Privacy Policy
Effective date: July 30, 2026
Shift ("we", "our", or "the app") is a workout tracking app built by Zuhayr Khan. This policy explains what information Shift processes, why it is used, where it is stored, and the choices available to you.
1. Information We Process
Account and authentication information
When you create or access an account, we may process:
- Your email address and authentication identifiers
- A securely hashed password when email-and-password sign-in is used; we do not receive or store your plaintext password
- Identity information provided for authentication when you choose Sign in with Apple or Google
- Purchase and subscription entitlement status supplied by Apple; Shift does not receive your full payment-card details
Profile information
You may provide a name, date of birth or age, body weight, profile image, fitness preferences, goals, and equipment preferences. Shift is for people aged 13 or over and uses age information to enforce that requirement.
Workout and progress information
- Workout plans, exercises, sessions, sets, repetitions, weights, timers, and notes
- Exercise goals, achievements, streaks, and progress
- Custom exercises and plan-generation preferences
- Body-weight entries and body measurements
- Progress photos you choose to upload
Apple Health information
Health access is optional and requested by feature. Depending on the features you enable, Shift may ask to read:
- Step count, walking and running distance, active energy, exercise time, stand time, and activity summaries
- Workout records, heart rate, resting heart rate, heart-rate variability, and sleep analysis
- Body weight
If you enable the related sync options, Shift may write completed workouts and body-weight entries to Apple Health. Shift requests only the Health categories needed for enabled features. You can deny or revoke any Health permission in iOS Settings.
Voice input
The plan generator can use Apple's on-device speech recognition when the selected language and device support it. Shift requires on-device recognition and does not upload voice audio to our servers. If on-device recognition is unavailable, voice input is disabled and you can type instead.
On-device AI
When available, AI plan generation and editing use Apple's on-device Foundation Models framework. Prompts and generated plans are processed on your device and are not sent to an external AI provider by Shift.
Technical information
Shift and its service providers may process limited technical information needed to authenticate requests, secure the service, deliver data, diagnose failures, and prevent abuse, such as timestamps, request metadata, and service logs. Shift does not use third-party advertising analytics.
2. How We Use Information
We use information to:
- Create and secure your account
- Record workouts and maintain plans, goals, and progress
- Sync information across your phone, watch, widgets, and other supported devices
- Provide the Health, notification, subscription, voice, and on-device AI features you choose
- Provide support, maintain reliability, prevent abuse, and comply with legal obligations
3. Storage and Security
- On your device: Shift stores app information in its local app container. iOS security features, including device data protection where available, help protect that container.
- Cloud sync: Account and workout information is stored using Supabase and transferred over encrypted TLS/HTTPS connections. Database row-level security restricts records to the signed-in account.
- Progress photos: Photos are stored in a private Supabase Storage bucket. The app stores private object paths and creates short-lived signed links only when an authorised account needs to display a photo.
- Authentication: Supabase Auth manages account authentication. Apple or Google also processes information when you choose its sign-in option.
No system can guarantee absolute security, but we use access controls and data-minimisation practices intended to protect your information.
4. Service Providers and Disclosure
We do not sell your personal information. Information may be processed by:
- Supabase: authentication, database hosting, secure storage, and service operations
- Apple: App Store purchases, Sign in with Apple, Apple Health, device notifications, speech recognition, and on-device system frameworks you choose to use
- Google: authentication only when you choose Sign in with Google
We may also disclose information when reasonably necessary to comply with law, protect users or the service, investigate fraud or security issues, or complete a business transfer subject to appropriate safeguards.
5. Retention and Deletion
Account information is retained while your account is active and as needed to provide Shift. Some limited service logs or records may be retained for security, fraud prevention, dispute resolution, or legal compliance.
You can permanently delete your account from Settings. The deletion process removes your Shift profile, workout and progress records, custom content, cloud-stored progress photos, and authentication account. Local Shift data is then removed from your device and you are signed out. Deletion cannot be undone.
6. Your Choices and Rights
- Access and correction: View and update available profile, workout, and progress information in Shift.
- Deletion: Delete individual supported items or delete your account from Settings.
- Apple Health: Review or revoke permissions in iOS Settings > Privacy & Security > Health > Shift.
- Notifications: Manage feature notifications in Shift and system permission in iOS Settings.
- Photos and biometrics: Progress photos are optional. Face ID protection, when enabled, is handled by iOS; Shift does not receive your biometric template.
Depending on where you live, you may have additional rights to access, correct, delete, restrict, or receive a copy of personal information. Contact us to make a request. We may need to verify your identity.
7. Children
Shift is not intended for children under 13, and account creation requires confirmation that the user is at least 13. We do not knowingly collect personal information from a child under 13. If you believe this has occurred, contact us so we can investigate and delete the account and associated information.
8. International Processing
Service providers may process information in countries other than your own. Where required, appropriate safeguards are used for international transfers.
9. Changes to This Policy
We may update this policy as Shift changes. The current version will be posted on this page with a revised effective date. Material changes will be communicated where required.
10. Contact
For privacy questions or requests, contact: