Skip to main content
calibrHQ

Privacy Policy

Version 2026-10-17 · Effective 17 October 2026 · Last updated 1 November 2026 · Calibr HQ Pty Ltd

This policy explains how Calibr HQ Pty Ltd (“Calibr”, “we”, “us”) handles personal information when you use the Calibr website, apps and services. We are an Australian company and handle personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Because Calibr personalises training from your health screening and fitness data, some of what we collect is sensitive (health) information, which we only handle with your express consent.

1. What we collect

  • Account and identity: display name, email address, date of birth (used to enforce our 16+ age rule and minor safeguards), and authentication identifiers.
  • Free-trial eligibility: a one-way SHA-256 identifier derived from a comparison form of your email address (lowercase with any +tag removed). We preserve the address you entered for login and delivery and do not remove dots or apply provider-specific address rules.
  • Health information (sensitive): your PAR-Q health-screening answers and outcomes, GP clearance evidence where you provide it, fitness baselines (for example FTP, 1RMs, 5k time), rendered workout targets and completed workout results, and — for 16–17 year olds — parent/guardian consent records.
  • Location, if you record a route: if you turn on Record route for an outdoor run or ride, your phone uses its precise location while you train, including with the screen off. Before anything leaves your phone, we remove the first and last 500 m of the route and anything within 500 m of where you started or finished. We keep that trimmed route with your distance, splits and elevation. We never receive your exact start or finish. Recording is optional and only for people aged 18 and over.
  • Payment information: subscription and transaction records. Card details are collected and held by our payment processor, Stripe — we never see your full card number.
  • Content you create: messages in program chat and reports you submit.
  • Technical data: device and log information needed to run and secure the service, including IP address and browser details recorded as evidence when you give consent.

2. Why we collect it (collection notice)

We collect and use your information to:

  • create and administer your account and verify eligibility (age, and guardian consent for 16–17s);
  • screen for training readiness and personalise your program — rendering workout targets from your baselines within our safety limits;
  • process subscriptions, payments and coach payouts, enforce one free trial per canonical email address, and keep records tax law requires;
  • operate program chat and moderate content for safety;
  • if you record a route, keep it so you can look back on it in your training history, let your coach see it, and let you export it. If Calibr HQ later lets you share routes or suggests routes, it will tell you first, and ask where your consent is needed;
  • respond to support requests and safety escalations;
  • meet our legal obligations, including under privacy, consumer and tax law.

If you do not provide the information marked as required during setup, we cannot provide a personalised program. Browsing public program pages does not require an account.

3. Consent and lawful basis

We rely on your consent for collecting health information and for marketing; on the need to perform our contract with you for account, subscription and program delivery; and on legal obligations for records we must keep (such as tax records). Consents are recorded with the document version you accepted and can be withdrawn at any time in the app or by contacting us — withdrawal stops the related processing but does not affect processing that already happened.

4. Health information — your express consent

When you tick the health-data consent during setup, you expressly consent to Calibr collecting and handling the health information described in §1 for the purposes in §2 only: screening your training readiness, personalising your program, applying safety limits, and meeting our safety and legal obligations. We do not use your health information for advertising, and we never sell it.

  • Health information is stored in Australia (AWS Sydney region), encrypted at rest, with access audited.
  • Your coach sees the training data needed to coach you — baselines, rendered targets, results and your messages — not your raw PAR-Q answers.
  • A route you record is treated as health information. Only you and your current coach can see it. Other coaches, past coaches and other athletes cannot.
  • If you are 16 or 17, we also require your parent or guardian’s consent before collecting health information.
  • You can withdraw this consent at any time; doing so stops personalised rendering and further health-data collection, and you can then delete your account and data (§7).

5. Who we share information with

We share personal information only as needed to run Calibr:

  • Your coach — training data required to deliver your program (see §4).
  • Service providers: Amazon Web Services (hosting and authentication, Sydney region), Stripe (payments), and media infrastructure providers (Mux, Cloudflare) for video content. Some providers process limited data outside Australia (for example Stripe payment processing in the United States); where they do, we take reasonable steps required by APP 8 to ensure your information is handled consistently with the APPs.
  • Google draws the map under your route in the app, where your phone, or your coach’s phone, shows one, using the Google Maps software built into the app. The route line is drawn on the phone; Google receives map-area requests for the area around your trimmed route, with the phone’s IP address and device details. The Google Maps software also sends Google, automatically, a random identifier for that software, crash and performance information and how the map is shown and used, which Google uses to run and improve its services. Google does not receive your name, email address or other account details from us. Google handles this outside Australia, including in the United States.
  • Authorities where the law requires it.

We do not sell personal information, and we do not share health information with advertisers.

6. How long we keep it

  • Health screening, baselines and training history: while your account is active.
  • Routes: kept until you delete them or delete your account. Exact location points stay encrypted on your phone only while a workout is recording. They are deleted when it is saved or stopped. If your phone can’t delete them straight away, Calibr HQ deletes them the next time you open the app once they are more than a day old.
  • Financial and tax records: retained for the period Australian tax law requires (up to 7 years), in anonymised form after account deletion.
  • Consent and safety records: retained as evidence for the period the law allows or requires.
  • Child-safety and sexual-content reports: if something you uploaded or sent is reported because it may put a child at risk or is sexual content, we keep that item until we release the hold on it, which may be after our safety review of it ends, even if you delete your account in the meantime. We also keep a record of who uploaded or sent it (name, email address, sign-in identifier and when the account was created). That record is encrypted, only authorised Calibr HQ staff can open it, every time it is opened is logged, and it may be given to police or another authority where the law requires or allows. It is kept for as long as the item is held, and is destroyed when we release the hold.
  • Free-trial eligibility identifier: retained while Calibr operates the one-trial policy, including after account deletion, solely to prevent repeated trials. It is not used for login, email delivery or marketing.
  • Deleted accounts: we disable account access and remove active product identifiers within 30 days of your deletion request. Some health, safety, consent, audit or legal records may be retained in a restricted archive where Australian law requires or permits retention (§7).

7. Access, correction, export and deletion

  • You can access and correct your information in the app, or by contacting us.
  • You can export your data as a portable file from your account settings.
  • You can delete a route at any time from the workout in your history. Your coach stops seeing it straight away. Routes are in your data export and are deleted with your account.
  • You can delete your account and personal data at calibrhq.com/account/delete or in the app. We disable account access and remove active product identifiers within 30 days. Some health, safety, consent, audit or legal records may be retained in a restricted archive where Australian law requires or permits retention, and the one-way free-trial eligibility identifier is retained for the narrow purpose described in §6. If a child-safety or sexual-content report about something you uploaded or sent is under review, the item and an encrypted record of who you are are kept until we release the hold, which may be after the review ends (§6).

8. Marketing communications

We only send marketing email if you opt in, and every message includes a working unsubscribe link, consistent with the Spam Act 2003 (Cth). Service messages (receipts, safety notices, security alerts) are sent regardless of marketing preferences. We never use your health information for marketing.

9. People aged 16–17

Calibr is available from age 16. Consistent with OAIC guidance, we treat people aged 16 and over as generally able to consent to the handling of their own personal information; because training programs involve health information and physical risk, we also require a parent or guardian to confirm their consent before a 16–17 year old can record health information or subscribe. Guardians can contact us at any time to withdraw that consent, which stops personalised rendering for the minor.

10. Security and data breaches

We protect personal information with encryption in transit and at rest, row-level access controls, multi-factor authentication for privileged access, and audit logging. If a data breach is likely to result in serious harm we will notify affected users and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

11. Cookies and similar storage

We do not use advertising, analytics or social-media cookies, and we do not track you across other websites or apps. Apart from the campaign details described below, which we keep only if you accept them, everything our websites store on your device is strictly necessary: it signs you in, keeps your account secure, protects a form from bots, saves work you have not finished, remembers your cookie choice or remembers that you have seen a notice about a change to this policy. The site cannot work without it, so it cannot be switched off.

Cookies (small files your browser sends back to us):

  • Sign-in (__Host-calibr_id_token, __Host-calibr_access_token and __Host-calibr_refresh_token): keep you signed in. Only our server can read them, and your browser sends them only over a secure connection to the site that set them. The first two last about an hour; the refresh token lasts up to 30 days. Signing out deletes them.
  • Sign-in expiry (__Host-calibr_session_expires_at): holds only the time your sign-in expires, so the page knows when to renew it. It contains no password or token. It lasts up to 30 days, and signing out deletes it.
  • Our sign-in page: when you use our sign-in page (auth.calibrhq.com), Amazon Cognito, our sign-in provider, sets its own cookies there. They protect the sign-in form and let you sign in again without retyping your password for up to an hour.

Storage in your browser (kept on your device and not sent to us automatically):

  • Sign-in checks (session storage): one-time security values that let us finish a sign-in safely, and the page to return you to. They are deleted as soon as the sign-in finishes, or when you close the tab.
  • Forms in progress (session storage): your answers while you set up your account, coach profile or training target, and which parts of a page you had open, so a refresh does not lose them. They are deleted when you close the tab.
  • Workout in progress (local storage, calibr_workout_session_…): the sets you tick and the values you type during a workout, so a refresh or crash does not lose them. They stay on that device until your completed workout is saved to your account, and are then deleted.
  • Your cookie choice (local storage, calibr_storage_consent): whether you accepted or rejected the campaign details, and when, so we do not ask on every visit. It lasts six months, whichever you chose, and then we ask again.
  • Privacy notice seen (local storage, calibr_privacy_update_seen): which notice about a change to this policy you have already seen, so we show it only once. It holds no personal details and is kept until you clear the site data in your browser.

Bot check on the coach application form. Our coach application page uses Cloudflare Turnstile to tell people from bots. It reads technical details about your browser and device and may store a short-lived security value. Cloudflare uses only what it needs to run the check, not for advertising, and may handle it outside Australia, including in the United States. It runs only on that page.

Campaign details (only if you accept). The first time you visit our public pages, a cookie banner asks whether we may keep campaign details, with Accept and Reject side by side. If you accept and you reached our home page or coach application page through a link with campaign tags (utm_source, utm_medium, utm_campaign), for example from a newsletter or an ad, we keep those three values in session storage (calibr-attribution) so that, if you apply to coach with us, your application records which campaign brought you. They say nothing about you on their own, are never shared with an advertiser and are deleted when you close the tab. If you reject, or have not answered, we keep nothing and your application records no campaign. You can change your answer at any time from Cookie settings at the foot of every public page; rejecting deletes anything already kept.

The Calibr app does not use cookies. It keeps your sign-in, your settings and the training you can use offline on your phone so the app works, and the sign-in details and offline training data are encrypted. The app has no advertising or analytics tools of its own; the Google Maps software sends Google the data described in section 5. The app does not track you across other apps. If you sign in through our sign-in page from the app, Amazon Cognito sets the sign-in page cookies described above in your phone’s browser.

You can see and delete cookies and site data in your browser’s settings at any time. Signing out deletes the sign-in cookies, and closing the tab deletes session storage. If you block cookies for Calibr, you will not be able to sign in. Before we add any other cookie or similar storage that is not strictly necessary, such as analytics, we will update this section and ask for your consent first.

12. Questions and complaints

Contact us at support@calibrhq.com — we will respond to privacy complaints within 30 days. If you are not satisfied with our response you can complain to the OAIC at oaic.gov.au.

13. Changes to this policy

We update this policy as Calibr develops. Material changes are notified in the app and, where they affect a consent you gave, we ask you to re-consent. The current version and effective date appear at the top of this page.

Privacy Policy · Calibr HQ