Privacy policy

Last updated: November 2, 2026

MASS Monster (“MASS Monster,” “we,” “us,” or “our”) operates the MASS Monster website, online store, and the MASS Monster mobile application (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you access or use our Services.

By using any of the Services, you acknowledge that you have read and understand this Privacy Policy.

1. Information We Collect

We collect personal information that identifies, relates to, describes, or can reasonably be associated with you.

Information You Provide

  • Account Information: Account details and preferences you choose to provide, such as a public name or email address; email/password credentials when you use that sign-in method

  • Purchase Information: Order history, products purchased, shipping details

  • Communications: Messages sent to customer support or through community features

  • User-Generated Content: Content you post within community, chat, or social features

Information Collected Automatically

  • Device Information: Device type, operating system, app version, IP address

  • Usage Information: App interactions, pages viewed, features used

  • Cookies & Similar Technologies: Used on our website to improve functionality and analytics

Mobile App-Specific Information

  • Location Data (Accountability): A fresh precise foreground location is required when you open Accountability and when you submit either a Gym or Home Workout check-in. For gym check-ins, we use it to find nearby gyms and verify proximity to the selected gym, and coordinates may be sent to our backend and Google Maps Platform. Saved gym and gym check-in records may store the selected gym's coordinates and verification metadata, but not the device coordinates used for verification. For Home Workout check-ins, device coordinates and proof metadata are sent to our backend for real-time validation and removed before the check-in is stored. By default, the signed-in check-in map may show an anonymous, aggregated area derived from your latest selected gym. To build that view, we store a coarse grid cell and area center on your private account; other members receive combined area counts without contributor names or individual gym coordinates. You can turn map sharing off in Privacy Settings, which clears that map location. Location is not collected in the background.

  • Authentication Data: Used to securely sign in and manage your account. You can create a private passkey account without providing a personal name or email address. We store passkey public keys, credential identifiers, signature counters and limited device/security metadata to verify sign-ins, manage credentials and prevent abuse. When you create or rotate a recovery code, it is displayed to you; we store its cryptographic hash rather than the raw code. Your device or credential provider keeps the private key and performs device verification. MASS Monster does not collect passkey private keys, fingerprints or facial biometric data. You can manage passkeys and request account deletion in the app. Short-lived challenge and security records support sign-in, recovery and deletion.

  • Purchase Validation: Used to confirm purchases and membership access

Role and Opportunity Applications

Information collected. If you apply through the MASS Monster app to become a Coach, Moderator, ALTA, or Coral Club Affiliate, we collect the information you provide with the application. This includes your contact number, preferred contact method (text or call), contact email, availability, prior experience, why you believe you are a good fit, and why you want the role or opportunity. Coach applications also include whether you create fitness content, your audience or reach across social platforms, your primary social platform, and whether you are interested in creating Coach or content-creator courses in the app.

How we use and protect it. We use this information to review the application, record an approval or decline and any applicant-visible decision note, and contact you about the role or opportunity. Application information is not added to public profiles and is handled through authenticated applicant features and protected administrative tools.

Retention and Coral Club applications. Application records are retained with your MASS Monster account until the account is deleted, subject to any limited retention required by law. Applying as a Coral Club Affiliate does not create an app role or automatically send your information to Coral Club. MASS Monster administrators may use the contact details you provided to follow up with you about the opportunity.

2. How We Use Your Information

We use personal information to:

  • Provide and operate the Services

  • Process purchases and manage accounts

  • Enable community features and user interaction

  • Improve app and website performance

  • Communicate with you about updates, orders, or support

  • Prevent fraud, abuse, and unauthorized access

  • Comply with legal obligations

3. User-Generated Content & Community Safety

Our Services may allow users to create or share content. We reserve the right to:

  • Remove content that violates our Terms of Service

  • Restrict or terminate accounts for abusive or harmful behavior

  • Review and act on reported content within a reasonable timeframe

Users can report objectionable content and block other users through available in-app tools.

Community safety checks

Community safety screening is required before publishing the new content listed below. We ask for explicit permission before sending newly submitted public profile names, biographies, profile photos and public coach banner photos; chat or direct-message text and photos; stories and shared workout text; public playlist titles and links; or custom administrator welcome and broadcast content to OpenAI for safety checks. Selected photos and their thumbnails may both be checked. We do not send unrelated conversation history, unshared fitness or health records, account credentials, or billing records for these checks. Content that fails the checks is not published.

Only newly submitted or changed profile content is checked; existing profile content is not sent for a new check merely because you sign in or update the app. You can decline and continue signing in, completing account setup, reading and using private app features. Your existing profile remains unchanged, and new accounts can use the default MASS Member name without sending a custom name to OpenAI. Publishing new custom profile content or other content that requires these checks will be unavailable until you allow the checks. You can withdraw permission under Privacy settings > Community safety checks. Withdrawal stops future checks and the related publication flow; it does not remove content already posted or recall earlier provider requests. Reporting and blocking remain available. The existing retention and deletion choices for posted content continue to apply.

4. How We Share Information

We may share personal information with:

  • Service Providers: Payment processors, hosting providers, analytics tools

  • Shopify: To operate and support our online store

  • Legal Authorities: When required by law or to protect rights and safety

  • Business Transfers: In connection with mergers, acquisitions, or restructuring

We do not sell personal information.

5. Data Retention & Security

We retain personal information only as long as necessary to:

  • Provide the Services

  • Comply with legal obligations

  • Resolve disputes and enforce agreements

We use reasonable security measures to protect your information, but no system is 100% secure.

Account and data deletion

You can delete a MASS Monster app account in the app at Profile > Settings > Profile & account > Delete Account. You must reauthenticate and type DELETE. You may also request complete or category-specific deletion without installing the app by following the instructions at https://massmonster.life/pages/mass-monster-account-data-deletion or by emailing support@massmonster.life. We may verify account control before acting on an email request.

When account deletion completes, we delete the Firebase Authentication account, private user-document tree and subcollections, hosted profile media, authored community and direct-message content and media, retained stories and exports, Nutrition AI source media and exports, related coach and Crew records, and user-addressed notifications. Reply snapshots are scrubbed, and issued subscription-reward discounts are deactivated when applicable.

We retain a minimal “Deleted User” tombstone containing the Firebase user ID, deletion timestamp, and deletion source, and the account-deletion request/status record containing processing and retry metadata. The current system has no fixed expiry for those content-free technical records because they prevent restoration, document completion, and support reliable deletion retries. Safety and moderation reports, system audit records, fraud-prevention records, and records needed for disputes or legal compliance may be retained only as long as reasonably necessary for those purposes. System moderation messages may be reattributed to “system,” and authored content is removed.

Content-free pseudonymous Nutrition analytics events expire after 90 days; non-reversible aggregate daily metrics may remain. OpenAI may retain earlier AI request content for safety and abuse monitoring for up to 30 days under its standard API controls, with limited safety-review exceptions. Apple, Google, RevenueCat, Shopify, payment processors, and MASS Monster may retain purchase, order, subscription, tax, fraud-prevention, dispute, or legal-compliance records for the applicable provider-policy or legally required retention period. Deleting the MASS Monster account does not cancel Apple App Store or Google Play billing.

6. Your Rights & Choices

Depending on your location, you may have the right to:

  • Access your personal information

  • Request correction or deletion

  • Object to certain data uses

  • Withdraw consent where applicable

Requests can be made by contacting us using the information below.

7. Children’s Privacy

The Services are not intended for children under 13 (or under the age of majority in your jurisdiction). We do not knowingly collect personal information from children.

8. International Data Transfers

Your information may be processed outside your country of residence. We take steps to ensure appropriate safeguards are in place.

9. Third-Party Services & Links

The Services may include links to third-party websites or services. We are not responsible for their privacy practices.

Bio measurements and connected device health

Bio may store bodyweight, waist and abdomen measurements you submit and strength estimates derived from your training. If you choose to connect Apple Health (HealthKit) or Android Health Connect, MASS Monster requests read access only to the categories you select: weight, sleep, steps, recorded exercise/cardio, pulse/heart rate, and blood pressure. We do not write to or change the original health records. Imported weight is a suggestion until you review and submit it.

Selected sleep, step, exercise, pulse and blood-pressure summaries are saved to your private MASS Monster account with dates, relevant reading times, source/provider information, and device-sync identifiers needed to keep the connection accurate. They support the Bio views and health/fitness features you request. Your coach and authorized administrators can view only the Bio measurement, activity or vital categories that you separately enable for that recipient. Connected sleep, step, exercise, pulse and blood-pressure summaries are excluded from coach-assisted OpenAI context.

You can stop future imports by disconnecting in Bio connections or revoking the operating-system permissions. Disconnecting alone does not delete previously imported summaries. Use the deletion controls in Bio connections or Privacy settings to remove supported health data or date ranges; deleted ranges are suppressed from reimport. Stored history otherwise remains until you delete it or delete your account, subject to the limited retention described above.

9A. Nutrition, AI, and Coaching Data

Eligibility and information collected. Nutrition is available only to adults age 18 or older. Depending on the features you choose, we may process nutrition entries and nutrient snapshots, meal plans, grocery lists, dietary preferences and restrictions, bodyweight entries, calculated or manual targets, training sessions, performance data, and exercise-specific notes, accountability activity, reminders, AI draft metadata, consent records, and coach-access records. Calculation inputs may include age, height, weight, activity level, goal, and a private metabolic-calculation sex selection. Missing nutrients remain unknown rather than being treated as zero.

Purposes. We use this information to provide the diary and calendar, calculate and adapt targets, generate editable meal and guidance drafts, produce weekly reviews and exports, operate reminders, prevent abuse, enforce quotas, support account deletion, and provide features you explicitly request.

AI media and OpenAI. If you separately consent to photo or voice entry, a meal image or audio recording is sent temporarily to OpenAI for moderation, transcription when applicable, and generation of an editable draft. OpenAI output is not trusted as confirmed nutrients or URLs; MASS Monster maps usable candidates to canonical food records, and you must review portions, oils, sauces, and mixed-dish assumptions before confirmation. Responses API requests set store:false. MASS Monster has disabled optional API input/output sharing for model improvement. OpenAI may nevertheless retain certain Responses content for safety and abuse monitoring for up to 30 days under its standard API controls, and limited safety-review exceptions may apply to image inputs. We do not claim Zero Data Retention or Modified Abuse Monitoring.

USDA food data. Food text searches and barcode lookups may send the search term or product code to USDA FoodData Central. USDA results and their provenance may be cached to provide the feature. Meal photos and voice recordings are not sent to USDA.

Companion food suggestions. After you log one food, MASS Monster may use your confirmed diary history from the latest 14 diary days and an audited in-app pairing catalog to offer optional foods and editable serving quantities. Curated and history suggestions do not send these suggestion inputs to OpenAI unless you separately enable AI-ranked food suggestions. With that feature enabled, OpenAI receives only the logged food and serving, meal type, food names already in the current meal, your explicit dietary pattern, allergies, restrictions, and dislikes, and opaque identifiers for the app-approved candidates. OpenAI may filter or rank only those approved identifiers and cannot invent or add a food, quantity, nutrient value, URL, or diary entry. Requests use store:false; standard abuse-monitoring retention may apply for up to 30 days. Suggestion-request metadata expires after 30 days. You may decline or revoke this consent in Nutrition Settings. A suggestion never enters your diary unless you review and confirm it.

Personal training — disclosure updated September 18, 2026. In app version 1.0.23 and later, the former Pro-only, 30-day Nutrition coach grant is retired. Personal training does not require a paid membership. Applying to a coach requires a separate, explicit data-sharing choice naming that coach. An application alone does not give the coach access to private fitness records. If accepted, one active coach may view retained past and future fitness goals, login and app activity, workout splits, exercise weights and reps, accountability check-ins with their recorded locations and retained check-in photos, bodyweight, and available Nutrition logs, targets, plans, and reviews. Nutrition categories remain limited to eligible adults. Other clients cannot view these private records. Private conversations with other members, unrelated stories, billing information, and AI source files are not shared through this grant. Sharing is checked on each protected request and continues until the relationship ends; it does not automatically expire after 30 days. You can withdraw a pending application. To end active sharing, block the coach from their profile, ask the coach to remove you, or contact MASS Monster administration. Blocking by either party, coach or admin removal, or relevant account/role ineligibility ends protected access. Unblocking does not restore the relationship. Administrators can inspect coach rosters and remove clients; roster administration alone does not grant private fitness-record access. Access and relationship changes are audit logged. Ending a relationship revokes coach access but does not delete your underlying history; the deletion and retention choices below remain available.

Optional coach-assisted AI. With a current recorded coaching-AI permission, approved fitness records may be sent to OpenAI to help your coach review progress and draft workouts. This includes the approved goals, workout history, exercise prescriptions, bodyweight and shared Bio measurements or strength information, with Nutrition history included only under the separate applicable Nutrition consent. Photos, locations, private messages, billing records, coach private notes and connected device-health summaries are excluded. Your coach reviews drafts before sending them.

In the updated app, coaching-AI permission is an optional choice separate from the required Terms and ordinary coach/administrator data sharing. Declining or withdrawing AI permission does not remove ordinary app or human-coaching access. You can change it under Privacy settings > Coaching AI when that control is available in your version; otherwise contact support@massmonster.life for help withdrawing it. Withdrawal prevents future coaching-AI processing; it does not delete your fitness history or recall earlier provider requests. Existing category-sharing choices and the provider retention described above still apply.

Administrative fitness access. Where you permit administrative fitness-data sharing, authorized MASS Monster administrators can view the covered fitness records. This permission is separate from roster management. Bio measurement, activity and vital sharing uses the separate coach and administrator choices in Bio privacy settings.

Retention. Confirmed nutrition, bodyweight, training, and review history remains until you delete an item or range or delete the account. Temporary meal images and audio are deleted from MASS Monster storage after processing; orphan cleanup targets files older than one hour. AI request metadata expires after 30 days, generated PDF exports after 24 hours, and content-free analytics events after 90 days. Account deletion also removes Nutrition media and export storage prefixes, subject to legal obligations that require limited records to be retained.

Analytics and sharing. Nutrition analytics use allowlisted, content-free event names and a secret-derived pseudonymous actor key. Analytics do not include food names, calories, macros, weights, coach identifiers, photos, or transcripts. Redacted summary cards are shared only when you choose to share them. Exercise-specific notes may be included in MASS Coach only when you enable its existing fitness personalization. Detailed Nutrition history is included only after separate Nutrition personalization consent.

Your choices. Manual logging can be used without AI media. Reminders are opt-in. After completing estimated setup, you may manually adjust your calorie and macronutrient targets, withdraw AI or Coach personalization consent, revoke coach access, delete supported items or ranges, request an export, or delete your account.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised “Last updated” date.

11. Contact Us

If you have questions about this Privacy Policy or your personal information, contact us at:

Email: support@massmonster.life