Privacy Policy

MatStrong is operated by APPLICATION LAYER AI d.o.o., Col 92E, 5273 Col, Slovenia, registration number 7446268000, VAT ID SI61904180 ("MatStrong", "we", "us"). We decide how your personal information is used (we are the "controller").

Privacy questions and requests

Our privacy lead, miha@matstrong.com

Support

support@matstrong.com

Quiz answers

Before you buy, the quiz asks about you and your training: gender, belt rank, goals and focus areas, weekly BJJ and strength schedule, time available, grappling style, gym and equipment, strength experience and exercise skills, fitness level, age, height, weight and, if you choose, injuries and limitations. At the end we ask for your name and email to deliver your plan. We keep these answers even if you don't buy, so you can come back to your results (see Retention).

Account data

Name, email address, password (stored only as a secure hash by our authentication provider), time zone, unit and notification preferences, and a profile photo if you add one. Profile photos are stored so the app can show them; anyone with the photo's link can open it.

Training profile

What we need to build your program: the quiz answers above, your competition date, training locations and equipment, and any injuries or sore areas you choose to share.

Training activity

The workouts you log: exercises, sets, weights, reps, effort ratings, how a session felt, BJJ sessions, cardio results (such as time, distance, pace, watts, RPM and machine calories) and changes you make to your program.

Payment data

Stripe processes payments. We never see or store your card number. We receive your subscription status, plan, price, billing country, billing period and Stripe customer and subscription identifiers.

Messages and feedback

Emails you send us, in-app feedback, program and workout ratings, and any reason you choose to give when you cancel or delete your account.

Usage and device data

When you use the quiz, website or app, we collect pages and screens viewed, taps and features used, errors and performance data, device and browser type, and your IP address (used to estimate your country). This includes session replay: a reconstruction of how you move through the quiz and app. Everything you type is hidden in replays. See Section 6.

Advertising data (quiz only)

The quiz tells Meta and Google which ad brought you in and which quiz steps and purchases happened. See Section 6.

Push notifications

If you turn on training reminders, we store a push token for your device. On iPhone, the lock-screen workout display runs only on your device; nothing about it is sent to us.

Apple Health (optional, iPhone only)

If you switch it on, the app writes your finished workouts to Apple Health. It never reads from Apple Health, and no Apple Health data reaches us.

Injuries, sore areas and their severity are health information. Here's how we handle them:

It's optional

You don't have to tell us about injuries. If you don't, you still get a plan; it just won't be adapted around an injury.

What it's for

We use it to adapt your training around it. Our AI providers (Google Gemini and OpenAI) process it for that purpose, as our processors.

You can remove it

Edit your injuries in the app, or email us and we'll delete your injury information.

Privacy laws in the UK, the EU and some other places require us to state the legal basis for each use. We apply the same rules to everyone.

We don't use your information for purposes that are unrelated to these.

Your program is built by software, including AI models from Google (Gemini) and OpenAI, from your training profile and history. We send the training details needed to build it. We don't send your email or payment details. Under our agreements, these providers process the data to generate your program and don't use it to train their models.

The program is a suggestion, not a medical or legal decision. You can change, swap, skip or rebuild any workout. If you want a person to look at how your program was put together, email us.

Strictly necessary storage

We use cookies and local storage to keep you signed in, remember your quiz answers while you take the quiz, keep workouts you log offline until they sync, and remember your settings. These are always on.

Product analytics (PostHog)

PostHog records how the quiz and app are used, including session replays with typing hidden. Once you have an account, this is linked to it so we can fix problems you report.

Ads measurement (quiz only)

The quiz uses the Meta Pixel with Meta's Conversions API, and Google Analytics through Google Tag Manager. They receive the pages you view, the names of the quiz steps you complete (not your answers), when you start checkout or buy, your IP address and browser details, cookie identifiers and ad click identifiers. When you enter your email, start checkout or buy, Meta also receives a scrambled (hashed) copy of your email address so it can match the visit to an ad. Meta and Google use this information under their own privacy policies, and may combine it with what they know about you from other websites and apps. The app itself runs no advertising tags.

Your choices. You can block these cookies in your browser or with a tracker blocker, and control ad personalization in your Meta and Google account settings. To object to analytics or ads measurement, email us.

Browser signals.We don't currently respond to "Do Not Track" or Global Privacy Control signals.

US state laws.We don't sell personal information for money. Ads measurement may count as "sharing" or "targeted advertising" under some US state laws; the options above let you opt out.

Service emails (plan delivery, receipts, password resets and important account or policy changes) are part of the Service, and you'll get them while you have an account.

Training tips and offers. We email tips and offers if you tick the box in the quiz, and onboarding and product emails after you buy. Every marketing email has a one-click unsubscribe, and we act on unsubscribes straight away.

Push notifications only arrive if you allow them. Turn them off in your device settings or in the app.

We share personal information only with the companies below, and only for the purposes described. Most of them are our processors: they act only on our instructions and under contracts that protect your data. Where a company uses data for its own purposes, it's marked as independent.

We may also disclose information when the law requires it, to protect people's safety or our rights, or to a buyer if MatStrong is sold or merged. Any buyer would be bound by this policy.

We're based in Slovenia, and most of the companies above store data in the United States. Some also use servers in the EU and other countries. For transfers out of the UK, EU/EEA or Switzerland, we rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified. Otherwise we rely on the European Commission's Standard Contractual Clauses, with the UK addendum for UK data. Email us for a copy of the relevant safeguards.

If you're in Canada or Australia, your information is likely to be stored and processed in the United States and the EU. Authorities there may be able to access it under their laws.

Account, training profile and history

While your account exists.

After you delete your account

Removed from our live database straight away and from backups within 30 days. Copies held by our email and analytics providers are deleted when you ask us; email us.

Quiz answers and email if you don't buy

12 months after your last visit, then deleted.

Injury information

Until you remove it or delete your account.

Analytics and session replays

Up to 12 months.

Billing records

As long as tax and accounting law requires, which can be up to 10 years.

Records of your consents

While your account exists and for 3 years after, so we can show what you agreed to.

Support messages

Up to 2 years after the conversation ends.

Unsubscribe records

Kept, so we don't email you again.

Push tokens

Removed when you turn reminders off or they stop working.

We may keep information that no longer identifies you, such as aggregated statistics.

Everyone gets the same controls:

Access and copy

Export your training data in the app (Profile > Export training data). For a copy of everything we hold, email us.

Correct

Edit your profile in the app, or email us.

Delete

Profile > Delete account. This cancels billing and permanently erases your account, program and training history.

Withdraw consent

Remove your injuries in the app, unsubscribe from tips with the link in any email, or email us.

Object or restrict

Email us, for example to object to analytics or ads measurement based on legitimate interests.

We answer within one month and may need to confirm it's you first. We won't treat you differently for using your rights. Some choices do change what the Service can do: without injury information, for example, your plan can't adapt around an injury.

UK, EU/EEA and Switzerland

You have the rights to access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time. You can complain to the Slovenian Information Commissioner (ip-rs.si), the UK Information Commissioner's Office (ico.org.uk), or the data protection authority where you live. You don't have to contact us first.

Canada

You can access and correct your information, withdraw consent (subject to legal or contractual limits), and complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). In Québec, you can complain to the Commission d'accès à l'information (cai.gouv.qc.ca). Our privacy lead is responsible for how we handle your information.

Australia

You can access and correct your information. If you have a complaint, email us and we'll reply within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

United States

Residents of any state can use the controls above, including for health information such as injuries.

MatStrong is for people aged 18 and over, and we don't knowingly collect information from under-18s. If you believe someone under 18 has given us information, email us and we'll delete it.

Data is encrypted in transit and at rest by our hosting providers. Access to production data is limited to the people who run MatStrong and protected by strong authentication. Card numbers never reach our systems. No system is perfectly secure. If a breach puts your information at risk, we'll tell you and the relevant authorities as the law requires.

When we change this policy, we update the date at the top. For material changes, we tell you in the app and by email before they take effect.

Registered office

APPLICATION LAYER AI d.o.o., Col 92E, 5273 Col, Slovenia

Privacy

miha@matstrong.com

Support

support@matstrong.com