Privacy policy

This policy covers the Kustos app for iOS and Android and the kustosapp.com website. It explains what we collect in each mode of use, who processes it, how long it is kept, and the rights you have over it.

Who we are

Kustos is a workout tracking app for iOS and Android, operated by Mountain Crest Agency FZCO, a company registered in Dubai, United Arab Emirates. We are the data controller for the personal data described in this policy. You can reach us any time at support@kustosapp.com.

What we collect

What we collect depends on whether you use Kustos as a guest or with an account.

Guest mode

You can use Kustos without signing up. In guest mode:

• Your workout data stays on your device. Workouts, routines, custom exercises, body measurements, and settings are stored locally. Logging never needs a connection.
• No account is created on our servers. A guest has no account record of any kind on our backend. If you later sign up, the history on your device is attached to your new account at that moment — nothing exists server-side before it.
• Analytics and crash telemetry run. We collect pseudonymous usage events and crash reports (described in the processor table below) to understand how the app is used and to fix bugs.

Signed-in accounts

If you create an account, we additionally collect and process:

• Account details: your email address, name, username, and sign-in credentials.
• Synced workout data: your workouts, routines, custom exercises, and personal records, synced to our backend so they are available if you switch devices.
• Body measurements: if you choose to track them (see the dedicated section below).
• User content: anything you choose to share through the optional social features — posts, workout photos, comments, and your profile. Social features are private by default; nothing is shared unless you share it.
• Push notification token: if you enable notifications, so we can deliver them.

The kustosapp.com website

The website works without cookies or signup. Two things involve personal data:

• Launch waitlist: if you submit your email address, we store it (with the time you joined) so we can send you one notification when Kustos launches. Legal basis: your consent. We delete waitlist entries after the launch mailing, or earlier on request.
• Site analytics: if enabled, we use Cloudflare Web Analytics, which is cookie-less and does not track you across sites.

Who processes your data

We use a small set of service providers (“processors”) to run Kustos and this website. This is the complete list:

There are no advertising SDKs in Kustos, and we do not sell personal data. Each processor is bound by a data processing agreement and processes data only on our instructions.

How long we keep your data

• On-device data (guest and signed-in): stays on your device under your control until you remove it or uninstall the app. This includes the app’s automatic versioned backup snapshots, which are files on your device.
• Signed-in account data: kept for as long as your account exists. When you delete your account, it is removed as described below.
• Waitlist emails: deleted after the launch mailing, or earlier on request.
• Analytics and crash data: retained by Google Firebase for the limited retention window set in our configuration, then deleted or aggregated.

Deleting your account

Account deletion is fully implemented in the app — it is not a support-ticket queue. When you use Delete Account in Settings, our backend runs a deletion cascade: your synced workouts, routines, custom exercises, body measurements, posts, comments, follows, and the account record itself are permanently removed. If you want stored media files (workout photos, profile pictures) scrubbed immediately as well, tell us at support@kustosapp.com and we will confirm their removal. Data stored only on your device remains under your control; you can remove it by deleting the app.

If you prefer, you can also request deletion by emailing support@kustosapp.com from the address on your account. Step-by-step instructions are in the account deletion guide.

Your rights under the GDPR

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, you have the right to:

• Access the personal data we hold about you.
• Rectification — correct inaccurate data (most account details can be edited directly in Settings).
• Erasure — delete your data, via Delete Account in the app or by contacting us.
• Restriction — ask us to limit processing in certain circumstances.
• Portability — receive your data in a machine-readable format. The in-app CSV export gives you your full workout history and your body-weight log (measurement export currently covers date and weight) at any time, and it is never paywalled. See how to export.
• Objection — object to processing based on legitimate interests, including analytics.
• Complaint — lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first, but you are not required to contact us before doing so.

To exercise any of these rights, email support@kustosapp.com. We respond within one month.

Legal bases for processing

International transfers

The processors listed above may process data in the United States and other countries outside your own. Where personal data is transferred out of the EEA or UK, the transfer relies on an adequacy decision or on Standard Contractual Clauses (and the UK equivalent) included in each processor’s data processing terms, together with the processor’s supplementary safeguards.

Your California privacy rights

If you are a California resident, the CCPA/CPRA gives you rights to know, delete, and correct personal information, and to opt out of “sale” or “sharing”.

• We do not sell personal information, and we have not sold it in the preceding 12 months.
• “Sharing”: whether our analytics configuration constitutes “sharing” as the CPRA defines it is currently under legal review. Until that review concludes, you can email support@kustosapp.com with the subject “CCPA opt-out” and we will honor the request.
• Sensitive personal information: whether body measurements qualify as “sensitive personal information” under the CPRA is under the same review. We already apply heightened handling — we do not use them for analytics or advertising — and you can request limits on their use via the same address.
• We do not discriminate against you for exercising any of these rights.

Body measurements and health-related data

If you track body measurements (such as weight), we treat that data with heightened care. For guests it is stored on your device; for signed-in users it syncs to our backend so it is available across your devices. We do not use body measurements for analytics or advertising. Your body-weight entries are included in your CSV export, and all measurements are removed by the account deletion cascade.

In some jurisdictions, body measurements may qualify as health-related data (for example, special-category data under GDPR Art. 9). Whether that classification applies to Kustos, and whether it requires an explicit-consent step in the app, is under legal review. In the meantime we apply the heightened handling described here regardless of classification.

Children’s privacy

Kustos is for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact us at support@kustosapp.com and we will delete the account and its data.

Changes to this policy

We may update this policy as the app evolves or the law requires. The date at the top of this page always reflects the latest revision. For material changes, we will give notice in the app or by email before the change takes effect.

How to contact us

For any privacy question, rights request, or complaint:

• Email: support@kustosapp.com
• Post: Mountain Crest Agency FZCO, Dubai, United Arab Emirates

This policy is effective as of July 13, 2026. See also our terms of service, community guidelines, and the plain-language your data page.