Privacy
ShakeFit Privacy Policy
> Unpublished revision: the sections covering Health Connect, configured additional sign-in providers, progress backup and community describe the implementation under review. Their live configuration, store declarations and publication have not been completed by this change. The Cloudflare disclosure below takes effect on 25 October 2026; publishing the updated policy remains the release owner’s task.
Version 1.12 · Last updated 27 October 2026 · In effect from 27 October 2026 (2026-10-27)
Version 1.12 corrects this policy for new-track notifications, which app version 1.4.2 already lets you turn on. It states what turning them on sends and to whom. This correction takes effect on publication, 27 October 2026.
This policy describes what ShakeFit does with information, and what it does not do. Every item below was written against the app's source code, and the review record in review-notes.md names the file each statement came from.
ShakeFit runs on iOS and on Android, from the same codebase. The way the app handles your camera, your records and the optional server sync is identical on both. Three things are not identical, and each is marked iOS or Android wherever it appears: health data, handled by Apple Health on iOS and optional Health Connect on supported Android devices; payment, which is handled by Apple on iOS and by Google on Android; and the optional sign-in provider, which can offer Apple or Google according to the configured providers and platform.
Controller and contact
- Controller: WorkNPLAY Inc., 5F, 20, Daedeok-daero 241beon-gil, Seo-gu, Daejeon 35229, Republic of Korea
- Business registration number: 304-86-01720
- Privacy contact and person in charge of personal data protection: JEEHO SONG, contact@shakefit.app
1. The short version
- Workouts work without signing in. Optional community features require sign-in and separate enrollment; there is no app password or mandatory sign-up form. Where server sync is switched on, the app still creates an anonymous account for itself, described below.
- Signing in is optional, and supports other-device completion counts plus optional progress backup and explicit restore where enabled. The available Apple and Google buttons depend on the providers configured for that build and platform. If you sign in, your email address is held by our backend provider, and with Apple it may be a private relay address. If you never sign in, no email address for you exists in our systems.
- Camera frames are processed on your device and discarded. No video and no image is stored, and none is sent anywhere.
- Your profile, workout history and weight log stay on your device. Progress also stays local unless you sign in and the optional progress-backup feature described in section 5 is enabled.
- iOS: heart rate and active energy from Apple Health are used during and just after a session, and never uploaded or shared. Saving your sessions to Apple Health as workouts, and the Apple Watch app, happen only if you turn on Save to Apple Health. Android: optional Health Connect can save workouts and active energy and read heart rate for a completed session. This health information is never uploaded to our servers.
- When server sync is switched on in a build, the app creates an account identifier, anonymous unless you sign in, and uploads numeric session summaries and product analytics events. It uploads no pose data, no video, no age, no height, no weight, no body composition and no heart rate.
- There is no advertising and no third-party analytics SDK, and we do not track you across other apps or websites. Nothing is sold.
2. The camera and the pose model
To score a repetition, ShakeFit needs to see you move.
- Camera frames go from the camera to an on-device pose model (MediaPipe Pose Landmarker) inside the app. The model returns coordinates for 16 body joints.
- Face landmarks and fingertip landmarks are discarded inside the native module before anything leaves it. The app never uses facial data. The skeleton it draws from your joint coordinates has no face and no hands. The coaches who demonstrate the moves are illustrated characters made in advance and shipped inside the app, and they are not drawn from your camera image or your pose.
- Joint coordinates exist in memory for the length of the session, drive the score, and are then gone. They are not written to storage and not transmitted.
- The app contains no code that encodes video and no code that sends camera data over a network. That absence is the safeguard, not a setting you have to trust. The app writes exactly one image file, and only when you ask it to: a result card drawn from your own numbers, described in section 3.
- Camera access is requested by the operating system the first time a session starts, on both platforms. You can withdraw it at any time: on iOS in Settings, and on Android in Settings, then Apps, then ShakeFit, then Permissions. Without camera access, sessions cannot be scored.
Scored game sessions show a live camera preview so you can frame yourself. Follow-along learning lessons do not use the camera. The preview is drawn and discarded frame by frame like everything else.
3. What is stored on your device
All of the following stays on your device, in the app's own storage.
| What | Detail |
|---|---|
| Age | Your age in years only. You enter a date of birth once for the age check, and the date of birth itself is never stored |
| Body figures you choose to enter | Height, weight, sex, weekly session goal |
| Workout preference | The genre you choose for your first-week plan, stored locally |
| Safety notice acknowledgement | The timestamp when you confirmed the safety notices. Your answers to health questions are not stored, only that you confirmed |
| Session history | Up to 400 sessions: day, effective seconds, estimated calories, muscle points, whether the session counted, track id, total score, max combo, whether you finished, and per-move game grade counts when available |
| Weight log | Up to 400 entries: day and weight |
| Weight goal | Target loss, if you set one |
| Body measurement | Body fat percentage and skeletal muscle mass, if you enter them; latest values and dated entries for up to 400 days |
| Custom sessions | Up to 40 saved camera-free session definitions: movements, order, duration, tempo, style and teaching instructions |
| Observed subscription periods | Up to 12 product-id/purchase-date tokens for confirmed non-trial periods, to avoid duplicate analytics events; not payment details or a cash ledger |
| Progress | XP, levels, unlocks, streak, earned badges with the day you earned them, your longest weekly streak, an opt-in monthly challenge marker, an active theme program marker, and recent automatic Plus suggestion timestamps |
| Track records | Best score, stars, rank, badge, play count and last played day per track |
| Settings | Silent mode, screen enhancement, auto zoom at distance, reduced motion, low impact, volume, audio calibration offset, difficulty feedback you gave after sessions, the daily track's frozen difficulty for the day, whether reminders are turned on, whether the app has asked for Apple Health access, whether Save to Apple Health is on, and which policy update notices you have closed |
| Learning completion | Completed learning lesson IDs, completion times (the most recent 120 per lesson) and counts (maximum 999 per lesson), stored on this device separately from scored game history and used for the weekly goal, streak and weekly goal reminder; no movement form score |
| Movement challenge | Selected movement, enrollment day, per-day credited observed repetitions and local attempt IDs used to prevent duplicate credit. Kept on this device and removed with all records; no raw poses or health measurements |
| Started weekly plan | The week start, chosen session goal, and each selected track’s ID, difficulty and duration when the user starts a weekly-plan slot. At most two weeks are kept locally; removed with all records and not uploaded |
| Legacy family records | The safety lock left by an older version is read only to require guardian confirmation before opening the general app. Confirmation and removal of the lock must both succeed before the app opens. Analytics, backend, billing and health features do not start before confirmation. Family completion counts are no longer read or used. Deleting all app records removes any remaining family records |
| Review request history | First observed app-use time and native request-attempt timestamps, used for request spacing; no rating, review text or claim of actual prompt display |
| Language | Your language choice, if you set one |
| Installation identifier | A random UUID generated on the device, described in section 5 |
| Pending analytics | Analytics events waiting to be sent, described in section 5 |
| Session token | Where server sync is on, the token for your server session, anonymous or signed in, kept in the operating system keychain. It is issued by our backend provider, and for a signed-in session the token itself carries the email address that provider holds. The app does not read that address and keeps no separate copy of it. After you sign in, the token of the anonymous session it replaced is also kept there until our server confirms that the anonymous account is deleted. If that has not happened within 90 days, the app discards it the next time it opens |
| Age block flag | If the age check blocked the app, that fact is kept so the check cannot be bypassed |
| Pending session summaries | Where server sync is on, session summaries waiting to be uploaded. Each is uploaded only to the account that was in use when the session finished, and kept until then. If that account is replaced first, by signing in, signing out or deleting your records, it is deleted without being uploaded. The queue holds at most 200 summaries, and the oldest are dropped beyond that |
| Records from your other devices | Where you are signed in, a cached count of the tracks finished on your other devices while signed in, and the date of the most recent one, so the app can show them without asking the server again |
| Access grant | If a code unlocked the paid tracks on this device, that fact and the day it was granted |
| Result card image | A PNG the app draws from your own numbers when you ask to share, written to the app's own cache directory. It holds no camera image. The app hands it to the system share sheet and where it goes next is your choice. The cache is cleared by the operating system, and by the app's own delete action |
Not stored anywhere, on the device or elsewhere: date of birth, answers to the health self-check, camera frames, pose coordinates, heart rate samples, and your phone number, which the app never asks for. The app never asks for your real name; community uses a nickname you choose. The sign-in token Google issues can carry the name on your Google account, and that token goes to our backend provider, so the name reaches it as part of signing in. Section 5 explains what happens to it. The app never asks for an email address either. An email address exists only if you choose to sign in, in which case it comes from Apple or Google and is held by our backend provider, as section 5 describes.
Your device backup may include this app's local data, depending on your own backup settings. On iOS that backup is between you and Apple. On Android the app allows backup, so it is between you and Google, or whoever runs the backup service on your device. Either way we have no access to it.
4. Optional health connections
Android: Health Connect. On Android 9 or later, where Health Connect is available, the app offers an optional connection in settings. With your permission it saves an exercise session and active calories for the observed activity intervals, excluding pauses and unobserved time. It checks existing records to avoid duplicates. With separate heart-rate read permission it reads samples within the completed session and shows the average and maximum in results; no real-time heart-rate chip is shown. Missing samples leave these rows hidden. Android 8 devices can use the app without this connection. Records saved to Health Connect remain under your control there after deleting app data. A device-only recovery journal contains client record identifiers for incomplete writes; identifiers may include the track and session start time, but no raw health measurements. This journal is excluded from backup and device transfer and is removed when its transaction is resolved. Health records and heart-rate samples are not sent to our servers, used for advertising or used in scoring. You can revoke permissions in Health Connect; workouts in the app remain available.
iOS: what ShakeFit reads. If you allow it, ShakeFit reads from Apple Health:
- Heart rate, to show live beats per minute during a session and an average, minimum and maximum in your results.
- Active energy burned, to show what Apple Health recorded for the session period, alongside the app's own estimate.
- Workouts, only to check whether another app or your Apple Watch already recorded a workout at the same time, so that ShakeFit does not save a second one.
- Your heart rate zones, on iOS 27 or later, as set in the Health settings, to color the zones in your results instead of estimating them from your age.
iOS: what ShakeFit saves to Apple Health, only if you turn it on. Nothing is saved until you turn on Save to Apple Health in the app's settings and allow it in the iOS permission sheet. When it is on, ShakeFit saves each finished session to Apple Health as a workout:
- The workout type, chosen from the track (for example Cardio Dance, Boxing or Mind and Body), the start and end time, and that it was indoors.
- Active energy for the session. When the workout is recorded live, on your Apple Watch or on an iPhone with iOS 26 or later, this is what your devices measured. When no device measured any, it is ShakeFit's own estimate of the energy you burned above resting, worked out the same way as the estimate on your results screen. When another device already recorded active energy for that time, ShakeFit adds none, so the same minutes are not counted twice.
- When the workout is recorded live, the heart rate your Apple Watch or a paired heart rate sensor measured during the session, which Apple Health keeps with the workout.
- An identifier that stops the same session from being saved twice.
Scores, grades, repetitions and anything from the camera are never saved to Apple Health. If another app or your Apple Watch already recorded a workout at the same time, ShakeFit does not save a second one. Workouts saved to Apple Health stay there, under your control in the Health app, if you turn the option off or delete ShakeFit's records; turning it off stops new saves.
iOS: the Apple Watch app. ShakeFit includes an Apple Watch app. When Save to Apple Health is on and ShakeFit is installed on your watch, starting a session also starts a workout on the watch. The watch measures your heart rate and active energy, shows them on your wrist, and sends them to ShakeFit on your iPhone during the session over Apple's direct connection between your devices, not through our servers. At the end, the watch saves the workout to Apple Health. The watch app keeps nothing after the session.
iOS: how health data is handled.
- Health data read by the app is used in memory for the session and the results screen. It is not saved to the app's storage, not uploaded, and not shared with anyone. What the app saves goes into Apple Health on your device, and nowhere else.
- Health data is never used for advertising, marketing or any similar purpose, and is not used to build a profile of you.
- iPhone has no heart rate sensor. Live values only arrive while an Apple Watch or a paired heart rate sensor, such as a chest strap or, on iOS 26 or later, compatible headphones, measures your heart rate. When no samples arrive, the app shows nothing rather than showing zero.
- Heart rate and zones are display only. They never enter scoring, grades, stars or XP.
- Everything else in the app works without Health access. You can grant or revoke reading and saving at any time in iOS Settings, under Privacy and Security, then Health, then ShakeFit.
The separate notice in health-data.md covers this in the form Apple asks for during review. That notice describes the iOS integration only, for the same reason: there is none on Android.
5. What leaves the device
ShakeFit has an optional server backend. It is switched on by build configuration, and when it is off the app has nowhere to send anything and stays entirely local. When it is on, exactly the following leaves your device.
An anonymous account. By default the app signs in anonymously to our backend. No email, no password, no name. The result is a random account identifier held by our processor and a random installation identifier held on your device. Neither is linked to your identity by us. Under some privacy laws, including the GDPR, such an identifier is still personal data, which is why it is described here.
Your email address, only if you sign in. Workouts remain available without signing in. Optional progress backup and explicit restore require sign-in when enabled; community requires sign-in and separate enrollment. Apple and Google provider availability depends on platform and release configuration.
When you sign in, the provider asks whether to share your name and email address with ShakeFit. What it sends goes to our backend provider, Supabase, which stores the email address on your account record. Google authentication can also provide the name on your Google account, which Supabase holds with the account. Native Apple sign-in returns a separate name field that ShakeFit does not read or send. Where a browser-based provider is enabled, the provider communicates directly with Supabase and may include profile fields such as a name in its account metadata; these provider names are not used as community nicknames. With Sign in with Apple you may choose Hide My Email, and then the address stored is the private relay address Apple generates rather than your personal one. Either way it is an email address, so it is listed here as data we collect.
ShakeFit's own code never reads that address, and never reads the name either. Neither is shown in the app, used to contact you, used for marketing, or matched against any other service. It exists because our backend provider holds it as part of the account. Deleting your records deletes the account and that address with it, as section 10 describes. If you never sign in, no email address for you exists in our systems at all.
Session summaries. When you finish a session, these fields are sent: track id, number of exercises, valid repetitions, invalid repetitions, max combo, effective seconds, tracking loss count, whether the session counted, whether the source was the camera or a replay, and the client timestamp.
Product analytics events. Our own event schema, with primitive values only. Event call sites send fixed identifiers, categories and aggregate numbers, not user-entered free text. Nested objects, arrays and non-finite numbers are rejected; null explicitly marks an unavailable measurement. The events the current build sends are:
| Event | Fields |
|---|---|
onboarding_step | step name, phase (view, complete, skip, camera intent, deferred profile offered/saved/skipped), camera intent flag |
onboarding_complete | weekly goal |
app_error | Message hash, screen identifier and app version; no raw message, stack or personal information |
session_start | track id, silent mode flag, restart flag, demo replay marker, coach id |
session_complete | the session summary fields above; bridge skips; judged repetitions, actual block index, stage and movement id, pause-excluded elapsed time and time in the block, observed-to-expected repetition ratio within visited recovery windows, selected session length, low-impact substitution and Easy flags, camera/follow-along player. Missing measurements are null; follow-along has zero judged repetitions |
star_upgrade | track id, previous and new star count |
reminder_optin | granted or not |
journey_action | reminder/widget origin, destination, observed open/reach/workout-start/completion action and elapsed time since entry. A tap is not a completion |
reminder_preference | reminder control changed after saving: setting category and enabled state. OS permission denial is separate |
reminder_open | reminder kind |
free_shelf_view | none |
upsell_view | none |
share_card | card variant |
session_abandon | the same playback and summary fields as session_complete, or only track id and stage when leaving preparation |
session_pause | track id, actual block/stage/movement, pause-excluded elapsed and block time, recovery ratio or null, selected length, substitution/Easy flags and player, when a real pause occurs |
session_retry | track id and player when the result screen starts the same track again |
review_request_attempt | native review API invocation; not proof of display or completion |
review_request_result | native capability, persistence or API result; display and rating are not observed |
review_link_result | manual store link handoff or failure |
paywall_plan_selected | entry context, selected store product id, store offer option id and whether the selection was the default or a user tap |
paywall_exit | entry context and exit reason |
purchase_result | entry context, product id, purchase result and verified entitlement flag optional delayed-attribution method (sdk_pending_correlation) |
restore_result | entry context and restore result |
paywall_dismiss | entry context and dismissal reason |
purchase_complete | entry context, product id and verified entitlement flag; a completed purchase may include a store trial and does not establish revenue optional delayed-attribution method (sdk_pending_correlation) |
app_active | no properties; foreground adult main-screen activity for retention measurement |
paid_subscription_active | product id for a confirmed non-trial subscription period, observed when the app is used; not revenue |
preview_wall_view | track id and camera/guided mode at the announced first-block preview boundary |
paywall_view | entry context: weekly plan, growth report, session builder, track preview, results or onboarding |
purchase_start | paywall entry source, product id, store offer option id and whether a free trial is confirmed |
trial_start | product id, entry context and whether the purchase completed optional delayed-attribution method (sdk_pending_correlation) |
dashboard_view | none |
New-track notification registration, only if you turn it on. If you turn on new-track notifications in notification settings, the app asks your device's notification service for a device token (Apple Push Notification service on iOS, Firebase Cloud Messaging on Android) and sends that token, the platform, language, time zone, your notification choices and reserved notification times to Supabase. Until you turn the type on, the app's own code requests no device token and sends no registration to Supabase. On Android, app version 1.4.2 also lets the Firebase Cloud Messaging library obtain a device token from Google when the app starts, before you turn the type on. That token is held by Google for message delivery and is not sent to us. From the next Android version, no token is obtained until you turn the type on. Section 13 describes the use, and turning the type off removes the registration.
Network metadata. Like any network request, the request carries your IP address and a timestamp, which our hosting processor logs.
Optional progress backup (next-release feature, only when enabled). If you choose to sign in, we store a private account snapshot of exercise XP, completed valid-session count, streak values with their last active date, unlocked-track markers, earned badges with award dates, achieved-week markers, and best scores/stars/ranks per choreography version and execution fingerprint. Levels are calculated from XP. This backup is used for app functionality, not advertising or public rankings. It does not include workout-by-workout history, body measurements, calorie estimates, health data or raw pose coordinates. You explicitly choose Restore progress before remote progress is applied to a device; local workout history is not fabricated. The first syncing account owns the device's progress link. Signing in to a different account blocks both upload and restore until you return to the original account or explicitly clear device records. A device-only clear preserves the remote backup. Account deletion removes it. The snapshot is retained until account deletion; failed uploads keep one owner-tagged snapshot locally for retry.
Nothing outside these described summaries, events, optional progress fields and optional new-track notification registration is uploaded. Specifically not uploaded: your age, height, weight, sex, body fat, skeletal muscle mass, weight log, weight goal, calorie estimate, muscle volume, language, settings, camera frames, pose coordinates and heart rate.
Review eligibility is managed locally using the first eligible app-use time and native request attempt timestamps. An API call does not reveal whether a review prompt appeared or whether a review was submitted.
Analytics events are buffered on the device when there is no network, capped at 500 events, oldest dropped first, and are sent on the next app start or session end.
This section is about what the app sends. Your device backup is a separate path, run by the operating system rather than by the app, and section 3 describes it.
Optional community (next release; disabled until rollout checks pass)
If you enroll with a nickname, new eligible camera workouts may send an attempt identifier, workout kind (catalog/Daily/custom), UTC activity date, planned and observed movement seconds, observed repetition count and app version. An account-bound opt-in nonce authorizes the request. No movement manifest, pose, raw score, body measurements, calories or health records are sent through this feature; historical workout rows are not backfilled. These observations support shared active minutes and active days, not a claim of hardware-verified performance.
Friend-circle members see your chosen nickname, whole active minutes and active days. A separately enabled weekly league shows those same fields only when at least five real eligible participants are available. Internal opaque member IDs support report and block actions. We never use a sign-in provider's real name or email as your community display name. Weeks and activity dates use UTC. The server caps counted effort at three hours per UTC day.
We process circle membership, random invite codes, opt-in preferences, blocks and reports to operate this optional feature. A report contains the reported member, a fixed reason, the nickname as reported and its status; moderators can restrict an account and retain a corresponding audit entry. No public chat, image upload or free-text report is provided. Contact contact@shakefit.app; our existing support aim is a response within three business days.
Community profile, memberships, blocks and effort remain until community withdrawal or account deletion. Reports and their audit entries are removed when an involved community profile/account is removed. A moderation restriction remains until account deletion so that withdrawing and rejoining cannot bypass it. Device-only deletion leaves server community membership in place; sign in and choose Leave community, delete the account, or contact support for server removal. Pending offline changes are labeled pending and do not claim server removal. Owner-tagged retry rows and unsent nickname/invite drafts are kept on the device and removed with device records. This data is used for community functionality, not advertising or tracking.
6. Why we process this
| Purpose | What it uses | Legal basis under the GDPR |
|---|---|---|
| Running the app: scoring, records, progress, settings | Everything in section 3, on your device | Performance of the contract with you |
| Showing heart rate during and after a session, iOS only | Apple Health data, in memory | Your consent, given through the iOS Health permission |
| Scoring your movement | Camera frames, on the device | Your consent, given through the camera permission on your device, and performance of the contract |
| Understanding where people get stuck and whether sessions complete, so the app can be fixed | The account identifier, session summaries, analytics events | Our legitimate interest in improving the app, balanced by sending summaries only, with no personal detail and no third-party analytics |
| Showing on your other devices how many tracks you finished while signed in, if you choose to sign in | Your account identifier, the email address the sign-in provider gives us, session summaries | Performance of the contract, at your request. You start this only by signing in, and you end it by deleting your records |
| Sending one new-track notification per release, if you turn it on | Device token, platform, language, time zone, notification choices and reserved notification times | Your consent, given by turning the notification type on. Turning it off withdraws it |
| Selling and restoring a subscription | Purchase state from the store you bought from, Apple on iOS or Google on Android, and from RevenueCat | Performance of the contract |
| Meeting legal obligations and defending claims | Records we are required to keep | Legal obligation, and legitimate interest |
We do not make automated decisions that have a legal effect on you or similarly significantly affect you. A grade is a game score.
7. Who receives data
We do not sell personal data, and we do not share it for advertising.
| Recipient | What they get | Role and place |
|---|---|---|
| Supabase, our backend provider | The account, session summaries, analytics events, request metadata including IP address, when server sync is on. If you sign in, also the email address the sign-in provider gives us, which Supabase stores on the account record | Processor. Hosting region: Seoul, Republic of Korea (ap-northeast-2) |
| RevenueCat | Subscription and purchase state, with an identifier RevenueCat generates itself. We pass no identifier of ours to it | Processor for subscription state. United States |
| Apple, iOS only | Your purchase, billing, refunds and subscription management on the App Store. If you choose Sign in with Apple, Apple runs that sign-in and therefore knows you signed in to ShakeFit, and Apple gives us your email address or the private relay address you chose instead. If you turn on new-track notifications, our server sends Apple Push Notification service your device token, the notification text and the catalog track id so that Apple can deliver it. Apart from that, we send Apple nothing about how you use the app. Apple's own privacy policy applies to those relationships | Independent controller for the App Store and for Sign in with Apple. Delivers new-track notifications through Apple Push Notification service if you turn them on; United States and other countries where Apple operates. Apple Health data stays on your device and is not sent to Apple by us |
| Google, Android only | Your purchase, billing, refunds and subscription management on Google Play. If you choose to sign in with Google, Google runs that sign-in and therefore knows you signed in to ShakeFit, and Google gives us your email address. If you turn on new-track notifications, the app registers with Firebase Cloud Messaging on your device to obtain a device token (in app version 1.4.2 this registration also happens when the app starts, as section 5 describes), and our server sends Firebase Cloud Messaging that token, the notification text and the catalog track id so that Google can deliver it. Apart from that, we send Google nothing about how you use the app. Google's own privacy policy applies to those relationships | Independent controller for Google Play and for Google sign-in. Delivers new-track notifications through Firebase Cloud Messaging if you turn them on; United States and other countries where Google operates |
Cloudflare (assets.shakefit.app, R2 static-file hosting) | IP address, User-Agent and request time when downloading coach picture packs. We do not send account or workout data with these requests | Processor for asset delivery. United States |
| Authorities | Only what the law requires, and only after checking that the request is lawful | As required |
The table above is the complete list of recipients the app sends anything to. In particular there is no advertising network, no attribution provider, and no third-party analytics SDK in the app. Your device backup is not something the app sends; it is run by the operating system and described in section 3. Music and the bundled coach voices and guide motions play locally. Additional coach picture packs are downloaded from https://assets.shakefit.app automatically on Wi-Fi, or when you explicitly request a download. Downloaded packs are verified and stored on your device for local playback. Optional downloadable coach voice packs use the same host when available and explicitly requested; these asset requests do not include account or workout data. The coach voice falls back to your device's built-in speech synthesis for lines with no pre-generated clip, which happens on the device.
8. International transfers
Where server sync is on, the account record, including the email address on a signed-in account, together with session summaries and analytics events, is stored in Seoul, Republic of Korea (ap-northeast-2). RevenueCat, and the store you bought from, Apple or Google, process data in the United States and other countries where they operate. Coach asset download requests also transfer the IP address, User-Agent and request time to Cloudflare in the United States for file delivery; no account or workout data is included. If you turn on new-track notifications, the device token, the notification text and the catalog track id are transferred to Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android) in the United States and other countries where they operate, for delivery only.
If you are in the European Economic Area, the United Kingdom or Switzerland, transfers outside your region rely on the European Commission's standard contractual clauses or another lawful transfer mechanism in the relevant provider's data processing terms.
If you are in the Republic of Korea, the recipients, the items transferred, the purposes, the retention periods and the countries are the ones listed in sections 5, 7 and 9. You may refuse the transfer. Running Delete all records in the app's settings erases the summaries and telemetry held on the server together with the account itself; after that, not enabling a network connection for the app stops any further transfer. Refusing does not stop the app working locally.
9. How long we keep it
| Where | How long |
|---|---|
| On your device | Until you delete records in the app, or delete the app. Session history and the weight log keep the most recent 400 entries, and older entries are dropped automatically |
| Session summaries and analytics events on the server | Until you delete them from the app, and in any case no longer than 24 months from the day they were received |
| Optional signed-in progress backup | Until you delete the account; device-only clearing does not remove the backup |
| The account record itself, anonymous or signed in, including the email address on a signed-in account | Until you delete your records in the app, which deletes the account, see section 10 |
| Asset request metadata processed by Cloudflare | Retained under Cloudflare’s applicable service and data-processing terms; we do not attach account or workout records |
| New-track notification registration on the server | Until you turn the notification type off, until 90 days pass without the app refreshing it, or until you delete the account, whichever comes first |
| Purchase records held by Apple on iOS, or Google on Android, and by RevenueCat | For the period those companies state in their own policies, and for as long as we need them for tax and accounting obligations |
10. Your choices and your rights
Switching the progress account. The progress card offers a separate device-only clear with confirmation. This removes local records and the progress-account link, signs out locally, and preserves the server backup for later explicit restore.
Delete everything on the device. Open Profile, then Data. The screen shows how many records exist. Confirm, then hold the delete button. This removes your profile, session history, weight log, weight goal, body measurement, settings, progress and track records. The age block flag is deliberately kept so the age check cannot be bypassed by deleting data. Deletion cannot be undone.
Delete what is on the server, and the account with it. The same delete action asks our server to delete your session summaries, your analytics events, optional progress backup, your profile row and the account record itself, and then discards the session token on the device. This is one operation on the server: if any part of it fails, none of it is applied, the app tells you it failed, and it does not delete your device records either.
This is the same whether the account is anonymous or created by signing in. Deleting a signed-in account removes the email address held for it, and nothing is kept to recognise you if you sign in again later. Deleting the account does not cancel a subscription, because the store you bought from holds that; cancel it there, as the support page explains.
If the server part cannot complete, for example because you are offline, the app offers to delete on the device only and says so plainly. In that case write to contact@shakefit.app and we will remove the server copy within 30 days of confirming the request.
Turn off the parts you do not want. Camera access is only needed to score a session. On iOS you can revoke camera access, and Health access, in Settings at any time; Health access is only needed for heart rate, the Apple Health energy figure and saving workouts. On Android you can revoke camera access in Settings, then Apps, then ShakeFit, then Permissions; there is no health permission to revoke because the app never asks for one.
Ask us directly. Write to contact@shakefit.app to access, correct, delete, restrict or object to processing, to ask for a copy of what the server holds for your identifier, or to withdraw a consent. If you have never signed in, we hold no name and no email address, so we may need the identifier from your device to find your records, and we will explain how to read it. If you have signed in, we can look your account up by the email address the provider gave us, including a private relay address. If we cannot identify your records, we will say so rather than guess.
Depending on where you live you may also have the right to lodge a complaint with a supervisory authority: the Personal Information Protection Commission in the Republic of Korea, or your national data protection authority in the European Economic Area and the United Kingdom.
We do not offer a data export feature in the app.
11. Children
Independent use of the general app requires age 13 or older, or age 16 in the app's EU region setting. The existing age check remains in place; a child must not enter an adult age or use an adult profile as their own account. Where applicable law requires parental consent at a higher age, that requirement still applies.
The Family play area has been removed. If an older version left a safety lock, or the lock state cannot be read, the general app stays closed. Guardian confirmation on the device and successful removal of the lock are required before the general app and its analytics, backend, billing and health features can start. This confirmation is not identity verification. Family completion counts are no longer read or used; deleting all app records removes them.
12. Security
- The parts of the app that could leak the most, the camera frames and the pose coordinates, are protected by the absence of any code that stores or transmits them.
- Data on the device is held in the app's own storage, inside the app sandbox that iOS and Android enforce, and is subject to your device passcode and encryption settings.
- Server access is restricted per account by row level security, so one account cannot read another's rows, whether it is anonymous or signed in. The app carries only a public API key, never a service key.
- Where you sign in, the sign-in token from Apple or Google is exchanged for a session directly with our backend provider. We never receive or store a password, and there is no password to reset.
- The session token on your device is kept in the operating system keychain, not in ordinary app storage.
- Requests to the server use HTTPS.
- Access to production data is limited to the people who need it, and every processor is bound by a data processing agreement.
No system is perfect. If a breach affects you, we will notify you and the competent authority as the law requires.
13. Marketing
Local reminders are optional. You may separately turn on new-track notifications in notification settings. If you do, we store the APNs or FCM device token, platform, language, time zone, notification choices and reserved notification times in Supabase to send one invitation per release, respecting quiet hours, pauses and the shared weekly and daily limits. These records contain no pose, health measurements or billing state and are not used for advertising or cross-app tracking. Registration expires after 90 days without refresh; account deletion removes it. You can turn this notification type off or turn off all reminders. Changes made offline reach the server when the app reconnects, so an already accepted notification may still arrive. An email address held for a signed-in account is not added to any mailing list. Home widgets may show your weekly progress, streak, a catalog track title and a coach illustration; you can hide progress in settings. Lock screen widget progress uses the system privacy-sensitive presentation.
On supported devices, widgets and opt-in Live Activities show generic workout status and an action to return to the app. The app and its extensions share display state and update/expiry times on the same device; no push token is requested. Weight, calories, heart rate, track names and progress counts are excluded from the Lock Screen payload. A backgrounded workout is not shown as continuing. App settings control reminder types, quiet hours, pauses and frequency limits. First-week presentation history, unresolved purchase context and reminder/widget action attribution are stored locally and removed with all app records. Delayed purchase attribution labelled sdk_pending_correlation is a product/date correlation, not proof of a particular transaction or revenue.
14. This website
https://shakefit.app serves static files. The page loads no analytics script, no advertising script and no third-party embed, and it collects nothing. If email collection is ever switched on, this policy will be updated first to state exactly what is collected, why, how long it is kept and how to have it deleted.
15. Changes to this policy
We will publish a new version at https://shakefit.app/privacy with a new version number and date. For a change that affects how we use data you already gave us, we will give notice in the app at least 30 days before it takes effect. Other changes, such as corrections and descriptions of new features that do not change what we collect or how we use it, take effect when they are published, and each one is recorded in the change history below.
Related documents
- Terms of Use:
terms-of-use.md, published at https://shakefit.app/terms - Health data notice:
health-data.md. It describes the Apple Health integration, which exists on iOS only - Korean version of this policy:
privacy-policy.ko.md
Change history
| Version | Date | Change |
|---|---|---|
| 1.12 | 2026-10-27 | In effect on publication, 2026-10-27. Correction. App version 1.4.2 already lets you turn on new-track notifications (section 13), and version 1.11 did not say what that sends. Sections 5, 6, 7, 8 and 9 now state it: the device token request to Apple Push Notification service or Firebase Cloud Messaging, the registration stored in Supabase, the notification text and catalog track id passed to Apple or Google for delivery, the legal basis and how long the registration is kept. Section 5 also states that on Android, app version 1.4.2 lets the Firebase library obtain a device token from Google when the app starts, which is not sent to us, and that the next Android version stops this. Apart from that Android token, nothing changes for people who leave this notification type off, and previously provided data is not used for a new purpose |
| 1.11 | 2026-10-25 | In effect on publication, 2026-10-25. Adds Cloudflare asset delivery to recipients and international transfers; corrects the claim that playback assets never require external downloads. Automatic Wi-Fi coach picture-pack downloads remain enabled |
| 1.10 | 2026-10-23 | In effect from 2026-10-23. Describes paywall_dismiss, purchase_complete, app_active, paid_subscription_active and preview_wall_view, and local subscription-period tokens used to prevent duplicate analytics. Reflects removal of Family play and the guardian-confirmed transition for an existing safety lock. No new use of previously provided data |
| 1.9 | 2026-10-16 | In effect from 2026-10-16. Adds camera-free learning completion, store review attempt history and the separate guardian-operated Family play area for accompanied ages 6-12. No new use of previously provided data |
| 1.0 | 2026-07-27 | First version. Data inventory verified field by field against the app source at commit 6a77bf9. Review record in review-notes.md |
| 1.8 | 2026-10-09 | In effect from 2026-10-09. Correction. Sections 1, 5 and 6 said signing in lets another device pick up where the first left off, or continue from your existing records. What it does is let your other devices show how many tracks you finished while signed in, and the date of the latest one. Level, streaks and badges stay on the device where you earned them, and tracks finished while not signed in are not included. Section 3 now says the cached count also holds that date, and that after you sign in the token of the replaced anonymous session is kept in the keychain until our server confirms that account is deleted, and discarded the first time the app opens after 90 days if that has not happened, and that a session summary waiting to be uploaded is sent only to the account that was in use when the session finished, and deleted without upload if that account is replaced first. What we collect and how we use it did not change |
| 1.7 | 2026-10-09 | In effect from 2026-10-09. The guide that demonstrates each move changed from an abstract figure to two illustrated coaches. Version 1.6 described a single drawn figure with no face and no hands in section 2, and that stops being true once the coaches, who have faces and hands, are on screen. Section 2 now describes the two separately: the skeleton drawn from your joint coordinates still has no face and no hands, and the coaches are illustrations made in advance and shipped inside the app, not drawn from your camera image or your pose. What the app does with camera data did not change: face and fingertip landmarks are still discarded in the native module, and no camera video, camera image or pose data is stored or sent. Section 15 also changed. It promised notice in the app at least 7 days before any change took effect. A change like this one, which corrects a description and does not change what we collect or how we use it, now takes effect when it is published. A change to how we use data you already gave us still gets notice in the app at least 30 days before it takes effect |
| 1.6 | 2026-09-23 | In effect from 2026-09-25. Published on 2026-09-23 to take effect on 2026-10-05, and brought forward to 2026-09-25. On iOS only, and only if you turn on Save to Apple Health: finished sessions can be saved to Apple Health as workouts, with the workout type, the times, active energy and the heart rate your devices measured, and a new Apple Watch app records the workout on your watch and sends live heart rate and energy to the iPhone over Apple's direct device connection. The app also reads workouts, only to avoid saving a duplicate, and on iOS 27 or later your heart rate zones from the Health settings. Version 1.5 said the Apple Health access was read only; that stays true until you turn saving on. Section 3 now also lists three settings kept on the device: whether the app has asked for Apple Health access, which was kept before this version but missing from the list, whether saving is on, and which update notices you have closed. What leaves the device did not change: heart rate and energy are still never uploaded to us. The app shows this change on its home screen from version 1.1.3. Corrected on 2026-09-24: the estimate saved as active energy is the energy burned above resting, because Apple Health's active energy excludes resting energy. The results screen keeps showing the total estimate. Also corrected on 2026-09-24: measured heart rate and energy are kept with the workout only when the workout is recorded live, by the Apple Watch app or on an iPhone with iOS 26 or later |
| 1.5 | 2026-09-13 | The controller changed from Foo AI Corp. to WorkNPLAY Inc. The store seller and developer had already been transferred to WorkNPLAY; this policy was the only place still naming the old company as controller, so the statement is corrected. The business registration number and address changed with it. What we process, why, how long we keep it, who processes it on our behalf and where it is transferred did not change. The data sits in the same Seoul region as before. Section 8 is also corrected: version 1.4 said to "not enable a network connection for the app, or delete the app", but deleting the app does not erase the summaries and telemetry held on the server, so that sentence was not true. It now names the measure that actually erases them, Delete all records in the app's settings |
| 1.4 | 2026-08-17 | Version 1.1.0 of the app added features that change this inventory, and this entry records them. Local reminders: the app can now schedule reminders on your device, which you turn on yourself; section 13 was rewritten because version 1.3 stated the app had no notifications at all. Result cards: the app can draw a card from your own session numbers and hand it to the system share sheet; section 2 was corrected because it said no code writes a media file, and section 3 now lists the card. New records kept on the device: earned badges, the longest weekly streak, an opted-in monthly challenge, an active program, the daily track's frozen difficulty and whether reminders are on. The section 5 analytics table went from 10 names to 15. Eight were added (paywall_view, purchase_start, star_upgrade, reminder_optin, reminder_open, free_shelf_view, upsell_view, share_card) and three were removed (misjudgment_reported, onboarding_blocked_age, streak_extended). Nothing new leaves the device that did not leave it before: camera frames, pose coordinates and heart rate are still never uploaded, and the card is written only when you ask and only to the app's own cache |
| 1.3 | 2026-08-03 | Corrected what happens to your name. Version 1.2 listed the name among things not stored anywhere, while the very next section said the provider asks whether to share your name and email address. Both could not be true. On Android the sign-in token Google issues carries the name on your Google account, and the app sends that token to our backend provider, so the name reaches it. On iOS the name arrives in a separate field the app never reads, so it stays on your device. The app's own code reads neither. Nothing else about what is collected changed |
| 1.2 | 2026-08-03 | Optional sign-in added to the app, so the inventory now includes an email address. Version 1.1 stated there was no social login and that the app holds no email address at all. Both statements are now wrong for a user who signs in: Sign in with Apple on iOS and Google on Android pass an email address, which may be an Apple private relay address, to our backend provider, which stores it on the account record. The app's own code does not read it. Signing in stays optional and every feature still works without signing in. Section 10 was also corrected: deleting your records deletes the account record itself, which version 1.1 said could remain. Nothing about the camera, health data, on-device records or the uploaded summaries changed |
| 1.1 | 2026-08-02 | Rewritten to cover both platforms. Version 1.0 described the app as if iOS were the only platform: it named Apple as the only payment recipient, and stated the Apple Health heart rate integration without saying that Android has none. Health data and payment are now split into iOS and Android. The data inventory itself did not change, because the camera handling, the on-device records and the server sync are the same on both platforms |