CaliRealm Privacy Policy
Last updated: 2026-08-28 Effective date: 2026-08-28
Plain-language summary (not a substitute for the full policy): CaliRealm is a calisthenics training app. We build you a training program, log your workouts, and use your phone's camera to count your reps, time your holds, and analyse your form. If you choose to save them, we store your recordings. We treat body and performance data as sensitive. We use a third-party AI provider (OpenAI) to generate form feedback. Some things are public to other users by design: your display name, avatar, rank, level, streak, and league standing appear on leaderboards and your profile, and anything you post in the community is visible to others. Your email, onboarding answers, body measurements and payment data are never published. We never sell your data. You can delete your recordings, your posts, and your account at any time.
1. Who we are (Data Controller)
CaliRealm ("CaliRealm", "we", "us", "our") is operated by:
- Legal name: Sjakie Minet, trading as CaliRealm (eenmanszaak / sole proprietorship)
- Registered address: Amnestylaan 145, 4336 LL Middelburg, Netherlands
- Chamber of Commerce (KvK) number: 93183208
- VAT (BTW) number: NL005003670B69
- Privacy contact: info@calirealm.com
We are the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer; you can reach our privacy contact above for any data-protection question.
This policy applies to the CaliRealm app (at app.calirealm.com, in the browser or installed on your device), the CaliRealm pages at calirealm.com, and related services (together, the "Service").
2. Scope and your age
The Service is intended for users aged 16 and over. We do not knowingly collect data from anyone under 16. If you are under 16, do not use the Service. If we learn we have collected data from someone under 16, we will delete it. Contact us at the address above.
3. What data we collect
3.1 Data you give us
- Account data: email address, password (stored hashed), display name, avatar, and (if you provide them) profile details such as your training level or goals. If you sign in with Google or Apple instead of a password, we receive from them the email address (or Apple's private relay address) and the name attached to that sign-in, and no password is created. While early access is invite-only, we also record the invite code you used.
- Onboarding & training profile data: the answers you give when setting up the Service, such as your sex, date of birth, experience level, training goals, current strength (for example, how many strict pull-ups you can do), available equipment, and how often you want to train. These are used to build your program. Accounts created with earlier versions of the setup may also have provided country, height, and weight.
- Community content: posts, comments, and replies you publish to the community feed or forum, and reports you submit about other users' content.
- Friend connections: the friend requests you send and accept.
- Subscription & payment data: subscription plan, status, and billing records. Card details are processed by our payment provider, and we do not store your full card number. See §6.
- Communications: messages, support requests, and beta feedback you send us.
3.2 Data created when you use the Service
- Camera / video recordings. When you train, the app uses your device camera. Clips you save yourself are stored so you can review them. In the workout player, a clip of each tracked set is saved automatically by default so your training history keeps the video; you can turn this off at any time in the app settings ("Save my set clips"). Turning it off does not affect rep counting.
- Pose & form data. We derive body-position data (skeletal landmarks, joint angles, silhouette-based measurements, repetition counts, hold duration) from the camera feed to count your reps, time your holds, and analyse your form.
- AI feedback data. The form feedback generated for your sets, and the inputs used to generate it.
- Training & workout data. The programs assigned to you, the sessions and sets you complete, weights, repetitions, times, and your training history.
- Generated-program data. The programs our system generates for you, the inputs used to generate them (your training profile and what you actually completed), and the record of how a program was adapted from week to week.
- Progression & gamification data. Experience points, levels, skill ranks and the results that earn them, weekly streaks, and league placements and standings.
- Usage & device data. App interactions, session timestamps, settings, device model, operating system, app version, and basic diagnostics/crash logs.
- Product analytics & session replay (only with your consent). If you allow it when first asked (or later in Settings), we use PostHog, hosted in the EU (Frankfurt), to record which screens are used and — as part of that — anonymised session replays of how the app is operated. Replays are heavily masked: all typed input and all on-screen text is masked, and camera/video surfaces are never recorded. A replay also carries where taps and scrolls landed and the app's own technical console messages, which we use to find bugs. Analytics identifies you only by an internal account ID — never by your email, name, or quiz answers — and your IP address is discarded rather than stored. You can say no, and withdraw at any time in Settings, without losing any feature.
- Push-notification data. If you enable notifications, the push subscription identifier (endpoint) and encryption keys issued by your browser or device, plus your notification preferences and the delivery status of messages we send.
3.3 Data that is visible to other users
Some data is published within the Service by design. Your display name, avatar, skill rank, level, experience points, weekly streak, and league standing appear on leaderboards, league tables, and your public profile, where other users can see them. Your community and forum posts and comments are visible to other users, alongside your display name and avatar. Recordings you mark as public are visible to other users; saved recordings are otherwise private to you.
Your email address, onboarding answers, height, weight, and payment data are never published to other users. If you do not want a name shown publicly, choose a display name that does not identify you.
3.4 Sensitivity of this data
Video of your body and data about your physical performance can be sensitive. Where such data reveals information about your physical condition, we treat it as a special category of personal data under the GDPR and process it only with your explicit consent. For users in jurisdictions with biometric-privacy laws (e.g. Illinois, USA), see §11.
4. Why we use your data and our legal bases (GDPR Art. 6 & 9)
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account | Account data | Contract (Art. 6(1)(b)) |
| Provide form analysis & AI feedback | Camera/video, pose data, AI feedback data | Explicit consent (Art. 9(2)(a)) + Contract |
| Count reps and time holds while you train | Camera/video, pose data | Explicit consent (Art. 9(2)(a)) + Contract |
| Store your recordings for later review | Saved videos | Contract (Art. 6(1)(b)); Explicit consent (Art. 9(2)(a)) where the video reveals data about your physical condition. Automatic set-clip saving can be switched off at any time in the app settings |
| Build and adapt your training program | Onboarding & training profile data, training/workout data, generated-program data | Contract (Art. 6(1)(b)); Explicit consent (Art. 9(2)(a)) where it reveals data about your physical condition |
| Log your training and show your history | Training & workout data | Contract |
| Run ranks, levels, streaks, and leagues | Progression & gamification data, training/workout data | Contract |
| Publish your display name and progress on leaderboards, league tables, and your public profile | Display name, avatar, rank, level, XP, streak, league standing | Contract (Art. 6(1)(b)): publication is an integral part of the competitive and community features you sign up for |
| Operate the community feed, forum, and friends | Community content, friend connections, display name, avatar | Contract |
| Moderate content and keep the community safe | Community content, reports, account and usage data | Legitimate interest (Art. 6(1)(f)): protecting users and the Service; Legal obligation |
| Send push notifications you have enabled | Push subscription identifier and keys, notification preferences | Consent (Art. 6(1)(a)) |
| Process your subscription & payments | Subscription/payment data | Contract; Legal obligation (tax) |
| Improve the app's rep counting and form checking using your recordings | Saved videos, pose data | Explicit consent (Art. 9(2)(a)), given separately in the app and withdrawable at any time. Never a condition of using the Service |
| Improve and debug the Service | Usage/device data, diagnostics | Legitimate interest (Art. 6(1)(f)) |
| Product analytics and session replay (PostHog) | Masked usage events and replays, anonymised IP | Consent (Art. 6(1)(a)) — asked in the app before anything is tracked |
| Provide support and respond to you | Communications | Contract; Legitimate interest |
| Security, fraud prevention, legal compliance | Account, usage data | Legal obligation; Legitimate interest |
| Send service or marketing emails | Email, preferences | Consent (marketing) / Legitimate interest (service messages) |
Withdrawing consent. Where we rely on consent (including for recording, storing videos, AI processing, and push notifications), you can withdraw it at any time in the app settings, in your browser or device notification settings, or by contacting us. Withdrawal does not affect processing already carried out, and may mean parts of the Service no longer work (e.g. you cannot get form feedback without camera processing).
If you don't want to appear publicly. Leaderboards, league tables, and public profiles are a core part of the Service, so we cannot switch them off for a single account. If you do not want to be identifiable there, use a display name and avatar that do not identify you, or close your account (§10).
We do not use your video, pose, or form data for automated decisions that produce legal or similarly significant effects, and we do not use it for advertising.
5. AI processing (OpenAI)
To generate coaching feedback, we send certain data — up to 24 still frames sampled from your recording, pose metrics, and contextual information about the exercise — to our AI provider OpenAI, acting as our processor under a Data Processing Agreement. The request carries no name, email address, or account identifier. OpenAI does not use this data to train its models; it may retain API inputs for up to 30 days for abuse monitoring, after which they are deleted. OpenAI may use its own sub-processors; see §7.
You are interacting with an AI system: feedback is generated automatically and may be incomplete or wrong. It is not medical advice (see the Terms of Service).
6. Who we share data with
We do not sell your personal data. We share it only with:
- Other users of the Service, but only the data the Service publishes by design: your display name, avatar, skill rank, level, experience points, weekly streak, league standing, your public profile, any recordings you mark as public, and anything you post to the community feed or forum. See §3.3.
- Service providers (processors) who run the Service on our behalf, under contract:
- Supabase: authentication, database, and file/video storage (project hosted in the EU). Your recordings live in private storage: they are not on the open internet, and every viewing goes through a short-lived signed link.
- OpenAI: AI feedback generation (see §5).
- Stripe: payment processing. Your email address and an internal account ID are shared with Stripe so your subscription can be matched to your account; your card details go directly to Stripe and never touch our servers.
- PostHog (EU): product analytics and session replay, only with your consent (§3.2).
- Resend: transactional email — account confirmation, password reset, and trial-ending reminders.
- Vercel: web hosting for the app and websites.
- Google and Apple: only if you choose to sign in with them. They confirm your identity to us and learn that you signed in to CaliRealm; we send them nothing else.
- Content-delivery servers (Google, jsDelivr): when you use the camera features, your browser downloads the pose-detection model files from these providers' servers, which — like any web download — see your IP address. No training data or video is sent to them.
- Push services (Google, Apple, Mozilla): if you enable notifications, messages are delivered through your browser's own push service in encrypted form.
- Authorities or advisors where required by law, to enforce our Terms, or to protect rights, safety, and security.
- A successor entity if we restructure, merge, or sell the business. You will be notified.
The list above is our current list of sub-processors; we update this policy before adding or replacing one (see §7).
Access by our team. A small number of people operating CaliRealm can technically access stored content, including recordings, and do so only when there is a reason: resolving a support request or dispute you raised, investigating a bug, moderating reported content, or reviewing a clip you reported as wrongly counted or analysed (each report carries its own permission covering that one clip). Beyond that, we review recordings to improve the app only if you have switched on "Help train the coach" in the app settings. We never use your recordings for marketing and never show them to anyone outside the Service without asking you first.
"Help train the coach" (optional). This permission is off unless you turn it on, it is only offered to users aged 18 or over, and it covers two things: people at CaliRealm watching your saved recordings, and using those recordings to improve and train the technology that counts your reps and judges your form. It applies to recordings you had already saved as well as new ones. We do not sell your recordings, share them with anyone outside CaliRealm, or publish them. You can withdraw it at any time in Settings, which stops any further use of your recordings; what the software has already learned from them cannot be separated out again afterwards, and we say so here rather than implying a withdrawal undoes it. Withdrawing has no effect on anything else in the app, and refusing costs you nothing.
7. Sub-processors and international transfers
Our primary storage (Supabase) and our analytics (PostHog) are hosted in the EU. Some providers (including OpenAI, Stripe, Resend, and Vercel) process data outside the European Economic Area, including in the United States. Where we transfer personal data outside the EEA, we rely on an appropriate safeguard such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, plus additional measures where needed. You can request a copy of the relevant safeguard from our privacy contact.
The sub-processor list in §6 is kept current in this policy; we update it before adding or replacing a sub-processor.
8. How long we keep your data (retention)
| Data | Retention |
|---|---|
| Account data | While your account is active; deleted when you delete your account (residual copies in encrypted backups expire within 30 days) |
| Onboarding & training profile data | While your account is active; deleted with your account |
| Saved video recordings | Until you delete them or delete your account, whichever is first |
| Pose / form / AI-feedback data | While your account is active; deleted with your account |
| Training & workout history | While your account is active; deleted with your account |
| Generated-program data | While your account is active; deleted with your account. Superseded program versions are kept as history while the account is active |
| Progression & gamification data (XP, levels, ranks, streaks) | While your account is active; deleted with your account |
| League standings | Deleted with your account; a past league table you appeared in may keep the anonymised placement so the table stays internally consistent |
| Community & forum posts, comments | Until you delete them or delete your account — deleting the account deletes your posts |
| Moderation records and reports | Up to 24 months after the report is resolved, so repeat behaviour can be recognised |
| Friend connections | While your account is active; deleted with your account |
| Push-notification subscriptions | Until you disable notifications, the subscription expires or is rejected by the push service, or your account closes, whichever is first |
| Payment & invoice records | As required by Dutch tax law (generally 7 years) |
| Analytics events (PostHog, with consent) | 12 months |
| Session replays (PostHog, with consent) | 30 days |
| Diagnostics / error logs | Up to 12 months |
| Support communications | Up to 24 months |
You can delete individual recordings and your own posts at any time in the app. We delete or irreversibly anonymise data we no longer have a lawful purpose to keep.
One caveat on public content. Other users may have seen, quoted, or replied to a post before you deleted it. We remove the post from the Service, but we cannot retract what others already saw or copied.
9. How we protect your data
We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, access controls, and least-privilege access for the small number of people who can access systems. No system is perfectly secure, but we take the protection of body-video and form data seriously. If a breach affects your data and is likely to result in a high risk to you, we will notify you and the relevant supervisory authority as required (within 72 hours to the authority).
10. Your rights (GDPR / EU)
You have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate data;
- Erase your data ("right to be forgotten");
- Restrict or object to certain processing;
- Data portability: receive your data in a portable format;
- Withdraw consent at any time (see §4);
- Not be subject to solely automated decisions with significant effects (we don't do this);
- Lodge a complaint with a supervisory authority.
To exercise any right, contact info@calirealm.com. We respond within one month. Deleting individual recordings, individual posts, and your whole account is available directly in the app (Settings → Delete account); for a copy of your data (portability), email us and we will provide it in a machine-readable format.
Supervisory authority (Netherlands): Autoriteit Persoonsgegevens, https://autoriteitpersoonsgegevens.nl. You may also complain to the authority in your own EU country.
11. Notice for United States residents
We do not sell or "share" your personal information for cross-context behavioural advertising as those terms are defined under California law (CCPA/CPRA). We treat your video, pose, and form data as sensitive personal information and use it only to provide the Service.
Biometric-privacy notice (including Illinois BIPA). To provide form analysis, we collect and process data about your body position and movement. We:
- obtain your consent before this processing;
- use it only to provide form feedback and operate the Service;
- do not sell, lease, trade, or otherwise profit from it;
- disclose it only to processors (e.g. OpenAI, Supabase) as needed to run the Service; and
- retain and then destroy such data per our retention schedule (§8), and in any event delete it when the purpose is satisfied or on account closure.
You have rights to access, delete, and correct your information, and to be free from discrimination for exercising them. Contact info@calirealm.com.
12. Cookies and similar technologies
The app uses strictly necessary local storage to work: your login session, your in-progress quiz answers, and interface preferences. These are functional, not tracking.
Analytics and session replay are opt-in. The first time you open the app we ask whether we may use privacy-friendly analytics (§3.2). Only if you say yes does PostHog set its cookie and local-storage entries; if you say no, nothing analytics-related is loaded at all. You can change your answer at any time in Settings → More → Usage analytics.
The public websites (the CaliRealm pages and sjakiecalisthenics.com) may, with your consent — asked in a banner on your first visit — set one advertising cookie (Meta's pixel) to measure whether our ads work. It reports page views to Meta and nothing else, and it is never loaded inside the app itself. If you decline, no advertising cookie is set.
13. Changes to this policy
We may update this policy. If changes are material, we will notify you in the app or by email before they take effect. The "Last updated" date shows the current version.
14. Contact
Questions or requests: info@calirealm.com, or write to us at the registered address in §1.