Privacy Policy for Mazao
Last updated: 6 August 2026
Mazao is a workout tracking application published by Djinn Foundry S.L.
What we collect
Your training data never leaves the device. We do not receive your workout history, your body measurements, your notes, or anything you record. There are no user accounts and no advertising.
Three things do leave the device, and they are listed here in full.
Exercise images. Exercise illustrations are fetched from wger.de when you view them. Those requests reach wger.de and, like any web request, expose your IP address to that server. They carry nothing about you or your training. The app works without them; if the images cannot load, everything else still does.
Crash reports, in the version published on the store. The store build sends crash and error diagnostics to Sentry so that a crash can be fixed. A report contains the technical state of the failure - device model, operating system version, and the code path that failed. It does not contain your training data. Only failures are sent: the app does not sample performance traces or profiles from a normal session. Builds compiled without a Sentry key, including every debug build, send nothing.
Product analytics, only if you turn them on. Off by default. If you enable it in Settings, the app sends two events to PostHog (EU servers):
| Event | What it carries |
|---|---|
| A workout was completed | The number of workouts completed so far, as a count |
| The app was opened | How many whole days since install |
Those two counters are what Mazao chooses to send. PostHog's own software adds some technical context to every event - your platform, operating system and app version, language and timezone - and creates a random identifier so that repeated events can be counted as one person. That identifier is not your name, your email or your device's serial number, and it is not derived from anything you record.
What is never sent: exercise names, weights, repetitions, dates, notes, measurements. The events are processed on servers in the European Union.
You can turn it off at any time in Settings. Doing so stops the sending, drops anything still queued, and discards the random identifier. While it is on, Settings displays that identifier so that you can quote it if you want your events deleted.
What the app stores on your device
Everything you enter stays on the device where you entered it:
- workout sessions, exercises, sets, repetitions, weights and perceived effort
- body measurements you choose to record
- notes, milestones and app preferences
- an optional PIN, and the setting that enables biometric unlock
This data is held in an encrypted database on the device. The encryption key is kept in the operating system's secure storage (Android Keystore). Uninstalling the app removes it. You can also erase everything from within the app, in Settings, under Reset Data.
Backups you create
The app can export a backup file containing your data. That file is created at your request and goes wherever you send it. Once you share it - to cloud storage, to another device, to anyone - it is outside the app's control and subject to whatever service you sent it to. We never receive a copy.
Permissions
- Notifications and alarms and reminders: to show rest timers and the workout reminders you schedule.
- Run at startup: to restore those scheduled reminders after the device restarts.
- Vibration: for timer and notification feedback.
- Biometrics: only if you turn on the optional app lock. Biometric matching is performed by the operating system; the app receives only a success or failure result and never sees your fingerprint or face data.
- Network access: used for the three things listed under What we collect - fetching exercise images, sending crash reports in the published build, and sending the two usage counters if you have switched them on. Every feature of the app works without a connection.
Children
Mazao is not directed at children. Nothing the app sends identifies anyone, at any age: crash reports describe a failure, and the optional usage counters are two numbers. We hold no account, no email and no profile for any user.
Changes
This policy is updated before a version that changes what leaves the device is published, and the change is described in the release notes. The list under What we collect is complete: if something is not on it, the app does not send it.