LEGAL
Privacy Policy
LAST UPDATED 25 AUGUST 2026 · EFFECTIVE 1 JANUARY 2026
1. Introduction
MustDuo LLC (“we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the MustDuo fitness app (“App”) and our connected fitness tracker device (“Hardware”) — collectively referred to as the “Services.” By using our Services, you consent to the practices described in this policy. We may update this Privacy Policy from time to time, and we will notify you of significant changes by posting the new policy on our website or through the App. Your continued use of the Services after such updates indicates your acceptance of the revised policy.
2. Company Information
3. Data We Collect
We collect the following types of data to provide and improve our Services:
Personal Information: Name, email address, age, height, and weight.
Fitness Goals and Preferences: Information about your fitness objectives and workout preferences (e.g., workout type, frequency, intensity).
Health-related Data: Workout details such as repetitions (reps), sets, body weight, and performance history.
Device Data: Sensor data from the Hardware, including orientation, acceleration, direction, and timestamps (collected via IMU sensors). This data is processed and stored in the App and on our cloud servers.
Rep Counting Improvement Data (optional): If you choose to join our rep counting improvement program, we collect records of how your tracker counted each set, including timestamped rep counts, the exercise performed, the target and final rep numbers, and any corrections you make to the count. This data is collected only with your consent and only during workouts with a connected tracker.
Usage Data: Information about how you interact with the App, such as features used and time spent on activities.
Technical Data: Device identifiers, IP address, operating system, and crash reports (collected automatically when you use the App).
4. How Data is Collected
We collect data in the following ways:
Account Creation: When you sign up manually or through integrations with Apple Health or Google Fit, we collect your personal and health-related data.
App Usage: We collect usage and technical data automatically as you interact with the App.
Hardware Usage: The Hardware collects sensor data during workouts, which is sent to the App for processing and storage. The Hardware does not collect any personally identifiable information (PII).
Third-Party Integrations: If you connect the App to third-party services like Apple Health or Google Fit, we may receive data from those services based on your permissions.
5. Bluetooth and Device Permissions
The App requests Bluetooth access only while in use to communicate with the Hardware. We do not collect location data directly or indirectly via Bluetooth. The App may also request permissions for other features (e.g., camera or microphone) if applicable to specific functionalities. We will always explain the purpose of these permissions when requested.
6. Improving Rep Counting (Optional Program)
To make our rep counting more accurate, the App offers an optional program you can join when you first pair a tracker, or later under Settings → Permissions. If you opt in, the App records how your tracker counted your sets and whether you corrected those counts, and uploads these records to our secure cloud servers over Wi-Fi after your workout.
We use this data to evaluate and improve our rep counting algorithms, including training machine learning models. The data is linked to your account so we can honor deletion requests, but it is never used for advertising, never sold, and never shared with third-party data brokers. This program does not use your location and does not read any data from Apple Health.
Participation is off by default. You can leave the program at any time under Settings → Permissions, which stops all future collection. If you delete your account, the data you shared through this program is deleted along with it, consistent with Section 11 (User Rights and Controls).
7. Legal Bases for Processing (EEA and UK)
If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
Performance of a contract: to create and operate your account, deliver the Services, and support your Hardware.
Your explicit consent: for health-related data, for optional integrations such as Apple Health and Google Fit, and for the rep counting improvement program described in Section 6.
Our legitimate interests: to secure the Services, prevent misuse, and improve product performance, where those interests are not overridden by your rights.
Legal obligation: where we are required to retain or disclose information by law.
Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing carried out before the withdrawal.
8. Data Storage and Security
Storage: User data is stored on secure cloud servers, including Firebase. Sensor data from the Hardware is processed in the App and stored both locally on your device and on our cloud servers.
Security: We use industry-standard security measures, including encryption during data transmission (e.g., HTTPS, SSL) and AES-256 encryption at rest. Data stored on our servers is protected by access controls and regular security audits. We use secure cloud providers (like Firebase) that maintain physical and digital security certifications.
Data Retention: We retain your data for as long as your account is active or as needed to provide the Services. If you delete your account, we will remove your data from our servers within 30 days.
9. Data Breach Notification
If a security incident affects your personal data, we will investigate promptly and take steps to contain it. Where required by law, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and we will notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
10. Data Sharing
We may share your data in the following ways:
Third-Party Service Providers: We use the following third-party services to operate and improve our Services:
Firebase — cloud hosting, database, and crash reporting
Google Analytics for Firebase — app usage analytics
OpenAI (powers Naya, our AI coach) — workout plan personalization
These providers are bound by contractual obligations to protect your data and may only process it for the purposes we specify.
Apple Health & Google Fit Integration: You may choose to connect the App with Apple Health or Google Fit. Data is only shared with these services if you explicitly enable the integration. Data accessed from Apple HealthKit or Google Fit APIs will not be used for marketing, advertising, or data mining, and will not be shared with any third-party data brokers.
Anonymized Data: We may share anonymized or aggregated data with analytics platforms to improve and personalize workout plans.
Legal Compliance: We may disclose data if required by law or to protect our rights, safety, or property.
Do Not Sell or Share My Personal Information: MustDuo does not sell your data. We do not share your data with third parties for cross-context behavioral advertising. You can exercise your right to opt-out by emailing support@mustduo.com.
11. User Rights and Controls
You have the following rights regarding your data:
Access: You can request a copy of the personal data we hold about you.
Correction: You can update your personal information (e.g., email, username) through the App.
Deletion: You can request deletion of your account and all associated data. We will process such requests within 30 days.
Portability: You can request a copy of the data you provided to us in a structured, commonly used, machine-readable format.
Restriction and Objection: You can ask us to restrict processing of your data, or object to processing we carry out on the basis of our legitimate interests.
Withdraw Consent: Where we rely on your consent — including for the rep counting improvement program — you can withdraw it at any time in the App under Settings → Permissions.
To exercise any of these rights, please contact us at support@mustduo.com. We will respond to your request within 30 days.
We will not discriminate against you for exercising any of these rights, and you will not receive a lesser level of service as a result. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local supervisory authority.
12. Children’s Privacy
Our Services are not intended for users under the age of 16. We do not knowingly collect data from minors. If we become aware that we have collected data from a minor without parental consent, we will take steps to delete it promptly.
13. Cookies and Analytics
App: Our App does not use cookies. However, we use third-party SDKs for analytics and AI functionality. These SDKs may collect usage data to help us improve the Services.
Website: Our website uses Google Analytics to understand how visitors use mustduo.com. Google Analytics sets cookies (such as _ga) to distinguish visitors and measure site traffic. This data is not used for advertising and is not linked to your MustDuo account.
14. International Data Transfers
If you are located outside the United States, please note that your data may be transferred to and processed in the United States or other countries where our service providers operate. We ensure that such transfers comply with applicable data protection laws, including the use of standard contractual clauses or other safeguards.
15. Compliance with Laws
We strive to comply with applicable privacy laws, including the General Data Protection Regulation (GDPR) for users in the European Union and the California Consumer Privacy Act (CCPA) for California residents. If you are covered by these laws, you may have additional rights, such as the right to lodge a complaint with a supervisory authority.
16. Policy Updates
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notifications. You can always review the latest version of the policy on the App. Your continued use of the Services after updates indicates your acceptance of the revised policy.
17. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at:
MustDuo LLC
23936 Old Pomegranate Rd, Yorba Linda, CA 92887, United States
Email: support@mustduo.com
