Privacy Policy

Updated 9 September 2026 · applies to the CaliRep iOS app and calirep.app

The short version: CaliRep has no sign-up and never shows your data to other users. The app sends pseudonymous usage events (what you did, not who you are) to an analytics service on EU servers; there is no advertising and no tracking across apps. This website counts visits with self-hosted, cookieless software that stores no personal data. Your training history is stored under an anonymous account on servers in the EU. Videos you film stay on your device unless you share them yourself.

Who is responsible

Cristian Serb, Germany. Contact for anything in this policy: support@criss.dev.

Your account is anonymous

On first launch the app creates an anonymous account — a random identifier, no email, no name, no password. We could not email you if we wanted to. This identifier exists so your training history belongs to you across app launches.

What we store, and where

Your onboarding answers (how many push-ups, pull-ups and dips you can do, and optionally your gender — used only to compute your goal numbers), the workouts you log, the goals you reach, and — if you redeem an influencer's offer code — which offer it was. That last one exists so the person whose code convinced you can be paid their share; it is never shown to anyone in the app.

All of it lives in a PostgreSQL database hosted by Supabase Inc. in Frankfurt, Germany (EU). Supabase acts as our processor; row-level security ensures your rows are readable by your account alone.

Camera and microphone

Filming a set is optional and happens entirely on your device. The finished clip is composed on your phone and handed to the iOS share sheet — it reaches TikTok, Instagram or anywhere else only because you post it there. We never receive, store or see your videos.

Subscriptions

Purchases run through Apple. We receive Apple's confirmation that your account is entitled — never your payment details, never your Apple ID. Apple's own privacy terms govern the transaction.

What we do not do

• Usage analytics in the app: PostHog, on servers in the EU. The app keeps one random installation identifier (no name, no email, no Apple ID, no advertising ID) and sends events about what happens: onboarding completed (with the gender and rep numbers you entered), sessions started and logged, goal attempts and their result, milestones, clips created or shared, the paywall shown, purchases made (which plan, never a transaction id). IP addresses are not stored. This is pseudonymous, not anonymous: the events of one installation belong together. Deleting the app deletes the identifier; to have the events erased, write to the address below with the date you installed.
• No advertising SDKs, no fingerprinting, no cross-app tracking, no cookies on this site.
• Site statistics: this website uses Umami, hosted by us on our own server in the EU. It sets no cookies, stores no IP address and no identifier that could single you out; it counts page views, button clicks, click positions and scroll depth in aggregate, per page, to see which parts of a page get read. No individual visit can be reconstructed. There is nothing to opt out of because nothing about you is kept.
• No selling, renting or sharing of data with third parties.
• No social graph: nobody in the app can see anybody else.

Your rights (GDPR)

You can request access to, correction of, or deletion of your data at any time: email support@criss.dev. Because accounts are anonymous, include the account identifier shown in the app's Settings so we can find your rows. Deleting the app's data removes your training history permanently. You also have the right to lodge a complaint with a supervisory authority.

Retention

Training data is kept for as long as your account exists. Data of accounts is deleted on request; backups age out on the hosting provider's standard schedule.

Changes

When the app's architecture changes in a way that touches this page, the page changes with it, and the date above moves.