← Malm

Privacy Policy

Malm workout app · Last updated 16 August 2026

Malm Development does not collect your personal data. There is no Malm account, server or analytics. Android system backup may copy eligible app data if enabled on your device. If you connect optional Google Drive backup, Malm encrypts the backup on your phone with a password only you know before uploading it.

Malm is developed by Malm Development, a one-person studio based in Norway. This policy covers the Malm Android app.

What the app stores, and where

Everything you enter stays in the app's private storage on your device:

• workouts, sets, programs, exercises, personal records and goals
• body weight, body measurements, and - if you turn them on - cycle entries and sleep entries
• injuries and pain logs
• progress photos you add, copied into the app's own private folder and encrypted at rest
• your app settings; the progress-photo encryption key is stored separately, protected by Android Keystore and optionally by your PIN

The app does not transmit this data to Malm or any service operated by Malm, and Malm operates no service that could receive it. If Android system backup is enabled, Android may store an encrypted copy of eligible database and settings data in the user's backup account or transfer it directly to a new device. Progress photo files and their device-bound key are excluded from Android system backup, though photo records in the database may still transfer. Restoring only through Android may therefore leave photo records without viewable images; use a password-protected Malm backup to move photos. Local data is removed when you uninstall the app or use Settings → Data → Delete all data; an Android system backup may remain available for reinstall or device transfer.

Data you move yourself

Backups

You can export a backup file containing your database, your progress photos and your portable settings. Backups can be protected with a password; encryption is required when a backup contains progress photos so their key can move safely with them. Malm cannot recover that password. You choose where the backup is written, including an optional automatic daily backup to a folder you select. Once a backup leaves the app, it is under your control, and any cloud service you point it at is governed by that service's own terms.

Google Drive backup (optional)

If you connect a Google account under Settings → Data, Malm keeps a daily encrypted backup in a folder called "Malm" in your own Google Drive. The file is the same password-protected envelope described above: it is encrypted on your phone before the upload, and your password is never transmitted, so Google - and anyone else holding the file - stores bytes they cannot read. Malm requests only the drive.file scope, which grants access to files the app itself created and to nothing else in your Drive. The upload runs on Wi-Fi, older copies are thinned out to seven daily, four weekly and three monthly, and Settings offers both Disconnect and Delete copies in Drive. Your use of Google Drive is governed by Google's own terms and privacy policy. This feature is off until you turn it on, and Malm does not upload a Drive backup before you do. Android system backup is separate and follows your device backup settings.

Program sharing

You can export a program as a file and share it however you like. It contains only the program itself - no history, no body data.

Imports

Files you import from FitNotes, Strong, Hevy or Strava are read on your device only.

Permissions and system access

• Notifications - rest timer alerts, ongoing workout status and weigh-in reminders.
• Vibration - vibrating when a rest timer ends, if you have that enabled.
• Exact alarms - firing the rest timer and reminders at the right moment.
• Run at boot - rescheduling your reminders after a restart or app update.
• Notification access (optional) - only if you enable in-session music controls, so the app can show and control the media player you are already using. Notification content is never read, stored or transmitted.
• Photo picker and camera app (optional) - used only when you add a progress photo yourself. Malm uses Android's system picker and camera app and does not request broad photo-library or camera permission.
• Internet - used only by the Google Drive backup. No other feature opens a connection, and no traffic happens at all until you connect an account yourself.

Third parties

There are no analytics SDKs, advertising SDKs, crash reporting services or payment SDKs in the app.

If you connect the Google Drive backup, the app uses Google's authorization library to obtain permission for the drive.file scope and uploads the encrypted backup file to your own Drive. That is the only third-party service the app talks to, it only happens after you connect it, and what Google receives is ciphertext plus the file's name and size. Google's own terms and privacy policy govern what they do with the file you store there. No data is shared with anyone else.

Two buttons open external websites in your own browser: the donate button (ko-fi.com/malm_development) and any support link. Once your browser is open, that site's privacy policy applies, not ours. Malm sends no information along with the link.

Children

Malm is not directed at children under 13 and collects no data from anyone.

Your rights

We hold nothing, so there is nothing for us to access, correct or delete on your behalf. You have full control: export your data, erase all of it from Settings → Data → Delete all data, and - if you connected Google Drive - remove every copy from there with Settings → Data → Google Drive → Delete copies in Drive, or delete the "Malm" folder in Drive yourself.

Changes and contact

If this policy changes, the updated version will be published here with a new date.

Questions about privacy: malm_fitness@pm.me