Legal

1. Information We Collect

• Account & profile: email, a hashed password, username, and optional profile details (display name, avatar, gender, goals, country/region, time zone).
• Training data: exercises, programs, workout history, body measurements, achievements, streaks, progression history, and fitness-index data you create or log.
• Community data: friends, shared content, and activity-feed entries if you use community features.
• Payment data: processed by Stripe. We do not receive or store your full card number — only subscription status and a Stripe customer identifier.
• Communications: emails (verification, password reset, reminders, summaries, backup alerts) are delivered through Resend.
• Notifications: if enabled, the push subscription your browser provides and basic device/browser info needed to deliver them.
• Cloud backup connections: if you connect Google Drive or Dropbox, an encrypted access/refresh token so we can save backups to your own cloud.
• On-device data: your browser's local storage (IndexedDB and localStorage) for offline use and to store your session tokens on your device.

2. How We Use Your Information

We use your information to operate the Service; save and sync your training data; process subscriptions; send service and account communications; deliver notifications you enable; create and restore backups; provide community features you opt into; maintain security and prevent abuse; and comply with legal obligations. We do not use your training data to serve third-party advertising.

3. How We Share Information

We do not sell your personal information. We share it only with service providers that help us run the Service, as needed:

• Stripe — payment processing.
• Resend — transactional email.
• Google Drive / Dropbox — only if you connect them, to store backups in your own account.
• Hosting and infrastructure providers — to operate our servers and database.

We may also disclose information if required by law, or to protect the rights, safety, and security of our users or the Service.

4. Community Features

Community features (leaderboards, friends, sharing) are optional. If you use them, information such as your username, achievements, and content you choose to share may be visible to other users. You control what you share and can keep your library and activity private.

5. Cloud Backups & Third-Party Connections

Backups are stored on our servers and, if you choose, uploaded to your own Google Drive or Dropbox account. When you connect a provider, we request a limited, app-scoped permission and store the resulting tokens encrypted at rest. We access only the files our app creates — never the rest of your Drive or Dropbox. You can disconnect anytime from the app, which removes the stored tokens.

Google API disclosure. Kalocian's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use the drive.file scope, which restricts access to files created by Kalocian.

6. Data Storage, Security & Retention

Passwords are hashed (bcrypt) and never stored in plain text. Sessions use signed JWTs, and cloud OAuth tokens are encrypted at rest (AES-256-GCM). We retain your information while your account is active. When you delete your account, your personal and training data are deleted from our systems; backups already stored in your own cloud remain under your control. No method of storage or transmission is 100% secure, but we use reasonable safeguards.

7. Your Choices & Rights

You can access and update your information in the app, control notifications in Settings, export a full copy of your data (Profile → Data Management), and permanently delete your account.

U.S. residents (including California): you have the right to know what personal information we collect, to request access to or deletion of it, and to not be discriminated against for exercising these rights. We do not sell or share your personal information for cross-context behavioral advertising.

EEA/UK residents: where GDPR/UK GDPR applies, you have rights to access, rectify, erase, restrict, and port your data, and to object to certain processing. You may also lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact support@kalocian.com.

8. Children

The Service is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

9. International Transfers

We operate from the United States, and our service providers may process data in the United States and elsewhere. By using the Service, you understand your information may be transferred to and processed in countries with different data-protection laws than your own.

10. Changes to This Policy

We may update this Policy from time to time. We will revise the Effective date above and, for material changes, provide additional notice. Continued use after changes take effect constitutes acceptance.

11. Contact

Questions or requests about this Policy or your data? Email support@kalocian.com.