FMAPrivacy Policy
Last updated September 30, 2026
This policy explains what information FMA Soul (the mobile app and this website, together the “Service”) collects, why, who else handles it, and the choices you have. The Service is operated by Lionel Castro (“we”, “us”).
The short version: we collect only what’s needed to run your account and your membership. We don’t sell your data, we don’t show ads, and we don’t use third-party analytics or tracking. You can delete your account at any time.
1. Information we collect
You can use the app without an account
The free foundation drills work without signing in. When you use the app signed out, we don’t receive any personal information about you. Your settings and your acceptance of our notices stay on your device.
Account information
When you sign in with Apple, Google, or Microsoft, that provider shares with us, and we store:
- a unique account identifier;
- your email address and whether it is verified. If you use Apple’s “Hide My Email”, we only see the relay address;
- your name, profile photo URL, and phone number, if the provider shares them.
We never see or store your password for those providers.
Training data
- playlists you create (names, the drills in them, and their settings);
- playlists you save to your list;
- your acceptance of our physical-training risk notice and these terms: which version you accepted, when, and whether it was in the app or on the website.
Membership and payment information
If you become a paying member, payments are processed by Stripe. Your card details go straight to Stripe and never reach our servers. We store:
- your Stripe customer and subscription IDs;
- your plan, billing interval, the amount you chose to pay, and your renewal date;
- the country you picked for regional pricing, and the country of your billing address. We compare the two to spot pricing abuse.
Technical information
- Server logs: for each request to our server we log the time, the address requested, the result, and your account identifier if you’re signed in. We use your IP address only briefly and in memory, to limit request rates and to estimate which country you’re in; we don’t store the IP address itself. Our hosting providers may keep their own network logs.
- Approximate country: if you’re signed in, we save the country estimated from your IP address to your account, so we can see roughly where our members are. We don’t use it for pricing, and it’s never more precise than the country.
- On your device: the app stores your settings, the drill catalog, drills you choose to download, and your acceptance of our notices. These stay on your device until you delete them or uninstall the app.
What we don’t collect
We don’t collect your precise location, contacts, photos, health or fitness data, or advertising identifiers. We don’t use analytics or crash-reporting SDKs, and we don’t track you across other companies’ apps or websites.
2. How we use it
- to sign you in and keep your account and playlists in sync across your devices;
- to work out which drills your membership includes, and to deliver them;
- to bill your membership and handle renewals, cancellations, and fraud checks;
- to keep a record that you accepted our risk notice and terms;
- to keep the Service secure and working, and to answer your support requests;
- to understand, in aggregate, which countries our members come from;
- to meet our legal obligations, for example keeping tax and accounting records.
If you’re in the EEA or UK, our legal bases are: performing our contract with you (your account, membership, and training data); legal obligation (billing records); and legitimate interests (security, fraud prevention, consent records, and country-level usage statistics).
3. Who we share it with
We don’t sell or rent your personal information, and we don’t share it for advertising. The companies below process it for us to run the Service, under their own security and privacy commitments:
| Provider | What they do |
|---|---|
| Google Firebase | Sign-in (account identifier, email, name, photo) |
| Apple, Google, Microsoft | The sign-in provider you choose |
| MongoDB Atlas | Database for your account, membership, and playlists |
| Railway | Hosts our server |
| Cloudflare | Stores and delivers training videos and audio |
| Stripe | Payment processing and billing records |
| GitHub | Hosts this website |
We may also disclose information if the law requires it, to protect someone’s safety, or as part of a merger or sale of the Service. In a sale, this policy would continue to apply to your information.
These providers may process data outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the EU Standard Contractual Clauses.
4. How long we keep it
- Account and training data: until you delete your account. We then remove it from our live database right away.
- Payment records: Stripe keeps invoices and charges as long as tax and accounting law requires, even after you delete your account.
- Server logs: kept for a limited time for security and debugging, then deleted.
5. Your choices and rights
- Delete your account: in the app, open the settings drawer and tap Account → Delete account. Or use our account deletion page. This permanently removes your account, playlists, and consent records, and ends any active membership.
- Access, correct, or export your data: email support@fmasoul.com and we’ll reply within 30 days.
- Downloaded drills and settings: delete them in the app, or uninstall it.
Depending on where you live (for example, in the EEA, the UK, or California), you may have the right to access, correct, delete, or port your data, and to object to or restrict how we process it. You can also complain to your local data protection authority. We don’t “sell” or “share” personal information as the CCPA defines those terms. We will never treat you differently for exercising your rights.
6. Security
All traffic is encrypted in transit (HTTPS). Training media is served through short-lived signed links. Only our server can read the database, and payment details never touch our systems. No system is perfectly secure, but we’ll notify you and the authorities of a breach as the law requires.
7. Children
The Service is not directed to children under 13, and you must be at least 13 (or the minimum age of digital consent where you live, if higher) to create an account. If you believe a child has given us personal information, contact us and we’ll delete it.
8. Changes to this policy
We’ll post any changes here and update the date at the top. If a change is significant, we’ll ask you to review and accept it the next time you open the app or the website.
9. Contact
Lionel Castro
5319 University Dr #10166, Irvine, CA 92612
support@fmasoul.com