Privacy Policy for MashdLabs by Mashdup

Version 2.1 · Last updated: 4 October 2026

Who we are (data controller)

MashdLabs is a fitness and training app operated by Mashdup Limited, a company registered in England & Wales (company number 17020411), registered office 124-128 City Road, London, England, EC1V 2NX ("we", "our", "the app"). We are the data controller for the personal data described here.

We are registered with the UK Information Commissioner's Office (ICO), registration reference ZC197200. We have not appointed a Data Protection Officer, as we are not required to.

For any privacy question or to exercise your rights, contact privacy@mashdlabs.com.

This policy is written under the UK GDPR and the Data Protection Act 2018. It explains what data we collect, why, our legal basis for using it, who it is shared with, how long we keep it, and your rights.

Data we collect

Account and profile

• Email address and password (password is stored only as a one-way hash — see Security)
• Username, and first/last name if you provide them
• Your date of birth, which you must give when you register. We use it to check you are 16 or over, and we keep it so we can evidence that the check was done
• Your profile bio and avatar image, if you add them
• Preferences: weight unit, training days, rest-timer setting, timezone
• Account status and dates: whether your email is verified, when you joined, last sign-in

Training data

• Workouts you log — exercises, sets, reps, weights, and completed sessions
• Exercises, cardio activities, stretches and routines you create; training programs and templates you build or follow
• Personal records (and their history), volume landmarks, and favorites
• Training history you import yourself — if you upload one of your own exports, or a CSV from another fitness app, we read that file and store what it contains as your training data
• Training locations you add, including any name and notes you enter. If you pick a gym from search rather than typing one, we also store the street address and map coordinates that Google Places returns for that venue — these describe the gym, not you or your device

Health-related data (special category — see below)

• Post-workout soreness check-ins (how sore each muscle group feels)
• Heart rate you enter yourself on cardio records
• Recovery figures we work out from those check-ins: the recovery score and soreness averages attached to a volume suggestion, and the before-and-after soreness recorded against a deload
• Answers you give to a check-in question your coach has marked as a health question. Be aware of the limit here: it is your coach who marks a question, and only marked questions get the protections described below — the consent gate, the coach-sharing switch, and erasure when you withdraw. If your coach asks something health-related in an unmarked question, or you volunteer it in a free-text answer, that answer is stored and shown to them as ordinary coaching content. Tell us at privacy@mashdlabs.com if you want something like that removed

Social and coaching data

• Posts and any media you attach; likes, comments, and your follow connections
• Direct messages you send and receive
• Blocks and reports you make
• If you use coaching: coach–client relationships, saved message templates, and structured check-ins (templates, assignments, and your submissions)

Support and feedback

• Bug reports, suggestions and general feedback you send us from inside the app — the description you write, and the screen you were on when you sent it, so we can reproduce the problem
• Email you send to our support or privacy addresses, and our replies, kept as a record of the request and what we did about it. Our mailboxes are hosted by Zoho (see processors below)

Device and technical data

• Push-notification tokens for the reminders and notifications you turn on
• Security logs: to protect accounts from brute-force attacks we record failed sign-in attempts, including the IP address and device/browser identifier used
• Crash and error diagnostics (stripped of personal identifiers before they leave the app — see Third-party services)
• Session replay, on the web app only: a playback of a browsing session — the pages you view and where you click and scroll — used to diagnose errors and usability problems. We currently record every session on the web app, not a sample. We configure the recorder to mask all text and anything you type, and to block images, video and other media, before the recording leaves your browser. The mobile apps do not record sessions.
• Website analytics, on the web app only: which pages are viewed, roughly where visitors arrive from (the referring site, or the campaign tag on a link you clicked), and a small number of named events such as viewing the pricing page or starting a subscription. This is measured with Umami, which we run ourselves on our own server — it is not sent to an analytics company, and it sets no cookies. Visitors are counted using an identifier worked out from your IP address and browser details, which is regenerated monthly and is never linked to your account or used to identify you. The mobile apps contain no analytics.
• If you arrive from a link carrying a campaign tag, we keep that tag for the duration of your visit so that, if you go on to create an account, we can record which campaign brought you. It is stored in your browser's session storage, cleared when you register or when you close the tab, and never used for anything else.

Data we receive about you from other people

Most of your data comes from you. In five cases it reaches us from someone else, and in each the source is another person using our service, not a data broker:

• Your coach. If you connect to a coach, they can build and edit training programs and structured check-ins for you. Content they write for you is stored against your account and is visible to you in the app.
• An organisation or gym. Where your coach works for a gym or team on our platform, an administrator there can record you as a client of that organisation and can move you between its coaches.
• Another user inviting you. If someone invites you to connect — as a coach, a client, or a follower — we process the username or email address they used to reach you, in order to deliver the invitation.
• Private notes your coach keeps about you. A coach can keep a dated private log of their work with you — for example what you worked on and what they plan next. These notes are written by your coach, not by us. You do not see them in the app and they are not in your data export, but they are personal data about you: if you want a copy, ask us at privacy@mashdlabs.com and we will handle it as a request under your right of access.
• Reports other users make about you. If another user reports you, or a post or message of yours, to us — for example as spam or harassment — we keep their report: who and what it is about, the reason they chose, anything they wrote, and a copy of the reported text as it stood when they reported it. Our moderators may add their own notes while dealing with it. These reports and our moderators' notes are not in your data export, but they are personal data about you: if you want a copy, ask us at privacy@mashdlabs.com and we will handle it as a request under your right of access, withholding anything that would identify the person who reported you.

We do not buy personal data, and we do not obtain it from public sources, data brokers, advertising networks or social-media platforms.

Special-category (health) data

Post-workout soreness and the heart rate you enter are data concerning your health, a special category under Article 9 of the UK GDPR. We treat them accordingly:

• They are collected only with your explicit consent. That consent is off unless you turn it on, asked for separately from anything else you agree to, in your profile settings. You can leave it off and still use the rest of the app.
• Our condition for processing them is your explicit consent (Art. 9(2)(a)).
• You can withdraw that consent at any time in the app's settings. Withdrawing does more than stop future collection: we erase the health data we already hold for you, as part of the same request. Your soreness check-ins are deleted, the heart rate you entered is removed from your workout history and from any personal record that carried it, the soreness figures inside recovery and deload records are stripped out, and answers to health questions in coaching check-ins are removed. We keep a dated record that you gave and then withdrew consent — that record is how we can show the consent was properly obtained. It records the decision, when it was made, which version of this notice was in force, and — where the consent was about one particular coach — which coach. It contains no health data.
• Your coach does not see any of it unless you separately say so. Connecting to a coach is not consent to share health data with them. There is a second switch, one per coach — on that coach's page in the web app, and on the My Coach screen in the mobile apps — off unless you turn it on. It is only offered while health data is turned on in your profile, because without that there is nothing to share. Until you turn it on, none of your health data is visible to that coach: not your soreness check-ins, not the heart rate you entered (it is removed from the workouts and cardio records they can see), not the soreness figures behind a deload, and not your answers to health questions. Switching it back off takes one tap or click and takes effect immediately. Changing it needs a connection: in the mobile apps the switch is unavailable while you are offline, and a change is never saved up and sent later — it takes effect at the moment you choose it, or not at all. If your copy of the mobile app does not show the switch yet, you can use the web app; because it is off until you turn it on, nothing is shared in the meantime.

We never sell this data and never share it for advertising.

Storage on your device

• A sign-in cookie. When you sign in on the web app we set one secure, http-only cookie so that you stay signed in. It is strictly necessary to provide the service you asked for, so it does not require your consent, and it is not used for tracking or advertising.
• The web app's local storage, holding your preferences (theme, language, units), a cached copy of your account details including your email address so the app can show you as signed in, feature settings, and recently-used exercises.
• The mobile app's storage, which is larger: your sign-in tokens are held in your device's own secure keychain, and the app keeps an offline copy of your training data plus a queue of changes you made while offline. The offline copy is what lets the app work without a connection; the queued changes are sent to us when you reconnect, so while the storage is local, your workouts themselves are uploaded.
• Session replay, on the web app, stores a short session identifier in your browser's session storage for the duration of the visit.
• A campaign tag, for one visit only, as described above — session storage, cleared at registration or when you close the tab.
• Analytics sets nothing. Our analytics does not read or write cookies or any other storage on your device.

We do not use advertising or third-party tracking cookies of any kind.

Our legal basis for using your data

How we use your data

• To provide the training-tracking service and calculate your analytics and personal records
• To let you use social and coaching features you choose to engage with
• To send notifications and reminders you opt into
• To authenticate you and keep your account secure
• To answer your support requests and act on the bugs and suggestions you report
• To act on blocks and reports and keep the platform safe
• To fix bugs and keep the app reliable

We do not sell your data, share it with advertisers, or use it to target advertising at you, and we do not carry out any solely-automated decision-making that produces legal or similarly significant effects about you (Art. 22). Our analytics, personal-record, and recovery calculations are tools to inform you, not automated decisions taken about you.

Artificial intelligence and your data

• We do not use your personal data to train machine-learning or AI models, whether our own or anyone else's.
• We do not send your personal data to third-party AI or large-language-model providers.
• The calculations the app does for you — analytics, personal records, recovery and deload suggestions — are ordinary, inspectable formulas, not AI models, and they run on our own servers.

If we ever introduce a feature that sends your data to an AI provider, it will be described here and, where the law requires it, we will ask for your consent before it is turned on for you.

Marketing

• Email. Today we send only transactional email — address verification, password resets, and notices about your account or subscription. If we introduce newsletters, product news or promotional email, we will send them only where you have opted in, or where the law otherwise allows it for an existing customer, and every such message will carry a one-click unsubscribe. You can opt out at any time, and opting out never affects your access to the service.
• We do not sell or rent your personal data.
• We do not build advertising profiles, run behavioural advertising, or share your data with advertising networks. We use no advertising cookies and no tracking pixels, on our website or in our apps.
• We do not use your data to target ads at you, on our service or anywhere else.

Who your data is shared with

We do not sell or rent your personal data. It is shared only in these ways:

With other people, when you choose to — social posts, follows, comments, and direct messages are shared with the users you send or show them to; if you use coaching, your training data is shared with the coach you connect to. Your health data is not part of that — soreness check-ins and answers to health questions stay invisible to a coach until you turn on the separate per-coach sharing switch described under Special-category (health) data. Where your coach works for a gym or team on our platform, an administrator there can also see that you are a client and can move you to a different coach at that organisation — so a coach you did not personally choose may gain access that way. These features are optional.

With service providers who process data on our behalf. Each of them may use your data only to provide the service we have engaged them for, and only on our instructions — they may not use it for their own purposes:

International data transfers

Your data is stored on servers in Germany, within the European Economic Area. Transfers from the UK to the EEA are covered by the UK's adequacy regulations, so no additional safeguard is required.

Some of our processors (Firebase, Resend, Backblaze, Stripe and Google) are based in the United States. Where your data is transferred there, it is protected by an appropriate safeguard under the UK GDPR — either the provider's certification under the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement / Addendum to the standard contractual clauses. You can ask us which safeguard applies to a particular provider, and request a copy of it, by emailing privacy@mashdlabs.com.

How long we keep your data

• Account, training, social, coaching and health data — kept while your account is active. When you delete your account, it enters a 30-day recoverable grace period, after which your account, training, social, coaching and health data are permanently erased from our live systems. There are two exceptions: billing records, below; and anything you deliberately published to everyone — a public exercise you authored, or a gym location you shared with other users — which stays so the people relying on it do not lose it, with your name and account removed from it so it no longer identifies you.
• Backups — routine backups are aged out on a rolling window of no more than 30 days. Because deletion itself has a 30-day grace period before erasure begins, data from a deleted account can remain in a backup for up to around 60 days from the day you ask, after which it is gone from every copy.
• Security (login-protection) logs — to protect accounts from brute-force attacks we count failed sign-in attempts against a username and IP address. Those counters are deleted automatically once the one-hour lock-out cool-off window has passed, and we keep no permanent log of sign-in attempts. Our server's application log records that an attempt failed, with the username and IP address masked.
• Billing and payment records — where you buy a paid subscription, the records of that sale (including the invoice, the amount, and the country information used to work out the tax) are held by our payment processor, Stripe, and kept for 10 years. We are required by tax law to keep these, so — unlike the rest of your data — they are not erased when you delete your account. We do not store your card details, and your billing address is held by Stripe rather than in our own systems.
• Crash, error and session-replay diagnostics — held only as long as they are useful for diagnosing the fault they describe, and deleted automatically by Sentry on their standard retention schedule (90 days for errors at our plan level). We do not extend it.
• Website analytics — page-view and event records, and the visit records that accompany them, are kept for no more than 400 days and then deleted. They carry no cookie and no identifier tied to your account.
• Feedback and bug reports sent from inside the app — erased when you delete your account. Where a report has already been turned into an engineering task, the technical description of the fault may survive in our issue tracking, but it is separated from you and no longer identifies you.
• Email you send to our support or privacy addresses — kept in our mailbox as the record of what you asked and what we did. It is not deleted automatically when you close your account; ask us and we will delete it.
• Email verification and password-reset links — short-lived and not stored as data (they are signed, time-limited tokens that expire).

Your rights

Under the UK GDPR you have the right to:

• Access your data — view it in the app, or export a copy (Profile → Export my data), which returns the personal data held in your account as a structured file, after re-confirming your password. A few things sit outside that export: messages other people sent to you, your billing and subscription records (ask us and we will provide them), private notes a coach has written about you, reports other users have made about you, and our moderators' notes on reports you have made. Ask us for anything the export does not cover.
• Rectify inaccurate data — edit your profile and training data in the app, including changing your email through a verified change flow.
• Erase your data — delete your account in the app (Profile → Delete account) or online at https://mashdlabs.com/legal/delete-account. Deletion is recoverable for 30 days: sign back in during that window and the app shows you a banner from which you can cancel the deletion. After 30 days it is permanent. You can also ask us to delete your account by email.
• Restrict our processing — contact us and we will action it where the law requires.
• Data portability — the export above is provided in a structured, machine-readable format you can take elsewhere.
• Withdraw consent — for health-data features, at any time in your profile settings; doing so also erases the health data we already hold for you, in the same request (see Special-category (health) data above). Separately, you can withdraw a coach's access to that data with the switch for that coach — on their page in the web app, or on the My Coach screen in the mobile apps. For push notifications, turn them off in your device's system settings for the app. For consents other than health data, withdrawal stops future processing and does not undo processing already carried out.
• Be told who else we told — if we correct, erase or restrict your data, we will pass that on to anyone we shared it with, unless it proves impossible or disproportionate, and we will tell you who they were if you ask.

To exercise any right, use the in-app tools above or email privacy@mashdlabs.com.

How we handle your request. We respond within one month of receiving it. If your request is unusually complex, or you have made several, we may extend that by up to two further months — we will tell you within the first month if we do, and why. Exercising your rights is free; we will only charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive, and we will explain our reasoning and your right to complain if that ever happens.

Confirming it is you. Because these rights give access to your data, we need to be satisfied the request comes from you. Using the in-app tools does this automatically — the export re-confirms your password. If you email us instead, we may ask you to confirm from your registered address or to verify from inside the app. We ask only for what we need to be sure, and we do not use the identification you give us for anything else.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority. You can do this at ico.org.uk, by calling 0303 123 1113, or by writing to:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Complaining to the ICO does not cost you anything and does not affect any other right you have. We'd appreciate the chance to resolve any concern first, but you are under no obligation to come to us before going to them.

Your right to object

Separately from the rights above, you have the right to object at any time to any processing we carry out on the basis of our legitimate interests. For us that means: security and login-protection logging, crash and error diagnostics, web session replay, website analytics and campaign attribution, and acting on blocks and reports to keep the platform safe.

To object, email privacy@mashdlabs.com and tell us which of these you object to. We will stop unless we can show compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims — and if we do continue, we will explain why.

Data breaches

If a personal-data breach happens and it is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, as the law requires. Where it is likely to result in a high risk to you, we will tell you directly and without undue delay, describe what happened and what data was involved, and tell you what we are doing about it and what you can do to protect yourself. We keep an internal record of every personal-data breach, including ones we decide are not reportable.

Is providing data mandatory?

To create an account you must give a username, a password, your date of birth (so we can check you are 16 or over) and your agreement to these terms. If we are running a closed or invite-only period at the time you sign up, an invite code is required as well; the sign-up screen tells you when that applies.

An email address is optional — but without one we cannot verify your account, and we cannot send you a password-reset link, so an account with no email address cannot be recovered if you forget the password.

Everything else — including health-data features, push notifications, and anything you choose to post or share — is optional and up to you.

Health app integration (Apple Health & Google Health Connect)

If you enable Health sync (off by default), the app writes your completed workouts to Apple Health (on iOS) or Google Health Connect (on Android). This integration is:

• Opt-in — nothing is written until you turn on Health sync in the app's settings and grant permission through your device's system prompt.
• Write-only — the app only writes workouts to your device's health store. It never reads any data from Apple Health or Google Health Connect.
• On-device — the data is written to the health store on your own device, governed by Apple's or Google's privacy terms. It is not sent to our servers as part of this integration.

What we write: the workout type, start and end time, and duration. For cardio workouts, we also write the calories, distance, and heart rate that you entered yourself. We never fabricate or estimate health metrics.

You can turn Health sync off at any time in the app's settings, or revoke access directly in the Apple Health app (iOS) or the Health Connect app (Android). This stops future workouts from being written; workouts already written remain in your health store until you remove them there.

Data security

• Passwords are stored only as a salted one-way hash — we never store your password in a readable form, and it is never visible to us in our systems.
• Communication between the app and our servers is encrypted in transit using HTTPS/TLS.
• Our primary systems are in a secured data centre in the EEA, protected by access controls, brute-force protection, and rate limiting. Backups and billing records sit with the providers named above.
• No security measure is perfect; we work to protect your data but cannot guarantee absolute security. If a personal-data breach occurs that is likely to affect your rights, we will notify the ICO and, where required, you, in line with our legal obligations.

Children's privacy

This app is intended for users aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided us data, contact us and we will delete it.

Links to other sites

The app and our website sometimes link out — for example to a payment page hosted by Stripe, or to our app-store listings. Those sites are controlled by other organisations and have their own privacy policies. This policy covers only what we do with your data, and we are not responsible for how a site we link to handles it.

Changes to this policy

We may update this policy. Material changes will be posted here with an updated date and a new version number, and where required we will ask for your renewed consent before the change affects you. Where a change is significant we will also tell you in the app or by email rather than relying on you to re-read this page.

This is version 2.1. If you would like to see an earlier version of this policy, ask us at privacy@mashdlabs.com and we will send you a copy.

Contact

For any privacy question, to exercise your rights, or to raise a concern:

If you need this policy in another format, tell us at privacy@mashdlabs.com and we will do what we reasonably can to provide it.