Privacy Notice

Shiftova LLC, a Georgia limited liability company, is the data controller for personal data processed through the Shiftova app. This notice explains what we collect, why, who we share it with, and the rights you have.

1. Personal data we collect

• Account data — email address, login credentials managed by our authentication provider, and account identifiers.
• Health and fitness profile data you enter — sex, age, height, weight and target weight, activity level, goals, dietary style, spice preference, cuisines, foods you like and avoid, calorie/macro targets, and the physical and health limitations you choose to report (for example injuries such as a knee or shoulder problem, exercise restrictions, mobility or joint limitations, back sensitivity, pregnancy, health restrictions such as high blood pressure or diabetes, food allergies and intolerances, plus any free-text note you add about them).
• Plan and log data — generated workouts and meal plans, completed sets, rebuild history, weigh-ins, water and food logs, restaurant meals you record, and grocery lists.
• Crew data — the buddy or small group you join and the completed days you choose to share.
• Subscription status — plan, trial and renewal state received from our payment provider.
• Technical data — IP address, device and browser information, and basic usage/telemetry and error logs.

Card and billing details are collected and processed by Paddle, not by us; we never see your full payment card data.

2. Why we use it, and our legal basis

• Creating and running your account, generating and rebuilding plans, and tracking progress — to perform our contract with you.
• Health and fitness profile data, including reported injuries, mobility limitations, health restrictions and allergies — processed on your explicit consent, which you give by entering it, and used only to adapt your workouts and meals; you may withdraw consent by deleting the data or your account. We never sell it.
• Estimating macros for meals you describe — to perform our contract, using an AI processing provider on our behalf.
• Security, abuse and fraud prevention, and product improvement — our legitimate interests in a safe, working service.
• Customer support — to perform our contract and our legitimate interests.
• Tax, accounting and legal records — to comply with legal obligations.
• Marketing emails, if any — only with your consent, withdrawable at any time.

3. Who we share it with

• Service providers / subprocessors — hosting, database and authentication infrastructure, AI processing for macro estimation, error monitoring, and support tooling.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing.
• Other members of a crew you join, limited to the completion data the app shares.
• Professional advisers — legal and accounting, where needed.
• Authorities — where required by law.

We do not sell your personal data.

4. International transfers

Our providers may process data outside your country, including in the United States. Where data leaves the UK/EEA we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

5. Retention

We keep account, profile, plan and log data for as long as your account is active, and delete or anonymise it within a reasonable period (normally 90 days) after account deletion, except where we must keep records longer for tax, accounting or legal purposes. Error and security logs are kept for a short period only.

6. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. You can edit or clear most of your profile data directly in the app, and request deletion of your account by contacting us. If you are in the UK or EEA you can also complain to your supervisory authority. We respond to requests within one month.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls so you can only reach your own records, and least-privilege access to production systems.

8. Cookies and local storage

We use strictly necessary cookies and browser storage to keep you signed in, remember your unit and language preferences, and hold live workout timer state. We do not use advertising cookies. You can clear this data in your browser, though signing in will no longer persist. Reminder notifications are scheduled on your device only and require your browser permission, which you can revoke at any time.

9. Children

Shiftova is not intended for anyone under 16, and we do not knowingly collect their data.

10. Contact

Privacy questions or requests: Shiftova LLC — contact us from within the app.