Privacy Policy
Last updated: October 7, 2026
The short version. We ask for your first name and your email so we can tell you when the Finish Strong Challenge opens. We do not sell your information, we do not share it with advertisers, and you can leave at any time using the link at the bottom of every email. If you want everything we hold on you deleted, email us and we will do it.
If you start buying the challenge, we also save the name, email and phone you type in the checkout, so we know when a payment did not finish. Here is how.
On this page
1. Who we are
This site is run by Cali Baby ("we", "us"). It coverschallenge.calibabyfit.com and the emails we send you about the Finish Strong Challenge. If you buy the challenge, the payment itself is taken by an external payment provider, and their terms apply to that part as well as ours.
2. What we collect
Only what the waitlist actually needs. Here is the complete list, straight from our database. What the checkout asks for is explained below the table.
| What | Where it comes from | Why |
|---|---|---|
| First name | You type it | So our emails say your name instead of "Hey there" |
| Email address | You type it | It is the whole point: it is how we tell you the challenge is open |
| Country | Worked out from your connection | To know where the challenge is being asked for. It is the country only, never your address |
| Time zone | Your browser | So that "today" means your today. At 11pm in Los Angeles it is already tomorrow in other clocks |
| The language you were reading in | The page you signed up from | So we write to you in the language you chose, English or Spanish |
| How you found us | The link you clicked (source and campaign tags) | To know which post or video actually brought people in |
| When you signed up | Our server | It is our record that you asked for these emails |
| A scrambled version of your IP address | Your connection | To stop one bot from submitting the form a thousand times. It is a one way hash with a secret key, we cannot turn it back into your IP, and it is deleted within about 24 hours |
Joining the list does not collect your last name, your address, your phone number, your date of birth, your health information or your payment details. There are no advertising trackers and no social media pixels on this site.
We do count visits, with an analytics tool we run ourselves on our own domain. It tells us which pages are read, the country a visit comes from, the post or video that brought it, the kind of device, and how many people tap the button to join. It does not use cookies and it never stores your IP address. It keeps a small visit record in your browser's storage so that one visit counts as one, and that visit ends after half an hour without activity. Nothing is counted on the payment pages.
If you arrive from one of our emails, that visit is linked to your email address, which we already have: it is how we know whether an email was actually useful to you. Otherwise every visit stays anonymous.
When you buy the challenge, our checkout page first asks for your name, your email and your phone number: the name is so we know who you are, the email is how you get into your dashboard, and the phone is so we can reach you about your challenge if we need to. Below that, a payment provider's form is embedded in the page, so that your card details go straight to them.We never see your card number.
We save those details as soon as you type your email in the checkout, before you pay, together with whether you ticked each box, which version of these texts you saw, the country, region and time zone your connection comes from (not your address), how you reached us (the link or ad you came from, and the first page you saw), and the internet address (IP) of your connection, which we keep only as proof of what you agreed to and to stop fraud. That is how we know when a payment did not finish. If you do not finish, we may send you one email about your order. If you are in the European Economic Area or the United Kingdom, or we cannot tell where you are, we only send it if you ticked the box for news and offers. That box is also the only way onto our newsletter, and we never send marketing text messages.
The challenge itself asks for more than the waitlist does: your age, your height, your weight, other health details, and progress photos. What is held, for how long, and who can see it is in section 12 of theFinish Strong Challenge Terms.
3. Why we collect it
Because you asked us to tell you when the challenge opens, and we cannot do that without an email address. In legal terms, we process this on the basis of your consent, which you gave by filling in the form, and you can take it back whenever you want.
When you start buying the challenge, we keep your checkout details because you asked us to sell it to you: we need them to take your payment and to give you access. If you do not finish, we keep them for 90 days so we can help you complete the order you started. In legal terms, that is the steps you asked for before a contract, and our legitimate interest in following up on it. News and offers are different: only with the box ticked, and you can untick it any time with the link in our emails.
4. Who else touches it
We do not sell your personal information. We do not share it for cross context behavioral advertising. We have never done it and we are not planning to. Nobody pays us for your data, and no advertiser gets near it.
To run the service at all, we use a small number of specialist providers. These are the categories, and what each one is allowed to do:
- Website hosting and security: serves the pages, and keeps bots away from the form.
- Data storage: where your name and email are kept, on servers in the United States.
- Email delivery: gets our emails to your inbox.
- Payments: only if you buy something, and only to take the payment. We never receive your card details.
Every one of them is contractually bound to use your information only to provide that service to us, and never for their own purposes. We choose providers that commit to that in writing.
If you want to know exactly which companies these are, email us and we will tell you. We publish categories rather than names here for the same reason we do not publish the rest of our security setup, but you have every right to ask and we will answer.
We will also hand over information if the law requires it, which so far has never happened.
5. How long we keep it
- Your name and email: until you unsubscribe or ask us to delete them.
- Checkout details, if you do not buy: 90 days, then they are deleted automatically. If you do buy, they become part of your purchase.
- The IP saved with your checkout details: 90 days, then it is deleted automatically. It never leaves our database.
- The scrambled IP of a waitlist signup: about 24 hours, then it is purged automatically.
- A short lived backup copy, kept only if your signup could not be saved straight away because something was down at that second: it deletes itself after 30 days, and normally it is gone within minutes. If one of those copies arrives damaged and we cannot read it, we hold it apart a while longer so a person can rescue your signup by hand, and then it goes as well.
- Unsubscribe records: we keep the fact that you unsubscribed even after that, because it is the only way to make sure we never email you again by accident.
6. Your rights, including California
Wherever you live, you can ask us to:
- Tell you what we hold about you, and give you a copy.
- Correct anything that is wrong.
- Delete all of it.
- Stop emailing you, which you can also do yourself with one click.
If you are in California
The California Consumer Privacy Act, as amended by the CPRA, gives you the rights above plus the right to opt out of the sale or sharing of your personal information, and the right to limit the use of sensitive personal information. Two straight answers about those two:we do not sell or share your personal information, andwe do not collect sensitive personal information as the law defines it, so there is nothing to limit. We will never treat you differently for exercising any of this.
In the past twelve months we have collected the categories listed in section 2, which fall under "identifiers" and "internet activity" in the statute. We disclosed them only to the service providers listed in section 4, and only so they could run the service.
If you are in another state
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and a growing list of others have similar laws. The rights above are what those laws give you, and we apply them to everyone regardless of where you live. It is simpler that way, and fairer.
How to use any of this
Email hello@mail.calibabyfit.comfrom the address you signed up with, and say what you want. We answer within 45 days, which is the deadline California sets, though in practice it takes us days, not weeks. If you write from a different address we may ask you something only you would know, so that nobody can delete or download your data by pretending to be you. You can also have someone act on your behalf.
7. Email, and how to stop it
Every email we send carries an unsubscribe link at the bottom and works with the one click unsubscribe button your email app shows. One click and it stops, no questions and no forms to fill in.
If you have bought the challenge, the emails about the program you paid for are a separate list from the marketing ones, so you can leave the marketing and still get your workouts.
We send from a name you will recognise, we never fake the sender, and the subject line always says what is inside. That is what United States law (the CAN SPAM Act) requires, and it is also just how we want to write to you.
8. How we protect it
The whole site runs over an encrypted connection. Your browser cannot reach the database at all: the only credential that opens it lives on our server and never leaves it, and the connection to it is encrypted too. The waitlist never stores your IP address in a form we could read back. The checkout does keep it, for 90 days and only as proof of what you agreed to and to stop fraud, and it never leaves our database.
No one can promise a system will never be broken into. What we can promise is that we hold as little as possible, which is the only protection that never fails, and that if something happened we would tell you and the authorities within the time the law gives us.
9. Children
The Finish Strong Challenge is for adults. This site is not directed at children under 18, and we do not knowingly collect information from them. If you believe a child has signed up, email us and we will remove it.
10. Cookies
Four, all ours, and none of them is for advertising or for following you around.
The first is called idioma. It holds the word en ores, and it lasts a year.
It only exists because this site shows itself in the language your browser asks for. If you use the language switch at the top to pick the other one, that cookie is how we remember it. Without it, your browser would send you back to its own language every single time and the switch would never work for you.
It does not identify you, it does not follow you anywhere, and it is not shared with anyone. Delete it in your browser whenever you like and nothing breaks: the site simply goes back to guessing from your browser.
The second is called __Host-pago_fs, and it is only set when you open the payment form. It holds the code of your payment session, so that the details you type in the checkout are saved with your own payment, and so that the page you land on after paying takes you, and nobody else, into your dashboard. It lasts a day. It comes with a twin called__Host-vuelta_fs, which holds a random code made for your payment and nothing else: the page you land on after paying sends it along, so that only the browser you paid in can open your dashboard. It also lasts a day.
The third is called enlace_fs, and it is only set if you arrive from a personal link we sent you. It holds the code of that link, so your price is applied when you pay. We take the code out of the address bar the moment you arrive, so it does not stay in your history, and the cookie ends when the offer behind that link does.
The visit counter from section 2 is not a cookie. It keeps its visit record in your browser's own storage, and clearing your browsing data removes it.
The first page of your visit and the link that brought you are not a cookie either. They are kept in your browser for that tab only, and gone when you close it, so the checkout can tell us how you reached us.
The payment form is run by our payment provider, and it may set its own cookies to keep the payment safe. Those are theirs, not ours.
11. Changes, and how to reach us
If we change how any of this works, we will update this page and change the date at the top. If the change matters to you, we will say so in an email rather than hoping you notice.
Questions, requests, or anything that reads wrong here:hello@mail.calibabyfit.com. A real person reads it.