Privacy Policy

MAVIR may collect account information such as your name, email address, authentication method, email verification status, and login activity. If you create an email/password account, your password is stored only as a secure hash.

During onboarding and profile setup, MAVIR may collect fitness and profile information such as age, gender, primary and secondary goals, experience level, workout location, available equipment, workout days, workout duration, injuries or limitations, height, weight, training preferences, and related profile settings.

MAVIR stores workout plans, workout logs, completed sets, exercise feedback, personal records derived from workout logs, nutrition entries, favorite foods, weight logs, lesson progress, onboarding progress, and settings needed to show your dashboard and progress views.

Current nutrition logging is manual. Barcode scanning, meal photo scanning, nutrition AI, AI Coach, weekly AI reports, and automatic progression remain disabled unless a future approved phase changes that.

Members may upload images for their own member-created exercises. Admins may upload images for global exercises. These image files are stored in a private AWS S3 bucket and are shown through short-lived signed URLs. MAVIR does not intentionally make the upload bucket public.

MAVIR uses NextAuth for sessions and supports email/password login and Google Sign-In. If you use Google Sign-In, Google provides account details needed to authenticate you, such as verified email status and provider account identifiers.

MAVIR uses Resend to send transactional email such as email verification and password reset messages. These emails may include your email address, sender details, and one-time verification or reset links.

MAVIR uses deterministic training rules for workout splits, weekly volume, progression, movement requirements, and exercise selection. AI does not make or replace those programming decisions.

If optional AI coaching or explanation features are enabled later, they may explain the existing plan using workout-relevant inputs. MAVIR should not send member name, email, user id, admin id, API keys, raw audit logs, unpublished drafts, archived Coaching Brains, or training chat messages to OpenAI.

MAVIR uses PostgreSQL for app data, AWS S3 for private exercise image storage, Resend for transactional email, Google for optional Google Sign-In, and OpenAI only for separately enabled workout-generation assistance or coaching explanations. Provider access is configured through owner-controlled secrets and production infrastructure.

You can update profile and settings information in the app where available. You can request help, account deletion, or questions about your data by emailing support@mavir.co.

Some records may be retained when required for security, fraud prevention, legal, or operational reasons. We will explain any retention that applies when responding to a deletion request.