Privacy

Last updated October 21, 2026

Calbr is run by cques LLC, a Florida company. It keeps a record of the firearms you tell it about and the scores you shoot. This page says exactly what that record contains, who can read it, which companies touch it, how long each part is kept, and what happens when you leave. Where the answer is uncomfortable, it is written down anyway.

What is stored

• Your account. An email address, and the date you confirmed you were 18 or older. No password, because signing in is a link sent to that address. No phone number.
• Your profile. A handle, optionally a display name, and optionally how long you have been shooting, your dominant hand and eye, and how you rate yourself.
• Your armory is sealed on your phone. Everything below that describes a gun, a part, a piece of gear, its care or its zero is locked on your phone (AES-256 encryption) before it is sent, except your wishlist, your ammunition and your reloading log, which are not sealed (below). We store the locked copy and cannot read it: not the make, not the model, not what you paid. What we can read is that a record exists, its dates and status, and round counts as numbers against an id that names no gun. What opens your armory stays on your devices and never with us in a form we can open: in the iPhone app it is kept in your iCloud Keychain, which Apple encrypts end to end, so with iCloud Keychain on, your other iPhones signed in to the same Apple ID open your armory by themselves. Your other devices open it with Face ID: your device makes a passkey for Calbr, kept by iCloud Keychain or your passkey manager, and the way in is locked with a secret only that passkey can give, after your face or passcode. We keep that locked copy, the passkey's id and a random value it is asked with, and cannot open it: the secret never reaches us. Turning Face ID off, starting your armory over or the purge after you delete your account removes it, and our change log keeps no copy of it. If your armory is locked anew, the device that holds it locks everything again on that device and the old Face ID copy is removed; we tell you each time it happens. We keep a short fingerprint so a device that cannot open it yet knows to ask. We cannot reset it, so if it is lost from every device, your iCloud Keychain and your Face ID passkeys, the sealed armory cannot be opened by anybody, us included.
• Your armory. For each firearm: make, model, type, caliber, barrel length, action type, capacity and a nickname if you give one, and, if you add them, what you paid, when, and where it came from in your own words, the dates it was lent out, at the gunsmith, put away or sold (and who had it, if you type that), and its maker's page, manual link, SKU and UPC. We never hold a serial number we can read. The database physically has no column for one and a check in the schema fails the build if anybody adds it. If you type a serial number or other private details into a gun's Records, they are kept on that phone; signing out of the phone removes them unless you saved them to a file.
• No sealed copies since 20 October 2026. The app no longer makes an encrypted copy of your serial numbers, private details and Records photos. A copy made before then stays as it was sent: encrypted on your phone before it left, so we cannot open it. It is removed when you delete your account, or sooner if you ask us at support@cques.ai.
• Your builds and wishlist. The parts on each firearm (brand, model, where it sits, and a cost or install date if you add them), and a wishlist of firearms and parts with your own target prices. Both are yours alone, unless you show a build to a crew: then its title, platform and the brand and model of each part are readable to that crew and to us, until you stop showing it or delete your account. Sharing a firearm does not share its build. A part you want for a gun you already have is kept on that gun and sealed like its parts: we cannot read what it is, only that it belongs to one of your guns, which is sealed too. The wishlist is for guns you do not have yet and their parts. A part listed for a gun you have before October 21, 2026 moves onto that gun the next time you open your wishlist, and the name it carried is then cleared from our copy.
• Your reminders. What a reminder says is sealed on your phone like your armory. We can read its day, how often it repeats and when you marked it done, and on its day we send an alert that says only that a reminder you set is due; your phone shows which one.
• Your gear, maintenance and ammunition. Gear that is not on a firearm (a holster, a safe, a case), with what you paid if you add it; each firearm's maintenance record (cleanings, parts replaced, malfunctions, gunsmith visits) and its service schedule; and the ammunition you stock, with what you bought, what you fired and what it cost. All of it is yours alone. Ammunition is not sealed: its caliber, brand, product, bullet and grain, UPC, storage and notes, and which of your guns (by an id that names no gun) fired it, are readable to us, and the low-ammo alert is worked out on our side from them. A gun's cleaning alert is worked out on our side too, from round counts, days and its schedule against an id that names no gun: it says only that a gun is due, and your phone shows which. Your reloading log and your wishlist are not sealed either.
• Your shooting. Sessions with a start and end time, which firearms you used and how many rounds, scores, where each shot landed on the target, split times, and any notes you type.
• Your profile photo and bio, if you add them. A photo you choose for your profile (location and camera data stripped out on our server before it is stored) and up to 160 characters about yourself. Each one shows only when you tick it on your card, and then only to the people in your crews and your friends; a private profile shows neither.
• Photographs, if you post one. A picture attached to a crew feed post. Location and camera data are stripped out on our server before the image is stored, not in your browser.
• A firearm's photo, if you keep a copy on your account. Your own photo of a firearm stays on your phone. Only if you choose “Keep a copy on your account” for that firearm is it sent to us, so your other phones can show it, together with where you marked your parts on it (a point on the picture for each part, nothing more). Location and camera data are stripped out on your phone, and the photo and your marks are then locked on your phone before they are sent: we store the locked copy and cannot open it, and nobody but you is ever shown it, whoever you share the firearm with. A 3D scan of your gun, if you add one, is kept on your phone only, with the parts you mark on it, and is never sent to us. The photos in your photo library (each gun's own album, and Range days, Targets, and Gear and receipts) stay on your phone, locked as your armory is. The Calbr lock (a PIN or Face ID, if you turn it on) stands in front of the app on that phone; what the phone keeps is protected at rest by the phone's own passcode encryption. In the iPhone app, when you ask, Calbr deletes from your Photos app the originals of photos you brought into the library; iOS asks you first, and nothing about them is sent to us.
• A request for your gun's exact model, if you send one. The make and model, a note if you add one, and a photo of each side if you add them, with location and camera data stripped out. It does not say who asked: your phone keeps the only link to it, so you can withdraw it. The photos are deleted once the model is done, or after 90 days.
• Your documents drawer, if you add to it. Receipts, manuals, warranties and transfer paperwork you choose to keep. Each one is locked on your phone before it is sent, its name included, after an image's location and camera data are stripped out. We store the locked file with its kind (receipt, manual and so on), its size and the day you added it, and cannot open it.
• Your crew. Which crews you are in and your role, feed posts, comments and reactions, range days and your RSVPs, and the ranges you add.
• Bookkeeping. Which of your devices has synced and when, so the app can work with no signal and catch up afterwards.

No location permission is ever requested. No advertising or analytics code runs in this app at all. When something in Calbr fails, or the app starts again by itself while it was open, the app sends us a short error report: the error's name and up to 300 characters of its wording with anything it quotes taken out, which screen it happened on (never what you typed into it, a code from a link or a record's id), and your phone's system and browser. It is linked to your account so we can follow up, and that link goes when your account is removed.

Who can see it

• Your armory is yours alone. Being in a crew with somebody does not let them see what you own. Nobody sees a firearm of yours unless you explicitly share it, and that is enforced by the database rather than by the screens. You can pick one gun or one piece of gear at a time to show your friends; your phone sends the label they will see (its name and caliber) with the share, and hiding it again deletes that label. They never see what you paid, its value, its photos or its records. Your whole armory can never be shared. When you add a gun, your crews see a post saying you added a firearm, with no make, model, type or photo.
• Your sessions and scores are visible to your crew. That is the point of a crew, and it is what a leaderboard is made of.
• A session you share is visible to anyone with its link. Only when you tap Share: the link opens a page with the day, the range, your rounds, your scores and your target, under your name. Never a firearm. Turn the link off from Home and the page shows nothing from then on.
• Your calendar link is visible to anyone who has it. When you put your range days in your phone's calendar, Calbr makes you a private link the calendar reads: the days of the crews you are in, their ranges and whether you said you are going. Never who else is going, and never anything from your armory. Make a new link from Profile, Security (or a crew's week) and the old one stops working at once.
• What you are bringing to a range day is yours unless you switch on showing it, and then your crew sees the make and model of those guns while you are going, nothing more.
• A crew's counter card counts scans, not people. Each scan is stored as a time and nothing else: not who scanned it, and not their phone.
• Your profile is a setting you control: private, or visible to the people in your crews. It starts private. Your profile is never open to everyone on Calbr, and there is no search or list of people: someone has to know your whole handle to ask to be your friend.
• Photographs go to your crew, and a profile photo you ticked to your crew and friends, through links that expire within minutes. The storage they live in is private and has no public URL.
• A report goes to the people who run Calbr, not to the person reported. When you report a message, a post, a comment or a profile, we keep who reported it, the reason and your note. The owner screen shows the reason, your note and the reported words, never your name; the person reported is not told who reported them. If it is hidden, its words go for everyone.
• The operator can read everything that is not sealed. Running the database means holding credentials that bypass every one of the rules above; what is sealed on your phone stays unreadable even then. That is true of every product of this kind and it is worth saying rather than implying otherwise.

Which companies touch it

• Supabase: the database and the photograph storage. This is where your data actually lives.
• Vercel: runs the app. Its request logs include IP addresses, as any web host’s do.
• Resend: sends the sign-in emails. It handles your address to deliver them.
• Cloudflare: when the check that you are a person is on, it runs on the sign-in screen before a sign-in email is sent. It sees your IP address and the signals from your browser and device it uses to tell a person from a script, as Cloudflare’s own terms describe; never your email address or anything in your armory. It is switched off today.
• Upstash: counts requests, so that nobody can be mailbombed or can guess their way in. Your address is hashed before it is used as a counter, so Upstash holds no readable addresses.
• GitHub: holds the nightly backups. They are encrypted before they are uploaded, and the tables holding live sign-in tokens are excluded from them.
• Stripe: takes the payment if you buy a paid display theme. It receives your email address and the billing address you type on its page, and we keep only that you bought the theme and Stripe’s reference for that payment. We never see your card. Nothing goes to Stripe unless you start a purchase.
• Anthropic: reads a photo of a firearm when you ask the armory to scan it for parts. You say yes each time; location and camera data are stripped out before the photo is sent, and we do not keep it. Anthropic keeps it for no more than 30 days under its own policy and does not train on it. Nothing goes to Anthropic unless you start a scan, and the scan is switched off today.
• Your browser’s push service (Apple, Google or Mozilla, depending on your phone and browser): carries a notification to your phone if you switch notifications on. In a browser it receives an encrypted message it cannot read; in the iPhone app, Apple carries the alert’s title and text to show them. It also holds the address of your phone’s subscription, which you can turn off at any time in the app or your phone’s settings.

How long it is kept

• Photographs: 90 days from upload. A photograph you withdraw, or one belonging to an account being deleted, is kept for a further 30 days and then the file itself is destroyed.
• Your profile photo and bio: until you change or remove them. When you delete your account the bio goes at once, and the photo file is destroyed 30 days later.
• Your account, after you delete it: your profile is scrubbed immediately, and 30 days later your armory is destroyed and your login is removed.
• The audit trail is kept. Every write to the database is recorded with a copy of the row, so a change can always be explained. No account can read it, including through your data export, and nobody can change it through the app, though the people who run the database could. What your armory holds is sealed on your phone before it is written (not your wishlist, ammunition or reloading log), so for the rest the trail keeps only the locked copy. When your account is purged, 30 days after you delete it, every entry about you or your records keeps its date and kind of change and loses what it said; an entry for something you did to another person's record (a score you recorded for them) stays theirs.
• Everything else is kept while the product exists: sessions, scores, feed posts, notifications, sync bookkeeping.

What deleting your account does, and what it does not

It removes: your handle and name, everything you told us about yourself, your crew memberships, the notes you wrote on your own sessions and range day replies, what you wrote in crew and range day chat, your notes on range pins, your feedback, your alerts, the builds you showed a crew and the names on your shares, and after 30 days your armory and your login. Your recap and calendar links stop working at once. Your feed comments are replaced with a marker so that conversations other people were part of still read.

It does not remove: your scores and sessions, which stay on finished seasons under an unnamed label so that a season somebody already won still adds up; the notes attached to individual scores, which cannot be edited once written; your crew feed posts, which are part of your crew’s record of its own afternoons; or the dates and kinds of change in the audit trail described above.

Deletion starts at once and cannot be undone. Your profile is scrubbed the moment you confirm, and the rest goes 30 days later as described above. There is no way back in through the same email address afterwards.

It cannot reach other people’s phones. Calbr works with no signal by keeping a copy on the device. If a crew mate has already synced, their copy of what they could see is on their phone, and leaving a crew does not reach across and delete it. Signing out removes the synced copy from the device you do it on; anything not yet synced, and what opens your armory, stay on it for when you sign back in. Deleting your account removes all of it. Deleting it from the iPhone app also removes what opens your armory from your iCloud Keychain; from anywhere else, it stays there until you remove it, and it opens nothing once the account is gone.

Getting a copy

Everything held about you can be downloaded as a file, at any time, from Profile, then Settings, in the app. It lists what it deliberately does not contain and why.

Cookies

A few small cookies: the ones that keep you signed in, which page scripts cannot read, one that recognizes this device for the list of where you have signed in, and one that remembers your Clear, Dark or Match phone choice. Two more last only while you sign in: one holds the link you opened until you tap Sign in (ten minutes), and one marks the browser that asked for a link, so a link somebody else sent you can be told apart (an hour). There is no advertising, no analytics and no third-party script, so there is nothing to consent to and no banner asking you to.

Age

Calbr is for adults. You confirm you are 18 or older when you sign in, and the date you did is recorded on your account.

Do Not Track

We do not track you across other websites, and no third party collects information about you across sites through Calbr. There is nothing for a browser Do Not Track or Global Privacy Control signal to opt you out of, so we do not change how the app behaves in response to one. Fonts and scripts are served from our own servers.

Asking us something

Questions about any of this, including a request to see or delete what is held about you, go to support@cques.ai.

Back to legal