Privacy

Who is responsible

MASSFORGE is published from Spain, in the European Union, by a sole operator, who is the data controller and decides what the app collects and why. The GDPR applies because the publisher is established in the Union; Algeria's Law 18-07 of 10 June 2018, as amended by Law 25-11 of 24 July 2025, applies because most of the people concerned are in Algeria. Where the two diverge, the more protective one is applied.

For a question about this page, about your data, or to exercise one of your rights: bonjour@massforge.fit. Write in French, English or Arabic.

[To be completed before publication: the publisher's registered name, identification number and postal address. GDPR Article 13 requires them here.]

What is collected

Your account: your email address, your password (stored hashed, nobody can read it back), your support ID, your recovery code (hashed too), your first name if you give one, your language and your time zone. No phone number in the app for your account: it does not ask for one and does not keep one, unless you win a prize, and then only a fingerprint of the number you verify on WhatsApp and its last two digits (see “Leaderboards and prizes”). Only a coach can add one, the WhatsApp number they choose to show on their coach profile.

Your training profile: goal, level, sex, age, height, weight, activity level, start date and session schedule. These feed the calorie maths and the load progression; without them the app cannot prescribe anything.

Your training: every set you log (exercise, reps, load), your sessions, your cardio, your records, your exercise notes, the movements you add or swap, and the sessions you write yourself.

Your body: your weigh-ins, your sleep hours, your tape measurements if you take them, and your progress photos if you take them. This is health data, and the section on progress photos says what that adds.

Your food: the meals you log and the foods you create.

What you agreed to: the version of the terms you accepted and the date, and, separately, the date you agreed to your progress photos being kept. Those three lines exist because proving an agreement was asked for is our job, not yours.

What comes out of running the app: your signed-in devices, described by browser and operating system only, without IP address or location, with the date they were last active; if you turn on Face ID or your fingerprint, the public key your phone creates for Massforge, the device's name and the dates it was added and last used (your face and finger never leave your phone, and a password reset, your recovery code or a password change removes them all); the anti-abuse counters, kept hashed; technical errors, scrubbed of email addresses, tokens and codes before they are written; and a daily count of how many sessions were logged in the app, which carries no identifier at all.

If you buy a licence: the plan, the date, the amount actually paid in dinars, and a free-text note. Payment happens outside the app: no card or bank detail is ever seen or stored.

When you buy. Your licence request (the plan and the date) is kept for up to ninety days after it is closed. The reply goes out by email. If you use WhatsApp, the operator sees your WhatsApp number and name, and the payment screenshot you send. The operator deletes it thirty days after activation. Deleting your account does not erase that conversation: ask us to.

Why

To perform the contract between us, that is, to make the app work: your account, your programme, your calorie maths, your load progression, your licence, the list of your signed-in devices. Without this data there is no product.

Because you explicitly agreed, for your body measurements and your progress photos, and for the reminders you turn on. These consents are separate: you can withdraw one without losing the rest.

Because there is a legitimate interest in keeping the service standing: limiting sign-in attempts, recording technical errors so they can be fixed, counting how many sessions are logged each day to know whether the app is being used. That interest stops where it would outweigh your privacy, which is why the anti-abuse counters are hashed, the errors scrubbed, and the daily count carries no identifier.

What is not done: no advertising, no profiling, no automated decision producing a legal effect on you, and no sale or rental of your data to anyone.

Your progress photos

A progress photo is health data. The GDPR places it under Article 9, among the special categories, alongside your measurements and your weigh-ins. That means one precise thing: it can only be processed if you explicitly agreed, separately from everything else, and you can take that agreement back whenever you want.

Your photos are never stored in the database. They go to private object storage, with no public folder and no guessable address, and are served only to you, over a signed address that expires.

Your coach does not see them. This is not a policy promise: the query that builds a coach's view does not select that column. A coach sees your training profile and your sessions; not your photos, not your email, not your support ID, not your recovery code. Your friends see less still: your first name, how many sessions and sets you have done, and your streak. Nothing about your body.

You can delete a photo at any time from the app: the object is erased from storage, not merely hidden. Delete your account and they all go with it.

And if you would rather not, do not upload any. No feature of the app depends on them.

How you feel today

Before a session, the app can ask "How do you feel?", from 1 to 5. At 1 or 2, you can add what is going on (slept badly, pain, stress, fasting, and period if you turned the period log on) and your hours of sleep, then choose a lighter session, your normal session or rest. You can switch the question off in Settings › Session, with "Ask how I feel".

Your answer stays on this phone, in your browser's own memory: the number, what is going on and your hours of sleep are never sent to us. This is information about your health, and fasting can say something about your religion; that is why it does not leave the device. We cannot read it, export it or show it to a coach. The phone keeps only ninety days of it: each new answer erases the oldest ones. Signing out in the app, or deleting your account from this phone, erases all of it.

The period log is off to begin with. It is offered only if your profile says you are a woman, and you are the one who turns it on, in Settings › Session. Days marked "Period" also stay on this phone only, for the same length of time, and never reach us. In the same place you see the list of those days and can erase them all; turning the log off erases every mark.

Only one thing goes to our server, because your session depends on it: your choice for the day, a lighter session or rest, with its date. Not the number, not the reason. The daily clean-up erases that choice two days after the day it was for. If you do the lighter session, the recorded session keeps a "lighter" mark, which explains why it has one set fewer per exercise; that mark stays with your sessions for as long as your account exists. This is performance of the contract: without that choice, the app cannot lighten your session.

Your choice for the day, while it exists, and the mark on lighter sessions are in your account export, and go with the account when you delete it. A coach who follows you sees your sessions as before, so one set fewer that day; he never sees your answer or your choice. Your friends see none of it. What we count is the total number of lighter sessions and rest days chosen in the app each day, with no identifier.

Reminders

Reminders are notifications your phone or computer shows: training day at the time you choose, the end of a rest while the app is in the background, your week's recap, and the end of your trial or licence. They stay off until you turn them on, from Today or in Settings › Reminders, and your device also asks for its own permission. The basis is your consent, and you can withdraw it whenever you like.

If you turn them on, we keep, for each device: the address its notification service gives it to be reached, the two keys used to encrypt messages to it, the kind of device (Android, iPhone, computer or other), the signed-in device it belongs to, the date it signed up, the date of the last successful delivery and the number of failures. And on your account: the reminders you chose, the time, and when and how many times we offered them to you.

Each reminder goes through your device's notification service: Google for Android and Chrome, Apple for iPhone and Safari, Mozilla for Firefox, Microsoft for Edge. It is encrypted end to end: the service sees the address, the time and the size of the message, not its content. These services are run by companies established in the United States: that is a transfer outside Algeria and outside the European Union, in addition to those in the section on where the data lives.

A reminder holds a title, a line, the link to the screen it is about, your language and an internal identifier of your account, which lets your device ignore a reminder meant for somebody who signed in on it before you. The line gives your session's name, its number of exercises and its length; or your week's sessions, sets and records; or, at the end of a rest, the next set with its load and reps. Never your body weight, your measurements, your photos, how you feel, your email address or your support ID.

On an iPhone, the app stops as soon as it goes to the background. For the end of a rest it therefore sends us the end time and the line for the next set; the server keeps them for the length of the rest, under five minutes, and erases them as soon as the reminder goes out or you come back first. A line left behind by mistake goes at the next daily clean-up. On Android and on a computer, this reminder is shown by the device itself, and nothing is sent to us.

To stop, turn off "Reminders on this phone" in Settings › Reminders, or withdraw the permission in your device's settings. A device's address and keys are erased when you turn its reminders off, when that device is signed out (by you, from it or from another device, or by a password reset), and as soon as the notification service answers that the address no longer exists. An address the service refuses five times in a row, with no successful delivery for thirty days, is erased at the daily clean-up. If you delete your account, all of it goes with it.

We also note which reminder went out, and for which day or week, so the same one is never sent twice. Those notes are erased after sixty days. And we count, with no identifier, how many reminders go out each day.

Warm-ups, muscles, checks and cards

The guided warm-up, the "Your muscles" card, the check questions and the week that starts on Saturday collect nothing new. They are worked out from what the app already holds: your working weight for the build-up sets, your sets over the last seven days for your muscles, the value you just entered for a check.

Your account keeps two more settings, on or off: "Guided warm-up" and "Ask how I feel". The warm-up and prep ticks, and the number of times you skipped the prep, stay on this phone and are erased when you sign out. A check keeps nothing: it asks you once whether the value is right, and what you confirm is recorded like any other entry.

Share cards (a record, a session, your week) are made from what the screen already shows: your first name if you gave one, and the card's numbers and muscles. Never your body weight or your measurements. They are drawn on your phone, or by our server from those words alone, without reading anything else or keeping anything. The image leaves your phone only if you share it yourself, to the app you choose, or save it.

The weekly check-in

The weekly check-in adjusts your calorie target from what you logged and from how your weight moved. It only exists if the feature is open on your account and you have set up nutrition. It asks you for nothing new: it reads the calorie total of each logged day over the last 21 days, your weigh-ins from the last 60 days, and the profile answers the calculation uses (goal, sex, age, height, activity). Without your consent to health data, it never changes your target.

What we keep: your target for each period (calories, protein, fat, carbohydrate, water), the day it starts and what changed it (the first calculation, a check-in, or a changed profile answer). For each check-in: its date, what it proposed, what became of it (applied, declined, reverted, left unanswered) and the arithmetic behind it, meaning your calorie and weight averages, the estimated expenditure, the days counted or left out and the profile answers that were used. Numbers and dates only, never free text.

Your account also has room for five choices: how you track (the meal plan or your log), the calculation method, the pace you aim for, the check-in day and whether it applies itself. While they are empty, the defaults hold: a check-in on Friday that applies itself when you follow the plan. The Eat screen then says so in one line, and a button takes you back to the previous target for seven days. If you set your own numbers in Settings, the check-in only reads your week: it never touches them.

This is the performance of our contract, like the calculation of your calories. A check-in has no legal effect: it is a calorie number, which you can always replace. Your targets and check-ins stay as long as your account exists, because each check-in starts from the last one; a check-in left unanswered is marked as such by the daily clean-up after seven days. They are in your account export and go with it. A coach who follows you sees neither your check-ins nor what explains them; nor do your friends.

Algerian dishes and portions

The list of Algerian dishes ships with the app and the search runs on your phone: what you type to find a dish there is not sent to us.

When you log a food, we keep, on top of its name, weight and values as before: which food it is when the screen knows (a dish from the list, an ingredient, a scanned product, one of your own dishes), the portion you chose (a ladle, a bowl, a flatbread…) and how many, in quarters. For a food logged on the day itself, we also keep the time you logged it; never for a past day.

This is the performance of our contract: it is what lets the app show you the same portion again and redo the arithmetic if a dish's values are corrected. These details stay with the logged meal until you remove it and as long as your account exists. They are in your account export and go with it. A coach does not see your logged meals.

Ramadan mode

Ramadan mode sets your meals and sessions around the fast. That a person fasts can reveal their religion: it is a special category of data under Article 9 of the GDPR, and sensitive data under Law 18-07. We treat it with the same care as your daily check ("How do you feel?"), with one difference: so that your meals change on all your devices, this one is kept on our server. That is why it has its own explicit consent, asked before anything is saved, with two buttons of equal weight, "No thanks" and "I agree". Saying no costs nothing: the rest of the app does not change.

What we keep, on a single row per Ramadan: the year, the first and last day of fasting, your wilaya (or the two times you typed if you chose another city), your adjustments of a few minutes, when you train, whether you want lighter sessions, the days you said "I'm not fasting today", with no reason asked or kept, and the date and version of your consent. The times are worked out from the wilaya: your phone's location is never asked for.

What we do with it: put together your four meals on fasting days (iftar, the main plate, the evening, suhoor), show the day's times and suggest a time to train. The weekly check-in reads only its two dates, so as not to take the week Ramadan starts or ends for a change in your body: in those weeks it changes nothing. A coach who follows you sees nothing of Ramadan mode, nor do your friends, and none of it goes into a reminder.

The row is erased by the daily clean-up sixty days after the last day of fasting, or at once when you tap "Turn off and erase" in Settings › Goal and food › Ramadan mode, which never asks for a licence. That is also how you withdraw your consent; what was done before stays valid. A weekly check-in that changed nothing because of Ramadan then loses its reason: it only says your target did not move. If you can no longer find this row in your settings, write to bonjour@massforge.fit and we will erase it.

The meals you logged stay in your log, with their names ("Iftar", for example), like any logged meal: you can remove them one by one. While it exists, the Ramadan mode row is in your account export; if you delete your account, it goes with it.

If you pay online

When online payment is offered, you pay on the page of Chargily Pay, an Algerian payment provider, with your Edahabia or CIB card. The card number, its date and its code are typed in at Chargily: the app never sees them and never keeps them. What you type on its page is covered by its own privacy policy.

We send Chargily the amount, the plan, the language of the page and a payment identifier that holds neither your name nor your email address. For each payment we keep: the plan, the amount in dinars, its state (open, paid, refused, cancelled or expired), the payment method and fees as Chargily reports them, the payment's identifier at Chargily and the dates.

A payment that did not go through is deleted ninety days after it was opened. A payment that went through is part of the record of your payments: if you delete your account, it loses its link to the account and stays for ten years for the accounts.

Who it is shared with

Nothing is sold, rented or traded. Nobody buys data here.

What other people see of you is what you decided. A friend sees your first name, your session and set counts, and your streak. If you choose to appear on the public leaderboards, other members see your first name and the initial of your last name (or your nickname), your wilaya and your points, never your weights, your bodyweight or your photos. A coach you accepted sees your training profile, your sessions, your loads and your records, because that is his job. Never your photos, never your account credentials. You can cut a coaching link or a friendship at any moment, and the access ends at the same moment.

Technical providers process data on our behalf, under contract, with no right to use it for themselves: Vercel for hosting the site, Neon for the database, Cloudflare R2 for photo storage, Resend for sending email, and Railway for the server that holds the realtime connection open. That last one never receives or keeps any training data: it carries only the signal that something changed, and your device then asks the site what.

Beyond that, nobody, except your device's notification service if you turn reminders on (see the section on reminders). No ad network, no analytics tool, no social pixel, no third party reading over your shoulder.

Data would be handed to an authority only where the law requires it, and only what is asked for.

Where the data lives

The site and the database are hosted in the European Union, in Frankfurt, Germany.

If you are in Algeria, that means your data leaves Algerian territory. Law 18-07, as amended by Law 25-11, makes that transfer subject to prior authorisation from the ANPDP, the national data protection authority. Obtaining and maintaining it is the publisher's responsibility.

Photo storage and email delivery run through providers whose parent companies are established in the United States. They are bound by the European Commission's standard contractual clauses, which is the mechanism GDPR Article 46 provides for exactly this case.

For how long

Your account and everything attached to it stay for as long as the account exists, including the record of what you agreed to, because an agreement whose trace was erased is no longer an agreement anyone can show. Delete the account and all of it goes with it: sessions, sets, weigh-ins, measurements, photos, meals, licence, devices, coaching links and friendships, and that record. It is a deletion, not a deactivation, and it is immediate.

The rest has fixed lifetimes, enforced by a sweep that runs once a day. Single-use sign-in tokens go the moment they are used or expired. A device session goes when it expires, or seven days after you revoked it. The delay exists so that 'sign that phone out' still shows as having happened when you look the next day. Technical errors are erased ninety days after they were last seen. Anti-abuse counters go as soon as their window has passed.

Other traces survive an account deletion, and none of them says anything about you. The daily count of sessions logged in the app, which carries no identifier. And the operator's register, which notes which licence was granted or revoked and when. When the account is deleted, that register loses the account's identifier, its email and its account number, and keeps only what was done and when. It exists because paid access granted without a trace is access nobody can check.

If you delete your account, the record of your payments stays for ten years for the accounts, without your name, email or account number: the plan, the amount and the dates.

Your rights

You have, over your data, the rights the GDPR grants and Law 18-07 restates: to access it, correct it, have it erased, restrict its use, get it back in a machine-readable format to take elsewhere, object to processing based on legitimate interest, and withdraw a consent you gave.

Three of them need no letter to anyone: in Settings you can export your whole account to a file, delete it for good, and switch off your reminders. Correcting your data is simply editing it in the app.

For the rest, write to bonjour@massforge.fit. The answer comes within thirty days, which is the GDPR deadline, and in practice much sooner.

Withdrawing a consent does not undo what was done before it, and costs only what it covered: saying no to photos does not close your account.

If the answer does not satisfy you, you can complain to a supervisory authority. In Algeria, the ANPDP. In the European Union, the authority where you live, or the AEPD in Spain, where the publisher is established.

Cookies

One cookie, strictly necessary: the one that keeps you signed in. It is signed, it does not contain your password, it is marked HttpOnly, Secure and SameSite=Lax, and it expires. A second cookie of the same kind exists for operator access; if you are not an operator it is never set.

No advertising cookie, no analytics, no third-party tracker. That is why there is no banner to click: a cookie strictly necessary for the service you asked for needs no consent, and there is no other kind here.

The app also keeps some things in your browser's own memory: your light or dark theme; a local queue of the sets you log while offline, so that nothing is lost when the network drops, which leaves your phone only when the connection comes back, and only to your own account; and what the sections on how you feel today and on warm-ups, muscles, checks and cards describe, which is never sent to us. None of it is a tracker.

Changes

This page can change, because the app changes. The date at the top says when it last did.

If a change touches what is collected, why, or who receives it, you are told by email before it takes effect. Not by a line quietly edited.

Earlier versions stay available on request at bonjour@massforge.fit.