Privacy policy

Last updated 17 October 2026

This policy explains what Calii collects, why, who else handles it, and what you can do about it.

In short: we collect what you give us to run your account and track your training. We do not sell your data, show ads, or use analytics or tracking tools.

Who we are

Calii is made by Lewis Vaillant-Jones in the United Kingdom, who looks after the personal data it collects. You can get in touch at [email protected].

What we collect

When you create an account:

Your email address, used to sign in.
Your password, stored only as a one-way hash we cannot reverse.
Your username and display name.

You need these to create an account. Everything else is optional.

When you use the app:

Your profile photo and bio, if you add them.
Your workouts, exercises and sets, your workout templates, skill progress, goals and milestones.
Who you follow, who follows you, and follow requests.
Your settings, such as units and whether your account is private.
Feedback you send us from the app.

Automatically, when the app talks to our servers:

Your IP address and basic request details, kept in server logs to run the service and keep it secure.
When the app checks for an update: your IP address, device platform, app version and a random installation ID. These are not linked to your account.

The app only reads your photo library when you choose a profile photo, and only the photo you pick is uploaded. While a workout is in progress it is stored on your device, and it reaches our servers only when you finish it.

Why we use it

To provide Calii (performing our contract with you): your account, logging and tracking your training, and the social features you choose to use.
To keep Calii working and secure (our legitimate interests): preventing abuse such as repeated sign-in attempts, fixing problems, and delivering app updates.
To act on your feedback (our legitimate interests): reading what you send us and improving Calii.

We do not send marketing, and we do not use your data for advertising or profiling.

We do not make automated decisions about you that have legal or similarly significant effects.

Who can see your profile

Anyone signed in to Calii can find you and see your username, display name, profile photo and bio.
Your workouts and progress are visible to you and the people who follow you.
With a public account anyone can follow you. With a private account you approve each follower, and only approved followers can see your workouts, progress and follow lists.

Profile photos are served from a public web address so the app can display them.

Who else handles your data

We use a small number of providers to run Calii. They process data only on our instructions:

Render hosts our servers and database, in Frankfurt, Germany.
Cloudflare stores and serves profile photos, and stores our encrypted database backups on its EU servers.
Expo delivers app updates to your device.
Discord is where feedback you send reaches our team, with your display name and username.

Some of these companies are based in the United States. Where your data leaves the UK or EU, it is protected by safeguards recognised under UK and EU law, such as the EU-US Data Privacy Framework and its UK Extension, or standard contractual clauses.

We will also share data when we need to:

Meet a legal obligation, such as a court order or a lawful request from the authorities.
Protect the rights, property or safety of Calii, our users or the public.
Investigate and prevent misuse of Calii or breaches of our rules.

If Calii is ever merged, acquired or sold, your data may be transferred as part of that deal. We will tell you before your data becomes subject to a different privacy policy.

How long we keep it

Your account data is kept until you delete your account.
Deleting your account removes it and all of its data from our systems straight away. Our hosting provider's database backups are kept for up to 3 days, and our own occasional encrypted backups are kept for up to 90 days. Both are only used to recover from a failure.
We keep a note that your account was deleted for 100 days, so it stays deleted even if we ever restore a backup.
Server logs are kept for a short period set by our hosting provider.

See how to delete your account, in the app or by email.

Your rights

Under UK and EU data protection law you can ask us to:

Give you a copy of your data.
Correct anything that is wrong. Most of it you can edit in the app.
Delete your data.
Restrict or object to how we use it.
Send your data to you or another service in a portable format.

Email [email protected] from your account's email address and we will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, or, in the EU, to the data protection authority in the country where you live.

Security

Data is sent over encrypted connections, passwords are hashed, and sign-in tokens are kept in your device's secure storage. No system is perfectly secure, but we take reasonable steps to protect your data.

Children

Calii is not meant for anyone under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

This website

This website does not use cookies or analytics. Its fonts are loaded from Google Fonts, which receives your IP address when the page loads.

Changes to this policy

If we change this policy we will update the date at the top. For significant changes we will let you know before they take effect.