Last updated: October 1, 2026
CaliPanther is operated by Lotanang Hope Mohlala, trading as CaliPanther ("we", "our", "us"), based in South Africa. This Privacy Policy explains what the CaliPanther app and website ("the App") collect, why, and what you can do about it. Under the Protection of Personal Information Act, 2013 (POPIA) we are the responsible party for the personal information described here.
When you create an account we collect your email address. Authentication is handled by Google Firebase Authentication.
If you sign up with an email address and a password, the password is hashed by Firebase and is never visible to us or stored anywhere in the App.
If you sign in with Google or with Apple instead, we never see a password at all. We receive your email address and, where the provider sends one, your name — which we do not put on your public profile. An account created this way starts with no panther name and appears on the leaderboard as "Anonymous Panther" until you choose one in Settings. Signing in this way also tells Google or Apple that you use CaliPanther; what they do with that is covered by their own privacy policies, linked in section 3.
Your profile holds your panther name, XP, level, current streak, longest streak, total workouts, and the date of your last workout. This profile is public. It is what the in-app leaderboard reads, so anyone using CaliPanther can see those fields. Nothing else about you is public — not your email address, not your workout history, not your subscription. Choose a panther name you are happy for strangers to see.
When you finish a workout we store which exercises you did, the XP earned, and the time you finished, along with the achievements you have unlocked. This data is yours alone: it powers your stats and streaks and is readable only by your own account.
Your settings, your progress through the journey, and any workouts finished while you were offline are stored on your device and synced when you reconnect. Clearing local data in Settings removes this copy.
Rep counting with the camera is a premium feature. For premium accounts it is on by default and can be switched off in Settings. The camera never starts without your browser or device asking you first; if you decline, the workout runs on the timer instead. When it is on, the camera feed is read on your own device to work out where your joints are, and the rep count comes from that. No video, photograph, or body measurement is recorded, stored, transmitted to us, or shared with anyone — nothing leaves your device, and the camera stops the moment you leave the workout screen. The pose-detection model that reads the frames is downloaded to your device from a public code CDN; your video is never sent to it, or anywhere else.
If you turn on workout reminders, the reminders are scheduled by your own device. We do not keep a push token and we do not send you remote notifications. Turning reminders off in Settings, or in your device's notification settings, stops them.
We never receive or store your full card number, and we never see your card's security code (CVV). What we hold depends on where you subscribed:
CaliPanther contains no analytics SDK, no advertising SDK, and no crash-reporting service. We do not build a profile of your behaviour, we do not track you across other apps or websites, and we do not sell or rent your personal information to anyone.
We do not use your personal information for automated decision-making that has legal consequences for you.
We use these operators. Each holds only the data described above.
Some of these operators process data outside South Africa. Where they do, we rely on their contractual commitments to protect it to a standard comparable to POPIA, as section 72 of POPIA requires.
We keep your data for as long as your account exists. When you delete your account from Settings, your profile, workout history and achievements are removed immediately, and your account itself with them.
Payment records are the exception. The transaction references and the notifications our payment provider sent about them are kept as financial records for the period South African tax and company law requires — currently five years. They contain no workout data.
Everything the App sends travels over encrypted connections (TLS). Passwords are hashed by Firebase Authentication and are never stored by us. Access to your data is enforced server-side by Firestore security rules that allow each account to read and write only its own documents — with the deliberate exception of the public profile fields listed in section 1, which the leaderboard needs. Our payment provider's notifications are verified with a cryptographic signature before we act on them.
No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.
Under POPIA you have the right to:
To exercise any of these, email us at the address below. The Information Regulator can be reached at inforegulator.org.za.
CaliPanther is not directed at children under 13, and we do not knowingly collect personal information from them. If you are under 18, use CaliPanther only with the permission of a parent or guardian; under POPIA a competent person must consent to processing a child's information. If you believe a child has given us personal information, email us and we will delete it.
We may update this Policy. When we make a significant change we will post a notice in the App and update the date at the top. Continuing to use CaliPanther after a change means you accept the updated Policy.
Email: Hop3mohlala@gmail.com
Website: https://calipanther.app