your data for as long as your account is active or as needed to provide the Services. If you delete your account, we will remove your data from our servers within 30 days.
12. Data Breach Notification
If a security incident affects your personal data, we will investigate promptly and take steps to contain it. Where required by law, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and we will notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
13. Service Providers
We use the following providers. They process data only to provide their service to us.
Google Firebase: sign-in, database, file storage, analytics and crash reports.
OpenAI: Naya’s replies and workout recaps, as described in Section 5.
OneSignal: push notifications. It receives a device push token and your email address.
Legal compliance: we may disclose data if required by law, or to protect our rights, safety, or property.
Do not sell or share my personal information: MustDuo does not sell your data. We do not share your data with third parties for cross-context behavioral advertising. You can exercise your right to opt out by emailing support@mustduo.com.
14. User Rights and Controls
You have the following rights regarding your data:
Access: You can request a copy of the personal data we hold about you.
Correction: You can update your personal information (e.g., email, username) through the App.
Deletion: You can delete your account at any time in the app under Profile, Settings, Delete Account. You can also email us to ask for deletion.
Portability: You can request a copy of the data you provided to us in a structured, commonly used, machine-readable format.
Restriction and Objection: You can ask us to restrict processing of your data, or object to processing we carry out on the basis of our legitimate interests.
Withdraw Consent: Where we rely on your consent, including for the rep counting improvement program, you can withdraw it at any time in the App under Settings, Permissions.
To exercise any of these rights, please contact us at support@mustduo.com. We will respond to your request within 30 days.
We will not discriminate against you for exercising any of these rights, and you will not receive a lesser level of service as a result. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local supervisory authority.
15. Deleting Your Account
You can delete your account at any time in the app: Profile, Settings, Delete Account. This deletes your account, plan, workouts, saved templates, Naya chats, logs and tracker data.
You can also email us at support@mustduo.com to ask for deletion.
16. Children’s Privacy
Our Services are not intended for users under the age of 16. We do not knowingly collect data from minors. If we become aware that we have collected data from a minor without parental consent, we will take steps to delete it promptly.
17. Cookies and Analytics
App: Our App does not use cookies. However, we use third-party SDKs for analytics and AI functionality. These SDKs may collect usage data to help us improve the Services.
Website: Our website uses Google Analytics to understand how visitors use mustduo.com. Google Analytics sets cookies (such as _ga) to distinguish visitors and measure site traffic. This data is not used for advertising and is not linked to your MustDuo account.
18. International Data Transfers
If you are located outside the United States, please note that your data may be transferred to and processed in the United States or other countries where our service providers operate. We ensure that such transfers comply with applicable data protection laws, including the use of standard contractual clauses or other safeguards.
19. Compliance with Laws
We strive to comply with applicable privacy laws, including the General Data Protection Regulation (GDPR) for users in the European Union and the California Consumer Privacy Act (CCPA) for California residents. If you are covered by these laws, you may have additional rights, such as the right to lodge a complaint with a supervisory authority.
20. Policy Updates
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notifications. You can always review the latest version of the policy on the App. Your continued use of the Services after updates indicates your acceptance of the revised policy.
21. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at:
MustDuo LLC
23936 Old Pomegranate Rd, Yorba Linda, CA 92887, United States
Email: support@mustduo.com
