Privacy policy

Calmo was built with the opposite of surveillance in mind. This page describes what we collect, where it lives, and how to delete it.

Account. If you create an account, we store your email and an encrypted password at Supabase. That's enough to let you sign in. There is no profile data beyond this.

App data on the server (only if you sign in). Breaks you've taken, glasses of water logged, manual break adjustments, exercises you completed, and your reminder settings. All of this lives in Supabase (European Union, Ireland), is linked to your account, and is covered by row-level security policies that only allow you to read and write your own rows.

Pain log stays on your device. Pain entries are saved in your browser's localStorage. They never leave this device. If you clear your browser data, they go with it.

Anonymous analytics. We record a small set of events (page views, sign-ups, start of a focus block, waitlist signups and similar) with no user id, no IP address, no cookie and no device identifier. A random session id lives in memory for the current tab only.

No ads, no third-party trackers, no cookie banner because we don't use cookies that need one. We use GitHub Pages to serve the site and Supabase to store the account data. That's the entire list of providers.

Delete your account. Settings → Delete my account. That calls a server function that removes your Supabase user and cascades to every piece of data linked to it. The action is immediate and cannot be undone.

Delete local data. Settings → Clear local data wipes anything Calmo stored in your browser (including the pain log).