Privacy
ShakeFit Privacy Policy
Version 1.5 · Last updated 13 September 2026 · Effective from the date this document is published at https://shakefit.app/privacy
This policy describes what ShakeFit does with information, and what it does not do. Every item below was written against the app's source code, and the review record in review-notes.md names the file each statement came from.
ShakeFit runs on iOS and on Android, from the same codebase. The way the app handles your camera, your records and the optional server sync is identical on both. Three things are not identical, and each is marked iOS or Android wherever it appears: health data, which exists on iOS only; payment, which is handled by Apple on iOS and by Google on Android; and the optional sign-in provider, which is Sign in with Apple on iOS and Google on Android.
Controller and contact
- Controller: WorkNPLAY Inc., 5F, 20, Daedeok-daero 241beon-gil, Seo-gu, Daejeon 35229, Republic of Korea
- Business registration number: 304-86-01720
- Privacy contact and person in charge of personal data protection: JEEHO SONG, contact@shakefit.app
1. The short version
- Every feature works without signing in, and there is no password and no sign-up form. Where server sync is switched on, the app still creates an anonymous account for itself, described below.
- Signing in is optional, and it exists so a second device can pick up where the first left off. Where the app offers it, iOS offers Sign in with Apple and Android offers Google. If you sign in, your email address is held by our backend provider, and with Apple it may be a private relay address. If you never sign in, no email address for you exists in our systems.
- Camera frames are processed on your device and discarded. No video and no image is stored, and none is sent anywhere.
- Your profile, workout history, weight log and progress are stored on your device.
- iOS: heart rate from Apple Health is read only, used during and just after a session, and never uploaded or shared. Android: the app reads no health data at all, because it has no health integration.
- When server sync is switched on in a build, the app creates an account identifier, anonymous unless you sign in, and uploads numeric session summaries and product analytics events. It uploads no pose data, no video, no age, no height, no weight, no body composition and no heart rate.
- There is no advertising and no third-party analytics SDK, and we do not track you across other apps or websites. Nothing is sold.
2. The camera and the pose model
To score a repetition, ShakeFit needs to see you move.
- Camera frames go from the camera to an on-device pose model (MediaPipe Pose Landmarker) inside the app. The model returns coordinates for 16 body joints.
- Face landmarks and fingertip landmarks are discarded inside the native module before anything leaves it. The app never uses facial data, and the figure it draws has no face and no hands.
- Joint coordinates exist in memory for the length of the session, drive the score, and are then gone. They are not written to storage and not transmitted.
- The app contains no code that encodes video and no code that sends camera data over a network. That absence is the safeguard, not a setting you have to trust. The app writes exactly one image file, and only when you ask it to: a result card drawn from your own numbers, described in section 3.
- Camera access is requested by the operating system the first time a session starts, on both platforms. You can withdraw it at any time: on iOS in Settings, and on Android in Settings, then Apps, then ShakeFit, then Permissions. Without camera access, sessions cannot be scored.
The screen shows a live camera preview during a session so you can frame yourself. The preview is drawn and discarded frame by frame like everything else.
3. What is stored on your device
All of the following stays on your device, in the app's own storage.
| What | Detail |
|---|---|
| Age | Your age in years only. You enter a date of birth once for the age check, and the date of birth itself is never stored |
| Body figures you choose to enter | Height, weight, sex, weekly session goal |
| Safety notice acknowledgement | The timestamp when you confirmed the safety notices. Your answers to health questions are not stored, only that you confirmed |
| Session history | Up to 400 sessions: day, effective seconds, estimated calories, muscle points, whether the session counted, track id, total score, max combo, whether you finished |
| Weight log | Up to 400 entries: day and weight |
| Weight goal | Target loss, if you set one |
| Body measurement | Body fat percentage and skeletal muscle mass, if you enter them |
| Progress | XP, levels, unlocks, streak, earned badges with the day you earned them, your longest weekly streak, an opt-in monthly challenge marker, an active theme program marker, and the display state of the occasional Plus preview card |
| Track records | Best score, stars, rank, badge, play count and last played day per track |
| Settings | Silent mode, screen enhancement, auto zoom at distance, reduced motion, low impact, volume, audio calibration offset, difficulty feedback you gave after sessions, the daily track's frozen difficulty for the day, and whether reminders are turned on |
| Language | Your language choice, if you set one |
| Installation identifier | A random UUID generated on the device, described in section 5 |
| Pending analytics | Analytics events waiting to be sent, described in section 5 |
| Session token | Where server sync is on, the token for your server session, anonymous or signed in, kept in the operating system keychain. It is issued by our backend provider, and for a signed-in session the token itself carries the email address that provider holds. The app does not read that address and keeps no separate copy of it |
| Age block flag | If the age check blocked the app, that fact is kept so the check cannot be bypassed |
| Pending session summaries | Where server sync is on, session summaries waiting to be uploaded, kept until the upload succeeds |
| Records from your other devices | Where you are signed in, a cached count of plays made on your other devices, so the app can show it without asking the server again |
| Access grant | If a code unlocked the paid tracks on this device, that fact and the day it was granted |
| Result card image | A PNG the app draws from your own numbers when you ask to share, written to the app's own cache directory. It holds no camera image. The app hands it to the system share sheet and where it goes next is your choice. The cache is cleared by the operating system, and by the app's own delete action |
Not stored anywhere, on the device or elsewhere: date of birth, answers to the health self-check, camera frames, pose coordinates, heart rate samples, and your phone number, which the app never asks for. The app never asks for your name either, but on Android the sign-in token Google issues carries the name on your Google account, and that token goes to our backend provider, so the name reaches it as part of signing in. Section 5 explains what happens to it. The app never asks for an email address either. An email address exists only if you choose to sign in, in which case it comes from Apple or Google and is held by our backend provider, as section 5 describes.
Your device backup may include this app's local data, depending on your own backup settings. On iOS that backup is between you and Apple. On Android the app allows backup, so it is between you and Google, or whoever runs the backup service on your device. Either way we have no access to it.
4. Heart rate from Apple Health, on iOS only
Android: this whole section does not apply to you. The Android build of ShakeFit has no health integration: no Health Connect, no Google Fit, and no health, activity recognition or body sensor permission. There is no health implementation on Android, so the shared code path that would talk to a health platform finds nothing to connect to and reports the feature as unavailable. No heart rate is read, shown or stored on Android.
iOS: if you allow it, ShakeFit reads two data types from Apple Health: heart rate and active energy burned.
- Access is read only. The app requests an empty write set, so it cannot write anything into Apple Health, and it does not.
- Heart rate is used to show live beats per minute during a session and an average, minimum and maximum in your results. Active energy is used to show what Apple Health recorded for the session period, alongside the app's own estimate.
- Health data is used in memory for the session and the results screen. It is not saved to the app's storage, not uploaded, and not shared with anyone.
- Health data is never used for advertising, marketing or any similar purpose, and is not used to build a profile of you.
- iPhone has no heart rate sensor. Live values only arrive while an Apple Watch is recording a workout, or while another device writes heart rate into Apple Health. When no samples arrive, the app shows nothing rather than showing zero.
- Everything else in the app works without Health access. You can grant or revoke it at any time in iOS Settings, under Privacy and Security, then Health.
The separate notice in health-data.md covers this in the form Apple asks for during review. That notice describes the iOS integration only, for the same reason: there is none on Android.
5. What leaves the device
ShakeFit has an optional server backend. It is switched on by build configuration, and when it is off the app has nowhere to send anything and stays entirely local. When it is on, exactly the following leaves your device.
An anonymous account. By default the app signs in anonymously to our backend. No email, no password, no name. The result is a random account identifier held by our processor and a random installation identifier held on your device. Neither is linked to your identity by us. Under some privacy laws, including the GDPR, such an identifier is still personal data, which is why it is described here.
Your email address, only if you sign in. Signing in is optional. Every part of the app works without it, nothing in the app requires it, and its one purpose is to let another device continue from your existing record count. Where the app offers it, iOS offers Sign in with Apple and Android offers Google, one provider per platform.
When you sign in, the provider asks whether to share your name and email address with ShakeFit. What it sends goes to our backend provider, Supabase, which stores the email address on your account record. On Android the token Google issues also carries your name, and it is held with the account record by the same provider. On iOS the name arrives in a separate field that ShakeFit never reads, so it never leaves your device. With Sign in with Apple you may choose Hide My Email, and then the address stored is the private relay address Apple generates rather than your personal one. Either way it is an email address, so it is listed here as data we collect.
ShakeFit's own code never reads that address, and never reads the name either. Neither is shown in the app, used to contact you, used for marketing, or matched against any other service. It exists because our backend provider holds it as part of the account. Deleting your records deletes the account and that address with it, as section 10 describes. If you never sign in, no email address for you exists in our systems at all.
Session summaries. When you finish a session, these fields are sent: track id, number of exercises, valid repetitions, invalid repetitions, max combo, effective seconds, tracking loss count, whether the session counted, whether the source was the camera or a replay, and the client timestamp.
Product analytics events. Our own event schema, with primitive values only. The app is built so that free text and nested objects are rejected before an event is stored, which keeps personal data out of it structurally. The events the current build sends are:
| Event | Fields |
|---|---|
onboarding_step | step name, phase (view, complete, skip, camera intent, deferred profile offered/saved/skipped), camera intent flag |
onboarding_complete | weekly goal |
session_start | track id, silent mode flag, restart flag, demo replay marker |
session_complete | the session summary fields listed above |
star_upgrade | track id, previous and new star count |
reminder_optin | granted or not |
reminder_open | reminder kind |
free_shelf_view | none |
upsell_view | none |
share_card | card variant |
session_abandon | the session summary fields, or track id and stage when you leave before the first repetition |
paywall_view | none |
purchase_start | product id, whether a free trial applies, and whether the purchase completed |
trial_start | product id, and whether the purchase completed |
dashboard_view | none |
Network metadata. Like any network request, the request carries your IP address and a timestamp, which our hosting processor logs.
Nothing else is uploaded. Specifically not uploaded: your age, height, weight, sex, body fat, skeletal muscle mass, weight log, weight goal, calorie estimate, muscle volume, XP, levels, streak, track records, language, settings, camera frames, pose coordinates and heart rate.
Analytics events are buffered on the device when there is no network, capped at 500 events, oldest dropped first, and are sent on the next app start or session end.
This section is about what the app sends. Your device backup is a separate path, run by the operating system rather than by the app, and section 3 describes it.
6. Why we process this
| Purpose | What it uses | Legal basis under the GDPR |
|---|---|---|
| Running the app: scoring, records, progress, settings | Everything in section 3, on your device | Performance of the contract with you |
| Showing heart rate during and after a session, iOS only | Apple Health data, in memory | Your consent, given through the iOS Health permission |
| Scoring your movement | Camera frames, on the device | Your consent, given through the camera permission on your device, and performance of the contract |
| Understanding where people get stuck and whether sessions complete, so the app can be fixed | The account identifier, session summaries, analytics events | Our legitimate interest in improving the app, balanced by sending summaries only, with no personal detail and no third-party analytics |
| Letting another device continue from your existing records, if you choose to sign in | Your account identifier, the email address the sign-in provider gives us, session summaries | Performance of the contract, at your request. You start this only by signing in, and you end it by deleting your records |
| Selling and restoring a subscription | Purchase state from the store you bought from, Apple on iOS or Google on Android, and from RevenueCat | Performance of the contract |
| Meeting legal obligations and defending claims | Records we are required to keep | Legal obligation, and legitimate interest |
We do not make automated decisions that have a legal effect on you or similarly significantly affect you. A grade is a game score.
7. Who receives data
We do not sell personal data, and we do not share it for advertising.
| Recipient | What they get | Role and place |
|---|---|---|
| Supabase, our backend provider | The account, session summaries, analytics events, request metadata including IP address, when server sync is on. If you sign in, also the email address the sign-in provider gives us, which Supabase stores on the account record | Processor. Hosting region: Seoul, Republic of Korea (ap-northeast-2) |
| RevenueCat | Subscription and purchase state, with an identifier RevenueCat generates itself. We pass no identifier of ours to it | Processor for subscription state. United States |
| Apple, iOS only | Your purchase, billing, refunds and subscription management on the App Store. If you choose Sign in with Apple, Apple runs that sign-in and therefore knows you signed in to ShakeFit, and Apple gives us your email address or the private relay address you chose instead. We send Apple nothing about how you use the app. Apple's own privacy policy applies to those relationships | Independent controller for the App Store and for Sign in with Apple. Apple Health data stays on your device and is not sent to Apple by us |
| Google, Android only | Your purchase, billing, refunds and subscription management on Google Play. If you choose to sign in with Google, Google runs that sign-in and therefore knows you signed in to ShakeFit, and Google gives us your email address. We send Google nothing about how you use the app. Google's own privacy policy applies to those relationships | Independent controller for Google Play and for Google sign-in |
| Authorities | Only what the law requires, and only after checking that the request is lawful | As required |
The table above is the complete list of recipients the app sends anything to. In particular there is no advertising network, no attribution provider, and no third-party analytics SDK in the app. Your device backup is not something the app sends; it is run by the operating system and described in section 3. The music, the coach voice and the guide motion were produced before release and are bundled with the app, so no service is contacted to play them. The coach voice falls back to your device's built-in speech synthesis for lines with no pre-generated clip, which happens on the device.
8. International transfers
Where server sync is on, the account record, including the email address on a signed-in account, together with session summaries and analytics events, is stored in Seoul, Republic of Korea (ap-northeast-2). RevenueCat, and the store you bought from, Apple or Google, process data in the United States and other countries where they operate.
If you are in the European Economic Area, the United Kingdom or Switzerland, transfers outside your region rely on the European Commission's standard contractual clauses or another lawful transfer mechanism in the relevant provider's data processing terms.
If you are in the Republic of Korea, the recipients, the items transferred, the purposes, the retention periods and the countries are the ones listed in sections 5, 7 and 9. You may refuse the transfer. Running Delete all records in the app's settings erases the summaries and telemetry held on the server together with the account itself; after that, not enabling a network connection for the app stops any further transfer. Refusing does not stop the app working locally.
9. How long we keep it
| Where | How long |
|---|---|
| On your device | Until you delete records in the app, or delete the app. Session history and the weight log keep the most recent 400 entries, and older entries are dropped automatically |
| Session summaries and analytics events on the server | Until you delete them from the app, and in any case no longer than 24 months from the day they were received |
| The account record itself, anonymous or signed in, including the email address on a signed-in account | Until you delete your records in the app, which deletes the account, see section 10 |
| Purchase records held by Apple on iOS, or Google on Android, and by RevenueCat | For the period those companies state in their own policies, and for as long as we need them for tax and accounting obligations |
10. Your choices and your rights
Delete everything on the device. Open Profile, then Data. The screen shows how many records exist. Confirm, then hold the delete button. This removes your profile, session history, weight log, weight goal, body measurement, settings, progress and track records. The age block flag is deliberately kept so the age check cannot be bypassed by deleting data. Deletion cannot be undone.
Delete what is on the server, and the account with it. The same delete action asks our server to delete your session summaries, your analytics events, your profile row and the account record itself, and then discards the session token on the device. This is one operation on the server: if any part of it fails, none of it is applied, the app tells you it failed, and it does not delete your device records either.
This is the same whether the account is anonymous or created by signing in. Deleting a signed-in account removes the email address held for it, and nothing is kept to recognise you if you sign in again later. Deleting the account does not cancel a subscription, because the store you bought from holds that; cancel it there, as the support page explains.
If the server part cannot complete, for example because you are offline, the app offers to delete on the device only and says so plainly. In that case write to contact@shakefit.app and we will remove the server copy within 30 days of confirming the request.
Turn off the parts you do not want. Camera access is only needed to score a session. On iOS you can revoke camera access, and Health access, in Settings at any time; Health access is only needed for heart rate. On Android you can revoke camera access in Settings, then Apps, then ShakeFit, then Permissions; there is no health permission to revoke because the app never asks for one.
Ask us directly. Write to contact@shakefit.app to access, correct, delete, restrict or object to processing, to ask for a copy of what the server holds for your identifier, or to withdraw a consent. If you have never signed in, we hold no name and no email address, so we may need the identifier from your device to find your records, and we will explain how to read it. If you have signed in, we can look your account up by the email address the provider gave us, including a private relay address. If we cannot identify your records, we will say so rather than guess.
Depending on where you live you may also have the right to lodge a complaint with a supervisory authority: the Personal Information Protection Commission in the Republic of Korea, or your national data protection authority in the European Economic Area and the United Kingdom.
We do not offer a data export feature in the app.
11. Children
ShakeFit is not for children under 13. The app asks for a date of birth once, keeps only the age in years, and blocks the app permanently below the minimum age. Where the country you live in requires a higher age for using an online service without the consent of a parent or legal guardian, use the app only if you meet that age or have that consent.
We do not knowingly process data of a child below the minimum age. If you believe a child has used the app, write to contact@shakefit.app and we will delete what we hold.
12. Security
- The parts of the app that could leak the most, the camera frames and the pose coordinates, are protected by the absence of any code that stores or transmits them.
- Data on the device is held in the app's own storage, inside the app sandbox that iOS and Android enforce, and is subject to your device passcode and encryption settings.
- Server access is restricted per account by row level security, so one account cannot read another's rows, whether it is anonymous or signed in. The app carries only a public API key, never a service key.
- Where you sign in, the sign-in token from Apple or Google is exchanged for a session directly with our backend provider. We never receive or store a password, and there is no password to reset.
- The session token on your device is kept in the operating system keychain, not in ordinary app storage.
- Requests to the server use HTTPS.
- Access to production data is limited to the people who need it, and every processor is bound by a data processing agreement.
No system is perfect. If a breach affects you, we will notify you and the competent authority as the law requires.
13. Marketing
We do not send marketing messages. The app can show local reminders that you turn on yourself, and they are scheduled and shown entirely on your device. There are no push notifications, no server-sent messages, no newsletter and no advertising identifier. An email address held for a signed-in account is not used to contact you and is not added to any mailing list. If that changes, we will ask for your consent separately before sending anything, as the law requires.
14. This website
https://shakefit.app serves static files. The page loads no analytics script, no advertising script and no third-party embed, and it collects nothing. If email collection is ever switched on, this policy will be updated first to state exactly what is collected, why, how long it is kept and how to have it deleted.
15. Changes to this policy
We will publish a new version at https://shakefit.app/privacy with a new version number and date. For a change that affects how we use data you already gave us, we will give notice in the app at least 30 days before it takes effect. For other changes, at least 7 days.
Related documents
- Terms of Use:
terms-of-use.md, published at https://shakefit.app/terms - Health data notice:
health-data.md. It describes the Apple Health integration, which exists on iOS only - Korean version of this policy:
privacy-policy.ko.md
Change history
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-07-27 | First version. Data inventory verified field by field against the app source at commit 6a77bf9. Review record in review-notes.md |
| 1.5 | 2026-09-13 | The controller changed from Foo AI Corp. to WorkNPLAY Inc. The store seller and developer had already been transferred to WorkNPLAY; this policy was the only place still naming the old company as controller, so the statement is corrected. The business registration number and address changed with it. What we process, why, how long we keep it, who processes it on our behalf and where it is transferred did not change. The data sits in the same Seoul region as before. Section 8 is also corrected: version 1.4 said to "not enable a network connection for the app, or delete the app", but deleting the app does not erase the summaries and telemetry held on the server, so that sentence was not true. It now names the measure that actually erases them, Delete all records in the app's settings |
| 1.4 | 2026-08-17 | Version 1.1.0 of the app added features that change this inventory, and this entry records them. Local reminders: the app can now schedule reminders on your device, which you turn on yourself; section 13 was rewritten because version 1.3 stated the app had no notifications at all. Result cards: the app can draw a card from your own session numbers and hand it to the system share sheet; section 2 was corrected because it said no code writes a media file, and section 3 now lists the card. New records kept on the device: earned badges, the longest weekly streak, an opted-in monthly challenge, an active program, the daily track's frozen difficulty and whether reminders are on. The section 5 analytics table went from 10 names to 15. Eight were added (paywall_view, purchase_start, star_upgrade, reminder_optin, reminder_open, free_shelf_view, upsell_view, share_card) and three were removed (misjudgment_reported, onboarding_blocked_age, streak_extended). Nothing new leaves the device that did not leave it before: camera frames, pose coordinates and heart rate are still never uploaded, and the card is written only when you ask and only to the app's own cache |
| 1.3 | 2026-08-03 | Corrected what happens to your name. Version 1.2 listed the name among things not stored anywhere, while the very next section said the provider asks whether to share your name and email address. Both could not be true. On Android the sign-in token Google issues carries the name on your Google account, and the app sends that token to our backend provider, so the name reaches it. On iOS the name arrives in a separate field the app never reads, so it stays on your device. The app's own code reads neither. Nothing else about what is collected changed |
| 1.2 | 2026-08-03 | Optional sign-in added to the app, so the inventory now includes an email address. Version 1.1 stated there was no social login and that the app holds no email address at all. Both statements are now wrong for a user who signs in: Sign in with Apple on iOS and Google on Android pass an email address, which may be an Apple private relay address, to our backend provider, which stores it on the account record. The app's own code does not read it. Signing in stays optional and every feature still works without signing in. Section 10 was also corrected: deleting your records deletes the account record itself, which version 1.1 said could remain. Nothing about the camera, health data, on-device records or the uploaded summaries changed |
| 1.1 | 2026-08-02 | Rewritten to cover both platforms. Version 1.0 described the app as if iOS were the only platform: it named Apple as the only payment recipient, and stated the Apple Health heart rate integration without saying that Android has none. Health data and payment are now split into iOS and Android. The data inventory itself did not change, because the camera handling, the on-device records and the server sync are the same on both platforms |