Legal
Last updated: August 12, 2026
This policy describes the data handled by the current Calio service and its configured providers. Provider availability and configuration can vary by deployment.
Calio processes account identifiers, email and profile information supplied through Clerk; organization and membership records; project names and files; drawings, annotations, measurements and takeoff outputs; and technical request, security and error information. Clerk manages sign-in credentials. Calio does not receive your plaintext password from Clerk.
We use this information to authenticate users, isolate organization data, store and display project files, run requested AI-assisted analysis, operate collaboration features, prevent abuse, diagnose failures and improve the service. AI output is assistive and must be reviewed by a qualified person before use in an estimate or decision.
When you request an AI feature, relevant prompts, text and rendered drawing content may be sent to the model provider configured for that request, including OpenAI, Google or OpenRouter-backed providers. Provider retention and training treatment is governed by the active provider account and its terms. Do not upload information you are not authorized to send to those providers.
Vercel may receive page-view, performance and hosting telemetry. If configured, PostHog receives page paths, query strings, feature events and the signed-in Clerk user ID, name, email and avatar. If configured, Sentry receives stack traces, runtime and browser context, URLs, session-replay data, and the signed-in Clerk user ID, email and name. Application filtering is intended to avoid file bodies and credentials, but diagnostic data may still contain personal or project context. Treat invitation tokens and other sensitive query parameters as secrets and do not share them unnecessarily.
Service data may be processed by Vercel for hosting, Clerk for authentication, managed Postgres and configured object-storage providers for application data and files, Liveblocks for real-time collaboration, and configured email providers such as Resend. Signed URLs and application authorization checks are used to limit file access.
New web and iOS subscription purchases are currently unavailable. If legacy billing records exist, Stripe may process payment and subscription information under Stripe’s own privacy terms. Calio should not receive full card numbers or card security codes.
Data is retained while needed to operate the service, meet security and legal obligations, resolve disputes, and maintain backups. Retention periods vary by provider and configuration; Calio does not promise automatic deletion on a fixed schedule. Organization deletion may be blocked where governed evidence must be retained. Verified deletion requests are assessed against these constraints.
You may ask for access, correction, export or deletion of personal information. Available project exports cover the data exposed by those export tools and may not be a complete account archive. We verify the requester and will respond as required by applicable law. Calio does not sell personal information or use it for cross-context behavioral advertising.
Send privacy requests to privacy@calio.dev. Send vulnerability reports to security@calio.dev. Do not include passwords, API keys, invitation tokens or unredacted confidential drawings in an initial email.
See also the Terms of Service.
Search for a command to run