CaliRealm Privacy Policy

Last updated: 2026-10-17 Effective date: 2026-10-17

Plain-language summary (not a substitute for the full policy): CaliRealm is a calisthenics training app. We build you a training program, log your workouts, and use your phone's camera to count your reps, time your holds, and analyse your form. If you choose to save them, we store your recordings. We treat body and performance data as sensitive. Form checks are worked out on your phone. Some things are public to other users by design: your display name, avatar, rank, level, streak, and league standing appear on leaderboards and your profile, and anything you post in the community is visible to others. Your email, onboarding answers, body measurements and payment data are never published. We never sell your data. You can delete your recordings, your posts, and your account at any time.

1. Who we are (Data Controller)

CaliRealm ("CaliRealm", "we", "us", "our") is operated by:

• Legal name: Sjakie Minet, trading as CaliRealm (eenmanszaak / sole proprietorship)
• Registered address: Segeersstraat 25, 4331 JM Middelburg, Netherlands
• Chamber of Commerce (KvK) number: 93183208
• VAT (BTW) number: NL005003670B69
• Privacy contact: info@calirealm.com

We are the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer; you can reach our privacy contact above for any data-protection question.

This policy applies to the CaliRealm app (at app.calirealm.com, in the browser or installed on your device), the CaliRealm iPhone app from the App Store, the CaliRealm pages at calirealm.com, and related services (together, the "Service").

2. Scope and your age

The Service is intended for users aged 16 and over. We do not knowingly collect data from anyone under 16. If you are under 16, do not use the Service. If we learn we have collected data from someone under 16, we will delete it. Contact us at the address above.

3. What data we collect

3.1 Data you give us

• Account data: email address, password (stored hashed), display name, avatar, and (if you provide them) profile details such as your training level or goals. If you sign in with Google or Apple instead of a password, we receive from them the email address (or Apple's private relay address) and the name attached to that sign-in, and no password is created. For Apple sign-in we also keep a token Apple issues, so we can end the sign-in with Apple when you delete your account. If you signed up with an invite code, we also record the code you used.
• Onboarding & training profile data: the answers you give when setting up the Service, such as your sex, date of birth, experience level, training goals, current strength (for example, how many strict pull-ups you can do), available equipment, and how often you want to train. These are used to build your program. Accounts created with earlier versions of the setup may also have provided height and weight.
• Country: filled in from your phone's time zone when you sign up, and you can change it in Settings. It shows as a flag next to your name in the community and places you on your country's leaderboard.
• Body weight (optional): if you train weighted exercises, the app asks your body weight once so it can show a step such as "+10% of body weight" in kilograms. You can skip the question, and change the number in Settings. It is visible only to you, is never shown to other users, is not sent to our analytics provider, and is deleted with your account.
• Community content: posts, comments, and replies you publish to the community feed or forum, and reports you submit about other users' content.
• Friend connections: the friend requests you send and accept.
• Subscription & payment data: subscription plan, status, and billing records. On the website, card details are processed by Stripe, and we do not store your full card number. In the iPhone app you pay through Apple: Apple handles the payment and keeps your payment details, and we keep only the plan, its status and dates, and a purchase identifier. See §6.
• Communications: messages, support requests, and feedback you send us, including any screenshot you attach.

3.2 Data created when you use the Service

• Camera / video recordings. When you train, the app uses your device camera. Clips you save yourself are stored so you can review them. With Pro, a clip of each tracked set in the workout player is saved automatically by default so your training history keeps the video; you can turn this off at any time in Settings ("Save set clips"). Turning it off does not affect rep counting. On the free plan, set clips are not kept.
• Pose & form data. We derive body-position data (skeletal landmarks, joint angles, silhouette-based measurements, repetition counts, hold duration) from the camera feed to count your reps, time your holds, and analyse your form.
• Form-check results. The feedback for your sets (the mistakes found and the measurements behind them), worked out on your device.
• Training & workout data. The programs assigned to you, the sessions and sets you complete, weights, repetitions, times, and your training history.
• Generated-program data. The programs our system generates for you, the inputs used to generate them (your training profile and what you actually completed), and the record of how a program was adapted from week to week.
• Progression & gamification data. Experience points, levels, skill ranks and the results that earn them, weekly streaks, and league placements and standings (leagues are called Realms in the app).
• Usage & device data. App interactions, session timestamps, settings, device model, operating system, app version, and basic diagnostics/crash logs. When something goes wrong, the error report includes the error message, a technical stack trace and the app screen it happened on.
• Product analytics & session replay (only with your consent). If you allow it when first asked (or later in Settings), we use PostHog, hosted in the EU (Frankfurt), to record which screens are used and — as part of that — anonymised session replays of how the app is operated. Replays are heavily masked: all typed input and all on-screen text is masked, and camera/video surfaces are never recorded. A replay also carries where taps and scrolls landed and the app's own technical console messages, which we use to find bugs. Analytics identifies you only by an internal account ID — never by your email, name, or quiz answers — and your IP address is discarded rather than stored. You can say no, and withdraw at any time in Settings, without losing any feature.
• Push-notification data. If you enable notifications, the push subscription identifier (endpoint) and encryption keys issued by your browser, or in the iPhone app the device token issued by Apple's push service, plus your notification preferences and the delivery status of messages we send.

3.3 Data that is visible to other users

Some data is published within the Service by design. Your display name, avatar, country flag, skill rank, level, experience points, weekly streak, and league standing appear on leaderboards, league tables, and your public profile, where other users can see them. Your community and forum posts and comments are visible to other users, alongside your display name and avatar. A clip you choose to show on your profile as proof of a skill, or attach to a post, is visible to other users; your other saved clips are private to you.

Your email address, onboarding answers, height, weight, and payment data are never published to other users. If you do not want a name shown publicly, choose a display name that does not identify you.

3.4 Sensitivity of this data

Video of your body can be sensitive, so we keep what we do with it narrow. The camera only runs while you use the timer or the workout player, and the body-position data is worked out on your device. A recording is only kept when you save it, or when the workout player saves a set clip for your history (you can switch that off in Settings). A form check only runs when you ask for one. Counting, timing, form checks and keeping your own recordings are the Service itself, so we do this as part of the Service (contract, Art. 6(1)(b)). Using your recordings to improve the app is a separate choice you make yourself ("Help train the coach", §6).

Your training log is how your program works. The exercises you do, your reps, your hold times and how hard a set felt are what we use to build your next week and to move you up or down a step. That adapting is the custom program you sign up for, so we process this data as part of the Service (contract, Art. 6(1)(b)) and do not ask a separate consent for it. It is never sold, and never shown to other users except where §3.3 says so. For users in jurisdictions with biometric-privacy laws (e.g. Illinois, USA), see §11.

4. Why we use your data and our legal bases (GDPR Art. 6 & 9)

Withdrawing consent. Where we rely on consent (analytics, push notifications, "Help train the coach", marketing emails, and the advertising cookie on our website), you can withdraw it at any time in the app settings, in your browser or device notification settings, or by contacting us. Withdrawal does not affect processing already carried out, and may mean the feature that needs it stops (e.g. no reminders without push notifications).

If you don't want to appear publicly. Leaderboards, league tables, and public profiles are a core part of the Service, so we cannot switch them off for a single account. If you do not want to be identifiable there, use a display name and avatar that do not identify you, or close your account (§10).

We do not use your video, pose, or form data for automated decisions that produce legal or similarly significant effects, and we do not use it for advertising.

5. Form checks run on your device

Counting your reps, timing your holds and checking your form are worked out by software on your phone.

Form feedback is generated automatically and may be incomplete or wrong. It is not medical advice (see the Terms of Service).

6. Who we share data with

We do not sell your personal data. We share it only with:

• Other users of the Service, but only the data the Service publishes by design: your display name, avatar, skill rank, level, experience points, weekly streak, league standing, your public profile, clips you choose to show on your profile or attach to a post, and anything you post to the community feed or forum. See §3.3.
• Service providers (processors) who run the Service on our behalf, under contract:
  • Supabase: authentication, database, and file/video storage (project hosted in the EU). Your recordings live in private storage: they are not on the open internet, and every viewing goes through a short-lived signed link.
  • Stripe: payment processing on the website. Your email address and an internal account ID are shared with Stripe so your subscription can be matched to your account; your card details go directly to Stripe and never touch our servers.
  • Apple: payment for a subscription bought in the iPhone app. Apple charges your Apple Account, keeps your payment details, and handles renewals, cancellations and refunds.
  • RevenueCat: processes App Store purchase and subscription data (product, price, status and dates), linked to an internal account ID so your subscription can be matched to your account. It receives no card details.
  • PostHog (EU): product analytics and session replay, only with your consent (§3.2).
  • Resend: email: account confirmation, password reset and trial-ending reminders, and occasional emails about CaliRealm, each with an unsubscribe link.
  • Vercel: web hosting for the app and websites.
  • Google and Apple: only if you choose to sign in with them. They confirm your identity to us and learn that you signed in to CaliRealm; we send them nothing else.
  • Content-delivery servers (Google, jsDelivr): when you use the camera features, your browser downloads the pose-detection model files. We serve these from our own hosting where we can; when a file is not available there, your browser downloads it from these providers' servers, which — like any web download — see your IP address. No training data or video is sent to them.
• Push services (Google, Apple, Mozilla): if you enable notifications, messages are delivered through your browser's own push service in encrypted form, or in the iPhone app through Apple's push service.
• Authorities or advisors where required by law, to enforce our Terms, or to protect rights, safety, and security.
• A successor entity if we restructure, merge, or sell the business. You will be notified.

The list above is our current list of sub-processors; we update this policy before adding or replacing one (see §7).

Access by our team. A small number of people operating CaliRealm can technically access stored content, including recordings, the body-position (pose) data attached to a recording, and error and crash reports, and do so only when there is a reason: resolving a support request or dispute you raised, investigating a bug, moderating reported content, or reviewing a clip you reported as wrongly counted or analysed (each report carries its own permission covering that one clip). Beyond that, we review recordings to improve the app only if you have switched on "Help train the coach" in the app settings. We never use your recordings for marketing and never show them to anyone outside the Service without asking you first.

"Help train the coach" (optional). This permission is off unless you turn it on, it is only offered to users aged 18 or over, and it covers two things: people at CaliRealm watching your saved recordings, and using those recordings to improve and train the technology that counts your reps and judges your form. It applies to recordings you had already saved as well as new ones. We do not sell your recordings, share them with anyone outside CaliRealm, or publish them. You can withdraw it at any time in Settings, which stops any further use of your recordings; what the software has already learned from them cannot be separated out again afterwards, and we say so here rather than implying a withdrawal undoes it. Withdrawing has no effect on anything else in the app, and refusing costs you nothing.

7. Sub-processors and international transfers

Our primary storage (Supabase) and our analytics (PostHog) are hosted in the EU. Some providers (including Stripe, Apple, RevenueCat, Resend, and Vercel) process data outside the European Economic Area, including in the United States. Where we transfer personal data outside the EEA, we rely on an appropriate safeguard such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, plus additional measures where needed. You can request a copy of the relevant safeguard from our privacy contact.

The sub-processor list in §6 is kept current in this policy; we update it before adding or replacing a sub-processor.

8. How long we keep your data (retention)

You can delete individual recordings and your own posts at any time in the app. We delete or irreversibly anonymise data we no longer have a lawful purpose to keep.

One caveat on public content. Other users may have seen, quoted, or replied to a post before you deleted it. We remove the post from the Service, but we cannot retract what others already saw or copied.

9. How we protect your data

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, access controls, and least-privilege access for the small number of people who can access systems. No system is perfectly secure, but we take the protection of body-video and form data seriously. If a breach affects your data and is likely to result in a high risk to you, we will notify you and the relevant supervisory authority as required (within 72 hours to the authority).

10. Your rights (GDPR / EU)

You have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten");
• Restrict or object to certain processing;
• Data portability: receive your data in a portable format;
• Withdraw consent at any time (see §4);
• Not be subject to solely automated decisions with significant effects (we don't do this);
• Lodge a complaint with a supervisory authority.

To exercise any right, contact info@calirealm.com. We respond within one month. Deleting individual recordings, individual posts, and your whole account is available directly in the app (Settings → Delete account); for a copy of your data (portability), email us and we will provide it in a machine-readable format.

Supervisory authority (Netherlands): Autoriteit Persoonsgegevens, https://autoriteitpersoonsgegevens.nl. You may also complain to the authority in your own EU country.

11. Notice for United States residents

We do not sell or "share" your personal information for cross-context behavioural advertising as those terms are defined under California law (CCPA/CPRA). We treat your video, pose, and form data as sensitive personal information and use it only to provide the Service.

Biometric-privacy notice (including Illinois BIPA). To provide form analysis, we collect and process data about your body position and movement. We:

• process it only while you use the camera, or when you ask for a form check;
• use it only to provide form feedback and operate the Service;
• do not sell, lease, trade, or otherwise profit from it;
• disclose it only to processors (e.g. Supabase, which stores your saved recordings) as needed to run the Service;
• retain and then destroy such data per our retention schedule (§8), and in any event delete it when the purpose is satisfied or on account closure; and
• never use it to identify or recognise you: it is not used for facial recognition or identity verification.

You have rights to access, delete, and correct your information, and to be free from discrimination for exercising them. Contact info@calirealm.com.

12. Cookies and similar technologies

The app uses strictly necessary local storage to work: your login session, your in-progress quiz answers, and interface preferences. These are functional, not tracking.

Analytics and session replay are opt-in. The first time you open the app we ask whether we may use privacy-friendly analytics (§3.2). Only if you say yes does PostHog set its cookie and local-storage entries; if you say no, nothing analytics-related is loaded at all. You can change your answer at any time in Settings → More → Usage analytics.

The public websites (the CaliRealm pages and sjakiecalisthenics.com) may, with your consent — asked in a banner on your first visit — set one advertising cookie (Meta's pixel) to measure whether our ads work. It reports page views to Meta and nothing else, and it is never loaded inside the app itself. If you decline, no advertising cookie is set.

13. Changes to this policy

We may update this policy. If changes are material, we will notify you in the app or by email before they take effect. The "Last updated" date shows the current version.

14. Contact

Questions or requests: info@calirealm.com, or write to us at the registered address in §1.