KalmeFit Privacy Policy

Reviewed by KalmeFit, September 2026.

Effective: September 24, 2026
Last updated: September 24, 2026

1. Who we are

KalmeFit is a fitness app with an AI companion named Kalme. It is offered on kalmefit.com, iOS and Android by Squadora L.L.C., a Minnesota limited liability company ("KalmeFit", "we", "us"). Squadora L.L.C. is responsible for the personal information described here.

Contact for privacy questions and requests: privacy@kalmefit.com. For anything else: hello@kalmefit.com.

This policy covers the KalmeFit apps, the website kalmefit.com, and the pilot.

2. Who KalmeFit is for

KalmeFit is for adults 18 and older in the United States. We check your birth year at sign-up and do not create an account for anyone under 18. We do not knowingly collect information from anyone under 18. KalmeFit has no teen or child mode. If we learn that a user is under 18, we delete their account and data. If you believe someone under 18 has given us information, write to privacy@kalmefit.com and we will delete it.

3. What we collect

3.1 Your account

• The email address your sign-in provider gives us (Apple may give us a private relay address instead)
• Your birth year, used to confirm you are 18 or older
• Which sign-in provider you used: Apple or Google. KalmeFit has no passwords and no email sign-in, in the apps or on kalmefit.com.
• Your time zone and the weekdays you want to train
• Whether you have a paid plan, and which version of our terms and consent you accepted
• A device token so we can send you notifications, if you allow them
• For Sign in with Apple, a token Apple issues so we can revoke the sign-in when you delete your account

3.2 What you tell Kalme about your training

• Your goals, the equipment you have, your experience, and any injuries or restrictions you list
• Your answers to the health screening questions at the start (a PAR-Q+ style screen). We ask for your consent before collecting them, use them only to keep your plan safe, keep them while your account exists, and delete them on their own whenever you ask
• How ready you feel on a given day, and notes you add, such as sleep hours, energy, mood and free text
• The workouts you do and the sets you log
• Your conversation with Kalme

Some of this, such as injuries, sleep, energy and mood, relates to your health. We treat it as sensitive: it is used only to provide KalmeFit to you, it is never sold, and it is never used for advertising. Our separate Consumer Health Data Privacy Policy (kalmefit.com/health-privacy) covers this data in full, as Washington's My Health My Data Act requires (RCW 19.373.020).

3.3 What Kalme remembers

Kalme keeps only memories you confirm: your intake answers, the Notes line, and preferences you accept on a confirm card. Kalme does not quietly build a memory from your messages. You can see and delete each memory in Settings.

3.4 Payments

If you subscribe, payment is handled by Stripe on our website. We receive whether the payment succeeded, your plan and its renewal date. We do not receive or store your full card number.

3.5 Keeping the service safe and affordable

To prevent abuse and control cost, we keep:

• a one-way hash of a device identifier, and a shortened one-way hash of your IP address, used for rate limits and to stop mass account creation
• a record of each AI request's cost and size (token counts). These records never contain what you wrote or what Kalme replied.

Deleting your account does not reset the device-level abuse counters.

3.6 What we do not collect

• No advertising identifiers, no ad trackers, and no third-party analytics.
• The website kalmefit.com sets no cookies and stores nothing in your browser.
• v1 does not collect nutrition, wearable, or body scan data.

3.7 The contact form on kalmefit.com

When you send us a message through the Contact form on kalmefit.com, we keep:

• the name, email address, topic and message you typed
• which page you sent it from, and when
• a keyed one-way hash of your IP address. We never store the address itself. The hash lets us limit how often one connection can send (at most 5 messages an hour) and review abuse.

A contact message is not linked to a KalmeFit account, so deleting an account does not delete a message sent through the form; write to privacy@kalmefit.com and we will delete it. Before a message is accepted, your browser solves a small computing puzzle that makes automated spam expensive. The puzzle uses no personal information.

3.8 How we count visits to kalmefit.com

We count page views ourselves, without cookies, advertising tags or third-party analytics. For each visit, the page sends us:

• which page was viewed (home, the launch post, or sign-in)
• the host name of the site that linked you there, if any (for example www.google.com, never the full address)

From the request itself we derive a device class (phone, tablet, desktop, or automated crawler). We keep a daily count of views per page and device class. The linking host name goes only to our server logs and is not added to the counts. The IP address is used only as a keyed one-way hash for a rate limit and is never stored.

We do not set cookies, store anything in your browser, build a profile, or fingerprint your device, and we do not record your country or location. If your browser sends a Global Privacy Control or Do Not Track signal, the page does not count your visit at all.

3.9 Photos for equipment import

You can take a photo of gym equipment, or of a gym's equipment list, to fill in your equipment. Only a photo taken with the camera inside the app can be used; the app does not upload photos from your library, and it does not accept PDFs or other documents.

The photo is sent once, through KalmeFit's own server, to Anthropic's Claude model (section 5), which may only answer with items from our fixed list of equipment types. It is not asked to identify people or faces. We do not store the photo: it is discarded once the equipment has been read. You review the list before anything is saved, and only the equipment you confirm is kept. Anthropic keeps what it receives, including the photo, for up to 30 days (section 5). Please keep people out of the frame.

3.10 Gym location (future step, not live)

This section describes a planned feature. It is not live, collects nothing today, and will not take effect until the feature ships, and we will update this policy before it does.

KalmeFit may later let you save a gym as your own and see equipment other members have reported at that gym. It will be optional. You can pick a gym by name and address, or turn on location only when you choose to search nearby. Your precise location is used on your device to find nearby gyms, and the search is sent to Apple Maps to identify the gym. We will store which gym you chose, never your location or a location history. Equipment you personally confirm at a gym is counted toward that gym's shared list. Others see only the equipment types that enough separate members have confirmed, never who confirmed them, how many did, or when. You can stop sharing and delete your contributions at any time. Precise location is sensitive data under Minnesota's and other states' laws, so before this feature collects anything we will ask for your opt-in consent to use it, separately from any other consent, and add Apple Maps to section 6.

4. How we use it

• To run your account and sign you in
• To plan and adjust your training, and to let Kalme reply to you
• To send notifications you turned on (the notification text is generic and holds no health details)
• To process purchases
• To prevent abuse, enforce usage limits, and keep costs under control
• To fix problems and keep the service secure
• To meet legal obligations

We do not sell your personal information, share it for cross-context behavioural advertising, or use it for advertising of any kind.

5. Kalme's AI: Anthropic (Claude) and Google (Gemini)

Kalme's replies are written by an AI model, reached only through KalmeFit's own server. Your device never talks to an AI provider directly. We use two providers:

• Anthropic's Claude is the model for every reply.
• Google's Gemini is a backup that answers only if Claude is unavailable. The backup is switched off at launch. While it is off, nothing you write goes to Google's AI. Before the backup is ever turned on, we will update this policy, tell you, and ask for your consent again; if you do not agree, nothing you write goes to Google's AI.

• Before Kalme's first AI reply we ask for your consent, and the consent screen names the provider (or providers) that may receive your messages and describes what is sent. If you decline, AI replies stay off and the rest of KalmeFit keeps working. You can withdraw consent later in Settings.
• What is sent: your message, instructions we write for the model, and the parts of your training information that the reply needs (for example your goals, equipment and any restrictions you listed). If you use equipment import, the photo you take (section 3.9). We do not send your name, email, or account identifiers.
• How Anthropic handles it: we use Anthropic's commercial API. Anthropic may not use your messages, photos or Kalme's replies to train its models, and processes them under its Data Processing Addendum. Anthropic keeps the inputs and outputs of each request for 30 days, during which Anthropic may review them for safety and misuse, and then deletes them.
• How Google handles it, if the backup is ever switched on: we use Google's paid Gemini API. Under Google's terms for paid use, Google does not use your messages or Kalme's replies to improve its products, and processes them as our data processor. Google keeps a log of requests and replies for a limited period, only to detect and prevent misuse and for legally required disclosures, and may store that data briefly or cache it in any country where Google or its agents have facilities, so it can be processed outside the United States.
• Kalme is an AI, not a person, and not a clinician (see the Terms, section 4).

6. Who we share it with

If Squadora L.L.C. is involved in a merger or sale, your information may move to the new owner under this policy, and we will tell you before it does.

7. How long we keep it

• Your account and training data: while your account exists, whether you use KalmeFit free or paid. Cancelling a subscription deletes nothing; your account continues on the free plan.
• Accounts no longer used: if you have not signed in for 24 months, we email you a warning. If you still do not sign in, we delete the account and its data 30 days after that email, as "When you delete your account" below describes.
• When you delete your account: we delete your data from our live systems right away, revoke Sign in with Apple, and remove your notification token. Copies in our backups are removed as those backups expire, within 98 days.
• Conversation history: kept while your account is open, so Kalme can pick up where you left off. You can delete it at any time in Settings, and it is deleted with your account.
• Abuse and cost records (section 3.5): 90 days.
• Payment records: 7 years, for tax and accounting duties.
• Contact form messages (section 3.7): 12 months from when you send them, then deleted. You can ask us to delete one sooner.
• Page view counts (section 3.8): 24 months. They are daily totals with no information about any person.
• Rate-limit records for the website: each holds only a keyed IP hash (or no IP at all) and a count, and is marked to expire one hour after its counting window ends (the longest window is one day), then deleted automatically.
• Server logs (including the linking host name from section 3.8): 30 days, then deleted automatically.
• Equipment photos (section 3.9): not kept by us; kept by Anthropic for 30 days (section 5).

8. Your choices and rights

You can:

• See and download your data: Settings, export, as a JSON file
• Correct it: edit your profile, or ask us
• Delete a memory: Settings, memories
• Delete your account: in the app, which permanently deletes your data as section 7 describes

These controls are in the app. An account page on kalmefit.com arrives when paid plans launch; until then, use the app or write to privacy@kalmefit.com.

• Withdraw AI consent: Settings, at any time
• Turn off notifications: in the app or your device settings

Depending on where you live (for example California, Colorado, Connecticut, Minnesota, Oregon, Texas, Virginia or Washington), you may have further rights: to know what personal information we hold and get a copy, to correct it, to delete it, and to opt out of its sale, of targeted advertising and of profiling. We do not sell or share personal information, use it for targeted advertising, or profile you in ways that have legal or similarly significant effects.

To use a right, write to privacy@kalmefit.com or use the controls above. We may confirm the request comes from you by replying to the email address on your account, and you may use an authorized agent where your state allows it. We will answer within 45 days; if we need longer, as the law allows, we will tell you why within those 45 days. If we decline a request, you can appeal by replying to our answer. We will decide the appeal within the time your state's law sets and, if we still decline, tell you how to contact your state's attorney general. We will not treat you differently for using your rights. For consumer health data, our Consumer Health Data Privacy Policy describes your rights in full.

9. Security

Data moves over encrypted connections and is stored on Google Cloud with access rules that let each person read only their own data. API keys stay on our servers and never ship in the apps. No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires, including under the FTC Health Breach Notification Rule where it applies.

10. Changes

We will tell you in the app before a material change takes effect, and ask for your consent again where the change needs it. The date at the top shows the latest version.

11. Contact

KalmeFit is operated by Squadora L.L.C., a Minnesota limited liability company. Privacy: privacy@kalmefit.com. General: hello@kalmefit.com.