Privacy
Privacy policy
Text prepared from the processing actually implemented in CalisForm (landing, waitlist, cookies, and analytics). Items marked “TO VALIDATE” must be confirmed before Production. This document is not legal advice and does not claim guaranteed GDPR or ePrivacy compliance.
1. Who operates CalisForm
CalisForm is a technique-analysis service for calisthenics, available notably at calisform.app. Current public contact: hello@calisform.app. TO VALIDATE: legal name of the operator, legal form, registered address, company number (e.g. Belgian CBE if applicable), and country of the controller. Until these are confirmed, the controller is not fully identified here.
2. Data we collect
On the landing and waitlist, we may process: the email address you submit to join; an approximate country code when the host provides it — the IP address is not stored for this purpose; optionally a public partner code present in the URL (?ref=) at signup time; the interface language for the confirmation email; technical security measures (temporary in-memory rate limiting, without durable storage of the IP in the waitlist database). Theme, language, and cookie-consent preferences may be stored locally in your browser. If you later create a CalisForm account, other account and analysis data (identifier, first name, scores, hold, history) may be processed in the app; analysis videos are not stored permanently on our servers. After consent, audience and experience tools may collect page-usage data (URL, events, interactions) without including your email in PostHog.
3. Purposes
We process this data to: record your waitlist signup; send a confirmation email and notify you when V1 is available; measure aggregated market interest via the approximate country code; attribute a signup to a partner when a valid ?ref= is present at submission; operate the site (language, theme, security, remembering consent); and, only if you consent, measure landing traffic and improve the experience via browsing recordings. Proposed legal bases (TO VALIDATE): pre-contractual steps / signup purpose for the waitlist and availability notice; a basis to confirm for the aggregated approximate country code (often described as legitimate interest, not confirmed here); consent for non-essential cookies and trackers; a distinct basis to confirm for commercial partner attribution. Joining the waitlist alone does not mean you authorize all marketing communications unrelated to the service launch — TO VALIDATE.
4. Waitlist and emails
When you join the waitlist, your email is stored (Supabase) and a contact may be created or updated with our email provider (Resend). We send a signup confirmation email (once). That email states we will notify you when CalisForm V1 is available. These messages relate to your signup (confirmation and availability notice). They do not prove you accepted promotional newsletters, general commercial offers, or other campaigns unrelated to the service launch. Any further marketing should rest on a distinct basis and notice — TO VALIDATE. Current sender: CalisForm <hello@calisform.app>.
5. Partner links (?ref=)
If you arrive with a ?ref=CODE parameter and that partner code is valid when you sign up, the code may be linked to your signup in the database to track or compensate creators / partners. Without a valid ?ref= in the URL at submission time, no attribution is created. We no longer generate a persistent affiliate visitor ID in the browser, and we no longer automatically count affiliate clicks for this waitlist attribution. Open point (TO VALIDATE legally): the legal basis and notice required for this commercial attribution via tracking link; the technical mechanism alone is not an exemption under GDPR or ePrivacy.
6. Retention periods (proposals)
No final retention schedule has been approved yet. Coherent, minimal proposals to validate: (1) waitlist email and related fields (source, approximate country code, optional attribution) — until the V1 availability notice, then deletion or anonymization within a reasonable time (proposal: 12 months after that notice), or sooner on request, unless a legal obligation or distinct accounting need linked to affiliation applies — TO VALIDATE; (2) cookie-consent preferences (local storage) — until changed or cleared; (3) theme and language — about 12 months for the theme cookie (current technical max-age), or until changed; (4) local “already joined” flag — browser session only; (5) statistics / recordings (PostHog, Microsoft Clarity) — per provider durations after consent (often up to about 12 months for some cookies) — TO CONFIRM in their docs and contracts; (6) waitlist rate limiting — server in-memory timestamps only, not stored as waitlist data in the database.
7. Service providers
Technical providers identified in the current implementation: Supabase (database / authentication); Resend (emails and waitlist contacts); Vercel (hosting and infrastructure headers, including approximate country code when applicable); PostHog EU Cloud (landing statistics, after “Statistics” consent); Microsoft Clarity (landing recordings / heatmaps, after “Experience improvement” consent); Whop (payments) when applicable for the app. Exact roles (controller / processor), DPAs, and precise processing locations: TO VALIDATE.
8. Cookies and trackers
We distinguish: (a) Essential — required for the site to work (theme and language preferences, remembering your cookie choice, technical security / session). They are not used for advertising. (b) Statistics — only after your “Statistics” consent; provider: PostHog (EU region, eu.i.posthog.com). They help us understand landing traffic and confirmed signups (event without email). (c) Experience improvement — only after the matching consent; provider: Microsoft Clarity. They enable heatmaps and browsing recordings on the landing; entered fields (including email) are masked in the current setup. You can accept, reject, or customize via the banner, and change your choice via “Cookies” in the footer. Withdrawal stops loading non-essential tools and reasonably clears related trackers. No persistent affiliate identifier is stored in the browser for a later visit. Provider cookie lifetimes: TO CONFIRM in PostHog and Microsoft Clarity policies.
9. Statistics and browsing recordings
PostHog loads only after “Statistics” consent, on allowed production hosts. PostHog Session Replay is disabled. Typical data: URL, language, aggregated events (page view, confirmed waitlist signup), optionally the public ?ref= code if present in the URL — never the email in PostHog. Microsoft Clarity loads only after “Experience improvement” consent; recordings / heatmaps cover the landing; no analysis videos, Luna chats, or authenticated pages in this setup. Localhost and Vercel previews are excluded from tracking unless a technical debug mode is on. These tools do not replace the source of truth for signups: Supabase.
10. International transfers
PostHog is configured toward EU hosting (eu.i.posthog.com). Microsoft Clarity is a Microsoft service that may involve processing outside the EU / EEA. Resend, Supabase, Vercel, and other providers may also process data according to their infrastructure. Applicable contractual safeguards (standard contractual clauses / SCCs, adequacy decisions, signed DPAs): TO VALIDATE with counsel and provider contracts. No transfer compliance is asserted here.
11. Your rights and contact
Under the GDPR, you may request access, rectification, erasure, restriction, portability where applicable, and object to certain processing, or withdraw cookie consent without affecting the lawfulness of prior processing. For the waitlist (no account), contact hello@calisform.app. If you have an account, you may also use Profile features (download my data / delete account) when available. You may lodge a complaint with the competent supervisory authority (in Belgium: the Data Protection Authority — TO CONFIRM based on the controller’s country). Appointment of a Data Protection Officer (DPO): not presented as mandatory by default at the current scale; any obligation is TO VALIDATE under GDPR Article 37 (public authority, large-scale regular and systematic monitoring, or large-scale special categories).
12. Updates
We may update this policy to reflect product or legal changes. The version published on this page prevails. Last revision date: TO VALIDATE at Production publication.