Privacy Notice
Applies to the Musclecn website (musclecn.com) and the iOS app “明刚笔记”. Lists only data we actually collect and use.
What we collect
Sign-in: phone number or email address, a hash of the code (no plain code stored), a hash of the request IP (rate limiting only, no plain IP), session token hashes.
Training: plans, sessions, sets, training notes and favourites you enter; private by default.
Community (website): comments, Old Friends post text and images, and poll choices. Comments and posts become public after review and show your display name; polls only count votes and never show who voted for what. Post images have EXIF / GPS metadata removed before they are stored.
Pose photos (if you upload any): used for a reviewer to check posing form. Private by default — only you and this site's reviewers can see them; never shown publicly, used for promotion or used to train models. EXIF and similar metadata (phone photos often carry GPS and device details) are stripped on the server before storage; files live in a private directory on this site's server, not under any directly accessible static path. You can delete any photo at any time, and deleting your account deletes the photos and their reviews.
Phone numbers are used only to deliver sign-in codes via the SMS provider (Aliyun SMS); no ID documents or payment data; no third-party ads or behavioural tracking.
Data the iOS app keeps on your phone
The sign-in token is stored in the system Keychain, valid for 90 days and revoked when you sign out.
Training records not yet synced, recently opened sessions and plans, and exercise details and teaching images you have viewed are kept in the app's private storage so you can keep logging and reading offline; they upload automatically once online. Signing out reminds you to sync first and clears local records after you confirm.
Training reminders are local notifications: only after you turn them on, once on each planned training day at the time you choose. They are not pushed from our server and carry no marketing; the switch and time are stored only on your phone and can be turned off in the app or in system settings.
The app includes no third-party analytics, advertising or tracking SDKs.
AI features
When the weekly-report explanation or poster copy call an external text model, only de-identified data is sent (weekly numbers, exercise and program names, dates) — never email, display name, phone number, note text or raw logs.
AI plan matching sends the sentence you type in its box to an external text model as is (up to 500 characters), so do not put personal details in it; the site records only a hash of that sentence, its length and the conditions recognised, not the text.
Pose photos are never sent to any AI model and never leave this site's server; they are reviewed by this site's reviewer personally. The full list of AI uses is on the “Method & AI” page.
AI-generated content is labelled on the page; changes to your training need your confirmation.
Export and deletion
You can export your training data or request deletion of your account; deletion removes your training records. Staff bylines follow the content rules.
Request it from Account settings on the website or the “Me” tab in the app; you can cancel any time before it is processed, and an administrator handles it. Our goal is to complete the clean-up within 30 days of the request. That is an internal target, not a cancellation window and not a statutory deadline.
Once carried out: the account can no longer sign in, identifying details such as phone number and email are cleared (the same number can register again), and training records, check-ins, favourites, questions, comment text, posts and their images, poll votes, and uploaded pose photos with their reviews are deleted; comments that others replied to keep a “deleted” placeholder; to keep the content review chain intact, review bylines and audit records on the content side are kept but unlinked from your account.
Storage, updates and contact
Data is stored on this site's servers in mainland China; runtime secrets are injected by the deployment, never written into code or docs.
When this notice changes, the version changes and you will be asked to confirm at your next sign-in.
Privacy questions and requests: service@musclecn.com.