Privacy Policy

SHIFT is provided by SHIFT COMPANY S.A. (RUC 80175870-0), Avenida Bernardino Caballero 749, 070112 Encarnación, Paraguay ("SHIFT", "we"), the controller of the personal data described here. This policy covers the SHIFT apps and website (the "Service"). Privacy questions and requests: legal@shifttraining.app.

• Account: name, email, date of birth, language, a hashed password and, for some third-party sign-in options, the account identifier they provide.
• Training: sports, goals, races, availability, height, weight, gender, thresholds such as FTP and heart-rate zones, equipment, sessions, feedback and notes.
• Health: injuries and symptoms you report, daily check-ins and, only if you connect them, data from wearables and health services: workouts (heart rate, power, pace, recorded routes), sleep, heart-rate variability, resting heart rate, recovery scores and body composition. From the health platform on your device (Apple Health or Health Connect) we only read the types you allow: sleep, resting heart rate, heart-rate variability, oxygen saturation, breathing rate, skin temperature, body weight, body fat, height, your date of birth and biological sex (from Apple Health), and your workouts. From each workout we read its identifier in your phone's health app (used to avoid importing it twice), its type, start and end, moving time, distance, active energy, elevation gain, average and maximum heart rate, power and speed, the heart-rate, power and speed measurements taken during it, where it took place (indoors, in a pool or in open water), its title, whether it was added by hand, and the app and device that recorded it. We write to it only the workouts you record with SHIFT on Apple Watch.
• Messages with Max, the AI coach, typed or, if you use voice features, spoken.
• Location, if you allow it: your city or an area of at least 5 km, for weather and planning, plus the routes in activities and race courses you import or upload.
• Purchases: subscription status and transaction records from the app store; never your card details.
• Device and usage: device and push-notification identifiers, app version, IP address, features used, how you found SHIFT, crash and error reports.
• Other: support requests and, if you are under 16, your parent or guardian's name and email.

• Providing the Service (plans and adjustments, tracking, syncing connected services, sending workouts to your devices, notifications and service emails), under our contract with you.
• Health data, a special category of data, only to provide and personalize your training and keep it safe (for example, flagging injury contraindications or urging you to seek care when a message describes emergency symptoms), and only with your explicit consent: you give it when you connect a service, allow access on your device or enter health information, and in the AI consent (Section 4).
• Security, support and improvement (preventing fraud and abuse, fixing errors, aggregated usage analysis), under our legitimate interest in a safe, working Service. You can object (Section 9).
• Marketing email, only if you opt in. Every marketing email has a one-click unsubscribe and a visible unsubscribe link; unsubscribing never stops essential account email.
• Legal obligations, such as tax and accounting records.

Your account details, date of birth, goals and availability are needed to provide the Service; everything else is optional.

SHIFT uses artificial intelligence to create, check and adjust your plans, write insights and power Max, which is an AI system, not a person. For this we send the data each task needs (profile, training and health data, goals, reported injuries and your messages) to third-party AI services. They generate the result for us under their terms and our agreements with them, and may keep it for a limited time under their own policies, for example to prevent abuse. One service you can connect, Ultrahuman, does not allow its data to be shared with AI services: we show you that data in SHIFT, but we do not send it to them. If your Ultrahuman app also writes to Apple Health or Health Connect, SHIFT reads that data as Apple Health or Health Connect data. We do not use your data to train AI models.

If you use voice features, what you say is streamed in real time to third-party AI services, which transcribe it and answer. We keep the transcript with your conversation with Max, like your typed messages, and we do not store audio recordings. The app uses your microphone only during a voice conversation you start. Voice features need a known date of birth and the AI consent below and, if you are under 16, your parent or guardian's permission (Section 10).

Before your first use of AI features, we ask for your explicit consent to (a) process your health and fitness data to personalize your training and (b) share it, and your conversations with Max (including voice conversations, if you use them), with third-party AI services for that purpose, and record when you gave it and which version you accepted. You can withdraw it at any time in your account settings: AI features then turn off for your account and we stop sending your data to third-party AI services until you consent again. Withdrawal does not affect earlier processing.

AI output can be wrong and is not medical advice; we apply safety checks, but you decide how you train. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We update this statement when the law or our providers' policies change.

• Third-party AI services, with your consent (Section 4).
• Wearables and health services you connect, to receive the data you authorize and, where supported, send them your planned workouts. Their own terms and privacy policies apply.
• Your coach or team, if you train with one: your profile, plans and training and health metrics.
• Service providers working for us: cloud hosting and infrastructure, email delivery, push notifications, error monitoring and crash reporting, website analytics, and weather and mapping services, which receive only an approximate location or the map area you view; on iPhone and iPad, if you open a route in Apple Maps (not offered for routes recorded by Garmin devices), Apple receives its exact start and finish.
• App stores, which process subscription payments.
• Your parent or guardian, if you are under 16.
• Authorities and others when the law requires it or to protect safety and rights, and a successor if SHIFT is reorganized or sold.

We share only what each recipient needs and require the AI services and service providers we use to protect your data consistently with this policy. We do not sell your personal data, share it for cross-context behavioral advertising, or use health data for advertising or marketing.

Our service providers page lists the AI services and service providers we use, with what each one does, the data it processes and where.

Our service providers may process your data outside Paraguay and your country, where laws may protect it less. Where the law requires it, we use appropriate safeguards; ask us about them at legal@shifttraining.app.

We keep your data while your account is open, except: messages with Max, including voice transcripts (deleted 180 days after they are sent), data exports (deleted 7 days after they are ready), security, operational and error logs (up to 180 days), product analytics events (up to one year) and purchase records (kept for tax and accounting obligations).

When you delete your account in the app's account settings, or ask us to, we delete it and the personal data linked to it right away; temporary processing copies are removed automatically within 10 days, and backup copies as the backups expire. Purchase records stay for as long as tax and accounting law requires, analytics events stay for the period above, audit and email logs are stripped of your details, and we keep a record that the deletion happened. When you disconnect a service, you can also delete the data imported from it, on the same terms. If that service's terms require it, we delete that data when you disconnect it or when we stop offering it. Anything you exported to your own device, such as calendar entries or files, stays under your control.

We encrypt data in transit, encrypt the credentials of services you connect, store passwords only as hashes and limit access to personal data. No system is completely secure; if a breach affects your data, we will notify you and the authorities as the law requires.

Depending on where you live, you can access, correct, delete or get a copy of your data, restrict or object to its use, and withdraw any consent at any time. Much of this works in the app (download your data, edit your profile, disconnect services, change your AI and email choices, delete your account); for the rest, write to legal@shifttraining.app. We may verify your identity and will answer within the legal deadline. You can also complain to a data protection authority, such as the one where you live or work.

US state residents can also act through an authorized agent and will not be treated differently for using their rights. In the past 12 months we collected the categories in Section 2, including sensitive information (health data, account credentials) and inferences used to personalize training, and disclosed them for business purposes to the recipients in Section 5. We do not sell or share personal information, and use sensitive information only to provide the Service.

SHIFT is not for children under 13; we do not knowingly collect their data and delete it if we learn we have. If you are under 16, a parent or legal guardian must give permission before you can finish setting up your account: we email them a request, and they can withdraw it at any time.

Our website uses only the cookies and local storage it needs for sign-in, security and your preferences, such as language and theme, with no advertising cookies or cross-site tracking. A cookieless analytics service measures performance and feature use, and our error-monitoring service receives data from your browser only when something breaks, with no session tracking and no recording of your screen. To measure sign-ups, we count visits and clicks on the way to sign-up, with the campaign tag of the link that brought you (such as utm_source) but without any identifier, and we store nothing on your device for it. If you create an account in the same visit, the tag travels in the sign-up link and we record it with your new account.

If you connect your Garmin account, Garmin sends us the data you allow in Garmin Connect: your activities (such as type, time, duration, distance, speed and pace, heart rate, power, cadence, elevation, calories, laps and GPS routes) and your health data (such as steps, active calories, resting heart rate, Body Battery, stress, sleep, heart-rate variability, pulse oximetry, respiration, skin temperature, blood pressure, body composition and height).

We use it to build and adjust your training plans, track your training and recovery, and show you your data. With your AI consent, we also send the parts each task needs to third-party AI services, which generate the result for us as the AI Transparency Statement (Section 4) describes; you can withdraw that consent at any time. Those services may not use Garmin data to train their own models. We do not use Garmin data to train, test, evaluate or benchmark AI models.

We keep it with the rest of your account data while your account is open, and delete it when you delete your account or ask us to. When you disconnect Garmin, we stop receiving your data and keep what we imported unless you choose to delete it when you disconnect in SHIFT, or ask us to.

We share Garmin data only with the recipients in Section 5: third-party AI services (with your AI consent), the service providers that host and run SHIFT, and your coach, if you train with one. With your permission, we also send your planned workouts to Garmin Connect so they reach your device. We do not sell Garmin data or use it for advertising.

We will post changes here with a new date and, if a change is significant, tell you in the app or by email before it applies and ask for your consent again where needed.

SHIFT COMPANY S.A., Avenida Bernardino Caballero 749, 070112 Encarnación, Paraguay.

• Privacy and legal: legal@shifttraining.app
• Support: support@shifttraining.app