Privacy policy

Who may use Molda

Molda is intended only for people aged 18 or older. We do not knowingly collect data from children or teenagers.

Data we process

• Account: name, email, hashed password, language, and acceptance records.
• Optional profile: date of birth, gender, height, weight, experience level, and workout preferences.
• Training: routines, exercises, sets, loads, repetitions, RPE/RIR, duration, notes, and history.
• Uploads: images or videos added when creating an exercise, including file name, type, and size.
• Technical and security data: IP address, sessions, tokens, error logs, and minimal interactions with in-app guides.
• On-device data: access token, preferences, unsynchronized active workouts, and notification settings.

Purposes and legal bases

We use data to create and protect your account, synchronize and display workouts, support custom exercises, deliver requested local alerts, provide support, prevent abuse, fix faults, and comply with law. Processing relies on providing the requested service, legal obligations, legitimate interests in security and improvement, and consent where required. Voluntarily provided health-related data receives enhanced protection.

Permissions and notifications

Molda requests media-library access only when you choose to upload an exercise photo or video. Notification permission is used only for local workout alerts, not advertising. You may optionally enable workout export to Apple Health on iOS or Health Connect on Android. On your device, Molda writes only completed workout sessions with their title, start and end times, and strength-training classification. Molda does not read or import data from these services and does not send HealthKit or Health Connect data to the Molda API. You can disable this export in the app at any time; disabling it does not remove workouts already written to Apple Health, Health Connect, or services you connect to Health Connect, such as Samsung Health.

Providers and international transfers

Core infrastructure runs on a DigitalOcean droplet in the NYC1 region in the United States, protected by Cloudflare. We may also use Expo/EAS, Apple, and Google to distribute the app and Sentry for error diagnosis when enabled. Providers process only data needed for their service and may make international transfers under contractual and security safeguards. OpenAI-assisted translation is used while preparing the catalog, not to send your personal data at runtime.

Sharing

We do not sell data and do not use advertising or cross-app tracking. We share data only with service providers, where needed to protect rights and safety, or when legally required.

Retention and deletion

• Account and training data remain while the account is active and are removed from the live database immediately after confirmed deletion.
• Identifiable technical logs are kept for up to 90 days.
• Backups are overwritten within 30 days, remain isolated, and are used only for disaster recovery.
• On account deletion, exercise uploads are erased. An exercise already used by others may remain without media or a link to you; if unused, it is deleted entirely.

Your rights

You may request confirmation and access, correction, portability where applicable, sharing information, review of automated decisions, objection, anonymization, blocking or deletion, and withdrawal of consent. You may also complain to Brazil’s National Data Protection Authority.

Security and changes

We use access controls, encryption in transit, password hashing, and safeguards proportionate to risk. No system is infallible. Material policy changes will be communicated in the app and may require renewed acceptance.