1. Scope and controller
This policy applies to calicombos.com and CaliCombos services that link to it. Tolbert Technologies LLC, which operates CaliCombos and calicombos.com, controls the personal information described here. It does not apply to third-party sites or services that have their own policies.
For fitness, movement, and body-analysis information, also read our separate Consumer Health Data Privacy Policy.
CaliCombos is not a healthcare provider or health plan, and the Service is generally not governed by HIPAA. Privacy laws may still protect information you provide to us.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account and authentication | Name, email address, Google account identifier, profile image, account ID, age-eligibility attestation, accepted-policy versions, and sign-in and session timestamps. | You and Google when you choose Google sign-in. Google does not provide your birth date through our standard sign-in scopes. |
| Profile and social content | Username, display name, bio, avatar, visibility settings, follows/interactions, posts, captions, comments, reactions, chat messages, group membership, reports, and moderation records. | You, other users, and our moderation activity. |
| Workout and activity | Equipment and movement selections, generated combos, workout history, uploaded or recorded video/audio, movement annotations, rep or hold estimates, form feedback, pose/body landmarks, match submissions, scores, results, and ratings. | You, your device camera/microphone after permission, and on-device automated analysis. |
| Livestream and real-time media | Stream title and status, camera/microphone feeds, connection signaling, spectator permissions, live and battle chat, and temporary media grants. | You, participants, viewers, and devices in a session. |
| Device and network | IP address, browser and device type, operating system, referring page, request times, error and security logs, and approximate location inferred from IP. | Your browser, our hosting/network providers, and server logs. |
| Cookies and local device storage | Session and security cookies; theme, workout setup, combo history, temporary OAuth state, cached app files and model assets; and—in legacy deployments—an authentication token. | Your browser when you use the Service. |
Cookies and similar storage
CaliCombos currently uses only first-party storage needed to provide features you request and protect the Service: a browser session cookie that normally expires after 7 days; one-time age-gate and OAuth cookies that normally expire after about 10 minutes; and browser storage or caches for theme, workout setup, local combo and project history, app files, and on-device model assets. We do not currently use advertising, cross-site tracking, or optional analytics cookies.
We do not display a cookie-consent banner for this essential-only configuration. If we add nonessential analytics, advertising, or cross-site tracking technologies, we will update this notice and request consent before activating them where the law requires it.
Before Google sign-in, we ask for a birth month solely to make a server-side 16+ eligibility decision. The submitted month is discarded after that decision and is not written to the account database. We retain only that the check passed, when it passed, and the versions of the Terms and privacy notices acknowledged.
We do not request government identifiers, payment card information, precise GPS location, contacts, or medical records. Please do not include unnecessary sensitive information in profiles, posts, captions, or chats.
3. Camera, microphone, and on-device processing
Your browser asks for permission before CaliCombos activates a camera or microphone. The video editor and automated form/pose analysis are designed to process clip pixels on your device. Model assets may be downloaded to your browser, but local editing and analysis do not by themselves upload your source video or frame-by-frame pose data.
Data leaves your device when you intentionally use a network feature—for example, publishing a post, submitting a recorded battle turn, uploading an avatar or clip, starting a livestream, or connecting with an opponent. Livestream media is transmitted in real time and is not intentionally recorded by CaliCombos. Battle attempt clips may be retained as evidence, as explained below.
4. How we use information
- Provide accounts, profiles, saved preferences, posts, chat, groups, video editing, livestreams, battles, scoring, and support.
- Determine 16+ account eligibility, record policy acceptance, authenticate users, maintain sessions, route real-time media, and apply privacy and visibility settings.
- Generate workouts and run user-requested movement, rep, pose, and form analysis.
- Moderate content, investigate reports, prevent cheating, spam, fraud, abuse, and security incidents, and enforce our rules.
- Debug, maintain, measure, and improve performance, accessibility, safety, and reliability.
- Comply with law, protect rights and safety, and establish or defend legal claims.
Where privacy law requires a legal basis, we process data as needed to provide the Service you request, based on consent (including device permissions and publication choices), for our legitimate interests in security and improvement, and to comply with legal obligations. You may withdraw consent for future optional processing, but that does not make earlier processing unlawful.
We do not use uploaded video, pose data, or consumer health data to train general-purpose AI models without separate, affirmative permission.
5. How information is disclosed
Other users and the public
Your username and selected profile fields may be visible according to your settings. Public posts, comments, results, chats, and livestreams can be seen by their intended audience. Opponents receive real-time media and match information; spectators receive media only when the applicable stream and battle permissions allow it. Public or unlisted content may be copied outside the Service by viewers.
Service providers
We disclose information to vendors that help operate the Service, subject to appropriate restrictions. These include Google for sign-in; Cloudflare for delivery, security, encrypted object storage, and related infrastructure; our hosting and network providers; and real-time media software or relay providers used for livestreams and peer connections. A legacy deployment may use Microsoft Azure or Supabase for hosting, authentication support, database, or media storage. These providers process information under their own terms and our instructions where applicable.
Legal, safety, and business events
We may disclose information when reasonably necessary to comply with legal process, protect a person from harm, investigate abuse, or protect rights, property, and security. If the Service is involved in a merger, financing, reorganization, or sale, information may transfer as part of that transaction subject to this policy or notice of material changes.
We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use third-party advertising cookies. Infrastructure providers may set strictly necessary or security-related cookies or process network information to deliver the Service.
6. Retention
- Browser data: preferences, local combo history, theme, caches, and local project data remain until you clear them or browser storage removes them.
- Age gate, OAuth, and sessions: the submitted birth month is discarded after the eligibility decision; one-time age and OAuth handshakes normally expire in about 10 minutes; the passed-check timestamp and policy versions remain with the account; standard browser sessions normally expire after 7 days and may be revoked sooner.
- Chat: active platform, livestream, and battle chat history is generally limited to 30 days. Deleted-message records and security evidence may persist for a limited period.
- Livestreams: live audio/video is not intentionally recorded. Stream status and moderation records may remain for operations and safety.
- Posts and uploads: kept until you delete them or request account deletion. Deleting a match post may hide it publicly while preserving the underlying clip as participant-only match evidence.
- Accounts, profiles, workout history, and match records: kept while the account is active and as reasonably needed for the Service, safety, disputes, legal compliance, and fraud prevention.
- Logs and backups: kept for a limited period based on security, operational, and legal needs, then deleted or de-identified where reasonably practicable.
7. Your choices and privacy rights
You can use the workout builder without signing in, deny or revoke camera/microphone permission in your browser, clear local browser data, edit profile fields and privacy settings, choose post visibility, delete your posts or messages where the interface permits, end a livestream, and opt out of spectator battle broadcasting.
Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or a copy of personal information; object to or withdraw consent for certain processing; opt out of sale, targeted advertising, or qualifying profiling; appeal a denied request; and receive equal service when exercising privacy rights. We do not sell personal information or use it for targeted advertising.
Email [email protected] to exercise a right or request account deletion. Describe the request and the Google email or username tied to the account. We may need to verify your identity. An authorized agent may submit a request where permitted by law, but we may ask for proof of authority. You may appeal a denial by replying with “Privacy Appeal.” You may also complain to your local privacy regulator.
Deleting data may take it out of active systems before backup copies expire. We may retain information when required by law or reasonably necessary for security, fraud prevention, dispute resolution, or the rights of others, and we will explain any applicable exception.
8. Security
We use measures designed to protect information, including HTTPS, HttpOnly browser sessions in the current deployment, hashed session credentials, access controls, scoped media grants, and encryption of stored private workout videos. No system is completely secure. Use a secure Google account, choose profile visibility carefully, and do not share content you cannot risk becoming public.
If you believe your account or information is at risk, contact us promptly.
9. International users
CaliCombos and its providers may process information in the United States and other countries where privacy laws differ. Where required, we use recognized transfer safeguards. Users in the EEA, United Kingdom, or Switzerland may contact us about the applicable transfer mechanism or their data-protection rights.
10. Children
The Service is intended for users age 16 and older. We use a neutral birth-month screen before account creation but do not treat it as proof of identity. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information, contact us so we can investigate and delete it. Users between 16 and the age of legal majority must have a parent or guardian’s authorization where required.
11. Changes to this policy
We may update this policy as the Service or law changes. We will revise the effective date and provide additional notice for material changes. If a change would materially expand how we use previously collected sensitive information, we will request consent where required.
12. Contact
Tolbert Technologies LLC — privacy questions, requests, and appeals: [email protected]. General support: [email protected].