Calisty collects only what it needs to run your training plan. It never sells your data and never shows ads. This page explains what is collected, why, for how long, and what your rights are.
Last updated: 25 September 2026
Article 1
Who is responsible for your data
In shortCalisty is published by Théo Gillet, based in Belgium. Théo Gillet is the data controller.
Calisty (the Android app and the website calisty.app) is published by Théo Gillet, whose registered office is at 6700 Arlon, Belgium.
For the purposes of the General Data Protection Regulation (GDPR) and Belgian data protection law, Théo Gillet is the data controller. This means we decide what personal data is collected and why.
In shortThis policy applies to the Calisty Android app and to the calisty.app website.
This policy describes how we handle personal data in two places:
The website (calisty.app), which presents the app.
The Android app, which you install from Google Play.
It does not cover Google Play, Google Sign-In or any other Google service. Those are governed by Google’s own privacy policy.
Article 3
Data collected on the website
In shortThe website counts visits without cookies and without identifying you. If you join the waitlist, it stores your email address.
The website sets no cookies and loads nothing from third parties. Fonts are served from our own domain, so no request is made to Google when you open a page.
Visit statistics. When you open a page, we record which page it was, its language, whether you use a phone, a tablet or a computer, and whether you arrived directly, from another page of the site or from another website (in which case we keep only that website’s name, never the full address). To count visitors without identifying them, your IP address and your browser’s user-agent string are combined into a code that changes every day and cannot be turned back into either. Your IP address and user-agent string themselves are never stored. Visits by search engines and other robots are not counted.
Waitlist. If you leave your email address to hear when the app launches, we store it encrypted, together with the language of the page and the date you signed up. We use it only to send you one email when the app is available.
Like any web server, the server that hosts the site keeps technical logs (IP address, page requested, date and time, user-agent string) that are used only to keep the site running and to detect abuse. To block abusive requests, the site also holds a scrambled form of your IP address in memory for a few minutes at most; it is never written to disk.
In shortThe app stores your account, the profile you set up, your training history, your notes and your conversations with the coach, and counts how the app is used unless you turn that off.
The Android app processes the following data:
Account data. Your email address and a password, which is stored only in hashed form. If you sign in with Google, we receive your email address and your Google account identifier. You can also use the app without an account: your data then stays on your phone and is not sent to our servers.
Profile. The answers you give during setup, which you can change later: the name you want to be called, your units, your weight and height, your level, your equipment, your goal, any painful areas you report, how often and how long you train, and how you heard about Calisty.
Training data. The sessions you log (date, duration and the step of your plan), your progress on the skill path, your personal records and the notes you write in your notebook.
Coach data. Your conversations with Cali, the coach, what you tell him you can already do, and the programs he writes for you. If you use form check, the app takes up to eight still images from the video you choose and sends only those images to the coach; the video itself stays on your phone.
Plan. Which plan you chose and when, and when a trial started or a subscription was cancelled. We never receive your payment details.
Usage statistics. Unless you turn off Share anonymous usage in Settings, the app sends us events such as opening the app, the answers chosen during setup (for example your goal, your level or the painful areas you selected, but never your name), the offers shown and chosen, the sessions logged and the time spent on each screen. These events are linked to a random identifier created on your phone, not to your account, your name or your email address, and they carry no IP address, device model or advertising identifier. Turning the setting off stops them and deletes that identifier.
We do not collect your date of birth, your sex, your location or your contacts. The app only sees a video when you choose one for form check. It does not connect to any health platform or wearable device, uses no advertising identifier, and contains no advertising or crash reporting tools.
Article 5
Why we process your data
In shortWe process your data to provide the service (contract), to improve the app and the site (legitimate interest) and, for health information and anything optional, with your consent.
Under the GDPR, every processing operation needs a legal basis. Ours are:
Performance of a contract (Article 6(1)(b) GDPR) for your account, profile, training, coach and plan data. Without them, the app cannot build your plan or provide the coach.
Explicit consent (Article 9(2)(a) GDPR) for the painful areas you report, which are health data. Reporting them is optional (you can answer “Nothing hurts”), and you can withdraw your consent at any time by changing your answer or writing to us.
Consent (Article 6(1)(a) GDPR) for the waitlist, and for letting the coach read your notebook, which stays off until you turn it on in Settings. You can withdraw your consent at any time.
Legitimate interest (Article 6(1)(f) GDPR) for the visit statistics on the website and the usage statistics in the app. Our interest is to understand which pages and features are used so we can improve them. You can object at any time, in the app by turning off Share anonymous usage in Settings.
Article 6
Who has access to your data
In shortWe never sell your data and never share it with advertisers. A few service providers process it on our behalf.
We do not sell personal data, do not share it with advertisers and do not display advertising in the app.
The following service providers (processors) handle data on our behalf, under contracts that limit them to our instructions:
Supabase, which hosts the app’s accounts and database: your account, profile, training, coach and plan data.
Anthropic, which provides the AI model behind Cali, the coach. When you use the coach, Anthropic receives your message together with a summary of your profile (including your name, goal, level, equipment, painful areas, weight and height), your training so far and your program, plus your most recent notes if you allowed the coach to read your notebook. For form check, it receives the still images. Under its commercial terms, Anthropic does not use this data to train its models.
Our website host, which runs the website and stores the visit statistics, the waitlist and the app’s usage statistics.
Google, only if you choose to sign in with a Google account. Google then handles the sign-in under its own privacy policy.
We may also disclose data where the law requires it, for example in response to a valid request from a public authority. Where permitted, we will inform you.
Article 7
How long we keep your data
In shortYour account data is kept while your account is open and erased when you delete it. Statistics and waitlist addresses are kept for a limited time.
We apply the following retention periods:
Account, profile, training, coach and plan data: for as long as your account is open. When you delete your account, this data is erased at once, and any copies in our backups within 30 days.
Waitlist addresses: until we have sent the launch email, or until you ask us to remove yours.
Visit statistics and usage statistics: 24 months. Usage statistics are not linked to your account, so deleting your account does not erase them.
Coach requests: Anthropic keeps them for a limited period under its own terms, then deletes them.
Records we are legally required to keep (for example invoices): for the period required by law.
Article 8
Where your data is stored
In shortSome of our service providers process data outside the European Union. These transfers are protected by the safeguards of the GDPR.
The app’s account and training data are stored by Supabase. The website, its visit statistics, the waitlist and the app’s usage statistics are stored by our website host.
Anthropic processes coach requests in the United States, and Supabase and Google may also process data outside the European Economic Area. Any such transfer is covered by the safeguards provided for by the GDPR, such as the European Commission’s standard contractual clauses or an adequacy decision.
Article 9
Your rights
In shortYou can access, correct, delete or export your data, and object to its processing. Just email us. We reply within 30 days.
Under the GDPR, you have the right to:
Access your personal data and obtain a copy of it.
Rectify data that is inaccurate or incomplete.
Erase your data (“right to be forgotten”).
Restrict the processing of your data in certain cases.
Receive your data in a portable format (data portability).
Object to processing based on our legitimate interest.
Withdraw your consent at any time, where processing is based on consent.
To exercise any of these rights, email privacy@calisty.app. We will respond within 30 days. Exercising your rights is free of charge and you do not need to give a reason. You can also delete your account directly from the app settings.
If you believe we have not handled your data correctly, please contact us first so we can put it right. You also have the right to lodge a complaint with the Belgian supervisory authority, the Data Protection Authority (APD/GBA), or with the supervisory authority of the country where you live.
Article 10
Children
In shortYou must be at least 16 years old to use Calisty.
Calisty is not intended for children. You must be at least 16 years old to create an account. We do not knowingly collect data from anyone younger.
If you believe a child has created an account, contact us at privacy@calisty.app and we will delete it.
Article 11
Security
In shortWe protect your data with appropriate technical and organisational measures.
We take reasonable technical and organisational measures to protect your data against loss, unauthorised access and misuse. Passwords are stored only in hashed form, data travels over encrypted connections, and access to production systems is restricted.
No system is perfectly secure. If a data breach affects you, we will inform you and the supervisory authority as required by the GDPR.
Article 12
Changes to this policy
In shortWe will notify you in the app before any significant change takes effect.
We may update this policy from time to time. If a change affects you significantly, we will notify you in the app before it takes effect. The date at the top of this page always shows when the current version came into force.
