Privacy Policy

Last updated: March 27, 2026

Calis League app and calisthenicsambition.com website

1. Introduction

This privacy policy describes how Calis League (hereinafter "we", "our" or "the App") collects, uses, stores and protects your personal data when you use our mobile application and website.

We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR - EU 2016/679) and applicable data protection laws.

2. Data Controller

3. Data We Collect

We collect the following categories of data:

3.1. Registration Data

• Email address: used to create and authenticate your account
• Password: encrypted and stored securely (never accessible in plain text)

3.2. Workout Data

• Exercises performed: exercise type, number of repetitions, number of sets
• Session history: dates and details of your workouts
• Quality scores: performance evaluations calculated by the app

3.3. Profile Data

• Username: freely chosen by you, displayed on the leaderboard

3.4. Body and Pose Data (Camera Usage)

The app's AI Tracker feature loads a web page hosted on our own website (calisthenicsambition.com) inside an in-app WebView. This web page uses your device's camera to provide AI-powered exercise form tracking. Here is how it works:

• Web content provider: The AI Tracker loads content from https://calisthenicsambition.com/counter/launcher.html, which is owned and operated by us (the same developer as the app). Although this web content is served from our website, it is governed by this same privacy policy.
• Technology used: The web page uses Google MediaPipe Pose Landmarker, an on-device machine-learning model that detects body pose landmarks (e.g., shoulders, elbows, wrists, hips, knees, ankles). The model also outputs a nose landmark used solely as a head-position reference point for pull-up repetition counting.
• No face data is collected: The app does not perform facial recognition, face identification, or create any facial geometry map. The nose landmark is a single 2D/3D coordinate used exclusively to measure vertical head displacement relative to the hands during pull-up exercises — no facial features, expressions, or biometric face data are analyzed or recorded.
• All processing is on-device: The MediaPipe model runs entirely in the WebView on your device using the device's GPU/CPU. No camera frames, images, video, or pose landmark coordinates are transmitted to any external server. The web page does not upload camera data — only the static JavaScript and ML model are downloaded from our website; all processing happens locally.
• Data transmitted to our website: The only data sent from the app to our website is your authenticated session token (so your workout can be saved to your account) and an exercise context parameter. No camera frames, video, images, or pose landmark coordinates are ever transmitted.
• No storage of pose data: Landmark coordinates are processed in real time within the WebView and immediately discarded after each video frame. Only the resulting exercise repetition count and quality score (numerical values) are saved to your account in our database (Supabase).
• No third-party sharing: No body pose, landmark, or camera data is shared with any third party, including Google. The MediaPipe model is loaded once and runs locally within the WebView — it does not phone home or transmit data.
• Retention: Since pose landmark data is never stored, there is no retention period. The numerical workout results (rep count, quality score) follow the same retention policy as other workout data (see Section 7).

3.5. Data We Do NOT Collect

4. Purpose of Data Processing

Your data is used exclusively for:

• App functionality: authentication, saving and displaying your workouts
• Leaderboard: anonymized ranking (username only) between users
• Service improvement: aggregated (non-individual) analysis to improve user experience
• Support: responding to your contact requests

5. Legal Basis for Processing

• Performance of contract: processing is necessary to provide the service (authentication, workout storage)
• Legitimate interest: service improvement and leaderboard operation

6. Data Storage and Security

6.1. Hosting

6.2. Security Measures

• Password encryption (bcrypt hashing)
• Secure communications via HTTPS/TLS
• JWT token authentication
• Data access restricted via Row Level Security (RLS) in Supabase

7. Data Retention

• Account and workout data: retained as long as your account is active
• After account deletion: data deleted within 30 days
• Contact data: 3 years from last exchange

8. Data Sharing

Your data is never sold to third parties. It may only be shared with:

• calisthenicsambition.com (our website): the app's AI Tracker feature loads web content from our own website in an in-app WebView. The only data shared is your authentication session token and exercise context. No camera data, images, or pose landmarks are transmitted. This website is owned and operated by us.
• Supabase: secure data hosting and storage (data processor)
• Apple / Google: payment processing for in-app purchases (they do not share your banking details with us)
• RevenueCat: in-app purchase management and entitlement verification
• Competent authorities: only upon legal request

9. International Transfers

Your data may be transferred to the United States (Supabase servers). These transfers are governed by Standard Contractual Clauses approved by the European Commission, ensuring an adequate level of protection.

10. Your Rights

Under the GDPR, you have the following rights:

• Right of access: view the data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data and account
• Right to restriction: limit the processing of your data
• Right to object: object to the processing of your data
• Right to data portability: receive your data in a structured format

How to Exercise Your Rights

You may also file a complaint with the CNIL (French Data Protection Authority): https://www.cnil.fr

11. Children

The app is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are a parent and believe your child has provided us with data, please contact us to have it deleted.

12. Changes to This Policy

We reserve the right to modify this privacy policy at any time. In the event of a substantial change, we will notify you via the app or by email.

The date of last update is indicated at the top of this page.

13. Contact

For any questions regarding this privacy policy:

• By email: ilyas.moud.pro@gmail.com
• Via our contact form