Privacy
ShakeFit Privacy Policy
Version 1.0 · Last updated 27 July 2026 · Effective from the date this document is published at https://shakefit.app/privacy
This policy describes what ShakeFit does with information, and what it does not do. Every item below was written against the app's source code, and the review record in review-notes.md names the file each statement came from.
Controller and contact
- Controller: Foo AI Corp., 359, Gangnam-daero, Seocho-gu, Seoul 06621, Republic of Korea
- Business registration number: 284-81-02702
- Privacy contact and person in charge of personal data protection: JEEHO SONG, contact@shakefit.app
1. The short version
- ShakeFit works with no account and no sign-up. There is no email, no password, no social login.
- Camera frames are processed on your device and discarded. No video and no image is stored, and none is sent anywhere.
- Your profile, workout history, weight log and progress are stored on your device.
- Heart rate from Apple Health is read only, used during and just after a session, and never uploaded or shared.
- When server sync is switched on in a build, the app creates an anonymous identifier and uploads numeric session summaries and product analytics events. It uploads no pose data, no video, no age, no height, no weight, no body composition and no heart rate.
- There is no advertising and no third-party analytics SDK, and we do not track you across other apps or websites. Nothing is sold.
2. The camera and the pose model
To score a repetition, ShakeFit needs to see you move.
- Camera frames go from the camera to an on-device pose model (MediaPipe Pose Landmarker) inside the app. The model returns coordinates for 16 body joints.
- Face landmarks and fingertip landmarks are discarded inside the native module before anything leaves it. The app never uses facial data, and the figure it draws has no face and no hands.
- Joint coordinates exist in memory for the length of the session, drive the score, and are then gone. They are not written to storage and not transmitted.
- The app contains no code that encodes video, writes a media file, or sends camera data over a network. That absence is the safeguard, not a setting you have to trust.
- Camera access is requested by iOS the first time a session starts. You can withdraw it at any time in iOS Settings. Without camera access, sessions cannot be scored.
The screen shows a live camera preview during a session so you can frame yourself. The preview is drawn and discarded frame by frame like everything else.
3. What is stored on your device
All of the following stays on your device, in the app's own storage.
| What | Detail |
|---|---|
| Age | Your age in years only. You enter a date of birth once for the age check, and the date of birth itself is never stored |
| Body figures you choose to enter | Height, weight, sex, weekly session goal |
| Safety notice acknowledgement | The timestamp when you confirmed the safety notices. Your answers to health questions are not stored, only that you confirmed |
| Session history | Up to 400 sessions: day, effective seconds, estimated calories, muscle points, whether the session counted, track id, total score, max combo, whether you finished |
| Weight log | Up to 400 entries: day and weight |
| Weight goal | Target loss, if you set one |
| Body measurement | Body fat percentage and skeletal muscle mass, if you enter them |
| Progress | XP, levels, unlocks, streak |
| Track records | Best score, stars, rank, badge, play count and last played day per track |
| Settings | Silent mode, screen enhancement, reduced motion, low impact, volume, audio calibration offset |
| Language | Your language choice, if you set one |
| Installation identifier | A random UUID generated on the device, described in section 5 |
| Pending analytics | Analytics events waiting to be sent, described in section 5 |
| Age block flag | If the age check blocked the app, that fact is kept so the check cannot be bypassed |
Not stored anywhere, on the device or elsewhere: date of birth, answers to the health self-check, camera frames, pose coordinates, heart rate samples, and your name, email or phone number, which the app never asks for.
Your device backup may include this app's local data, depending on your iOS backup settings. That backup is between you and Apple, and we have no access to it.
4. Heart rate from Apple Health
If you allow it, ShakeFit reads two data types from Apple Health: heart rate and active energy burned.
- Access is read only. The app requests an empty write set, so it cannot write anything into Apple Health, and it does not.
- Heart rate is used to show live beats per minute during a session and an average, minimum and maximum in your results. Active energy is used to show what Apple Health recorded for the session period, alongside the app's own estimate.
- Health data is used in memory for the session and the results screen. It is not saved to the app's storage, not uploaded, and not shared with anyone.
- Health data is never used for advertising, marketing or any similar purpose, and is not used to build a profile of you.
- iPhone has no heart rate sensor. Live values only arrive while an Apple Watch is recording a workout, or while another device writes heart rate into Apple Health. When no samples arrive, the app shows nothing rather than showing zero.
- Everything else in the app works without Health access. You can grant or revoke it at any time in iOS Settings, under Privacy and Security, then Health.
The separate notice in health-data.md covers this in the form Apple asks for during review.
5. What leaves the device
ShakeFit has an optional server backend. It is switched on by build configuration, and when it is off the app has nowhere to send anything and stays entirely local. When it is on, exactly the following leaves your device.
An anonymous account. The app signs in anonymously to our backend. No email, no password, no name. The result is a random account identifier held by our processor and a random installation identifier held on your device. Neither is linked to your identity by us. Under some privacy laws, including the GDPR, such an identifier is still personal data, which is why it is described here.
Session summaries. When you finish a session, these fields are sent: track id, number of exercises, valid repetitions, invalid repetitions, max combo, effective seconds, tracking loss count, whether the session counted, whether the source was the camera or a replay, and the client timestamp.
Product analytics events. Our own event schema, with primitive values only. The app is built so that free text and nested objects are rejected before an event is stored, which keeps personal data out of it structurally. The events the current build sends are:
| Event | Fields |
|---|---|
onboarding_step | step name, phase (view, complete, skip, camera intent), camera intent flag |
onboarding_blocked_age | none |
onboarding_complete | weekly goal |
session_start | track id, silent mode flag |
session_complete | the session summary fields listed above |
session_abandon | the session summary fields, or track id and stage when you leave before the first repetition |
Network metadata. Like any network request, the request carries your IP address and a timestamp, which our hosting processor logs.
Nothing else is uploaded. Specifically not uploaded: your age, height, weight, sex, body fat, skeletal muscle mass, weight log, weight goal, calorie estimate, muscle volume, XP, levels, streak, track records, language, settings, camera frames, pose coordinates and heart rate.
Analytics events are buffered on the device when there is no network, capped at 500 events, oldest dropped first, and are sent on the next app start or session end.
6. Why we process this
| Purpose | What it uses | Legal basis under the GDPR |
|---|---|---|
| Running the app: scoring, records, progress, settings | Everything in section 3, on your device | Performance of the contract with you |
| Showing heart rate during and after a session | Apple Health data, in memory | Your consent, given through the iOS Health permission |
| Scoring your movement | Camera frames, on the device | Your consent, given through the iOS camera permission, and performance of the contract |
| Understanding where people get stuck and whether sessions complete, so the app can be fixed | The anonymous identifier, session summaries, analytics events | Our legitimate interest in improving the app, balanced by sending summaries only, with no personal detail and no third-party analytics |
| Selling and restoring a subscription | Purchase state from Apple and RevenueCat | Performance of the contract |
| Meeting legal obligations and defending claims | Records we are required to keep | Legal obligation, and legitimate interest |
We do not make automated decisions that have a legal effect on you or similarly significantly affect you. A grade is a game score.
7. Who receives data
We do not sell personal data, and we do not share it for advertising.
| Recipient | What they get | Role and place |
|---|---|---|
| Supabase, our backend provider | The anonymous account, session summaries, analytics events, request metadata including IP address, when server sync is on | Processor. Hosting region: Seoul, Republic of Korea (ap-northeast-2) |
| RevenueCat | Subscription and purchase state, with an identifier RevenueCat generates itself. We pass no identifier of ours to it | Processor for subscription state. United States |
| Apple | Your purchase, billing, refunds and subscription management. Apple's own privacy policy applies to that relationship | Independent controller for the App Store. Apple Health data stays on your device and is not sent to Apple by us |
| Authorities | Only what the law requires, and only after checking that the request is lawful | As required |
There are no other recipients. In particular there is no advertising network, no attribution provider, and no third-party analytics SDK in the app. The music, the coach voice and the guide motion were produced before release and are bundled with the app, so no service is contacted to play them. The coach voice falls back to your device's built-in speech synthesis for lines with no pre-generated clip, which happens on the device.
8. International transfers
Where server sync is on, the anonymous account, session summaries and analytics events are stored in Seoul, Republic of Korea (ap-northeast-2). RevenueCat and Apple process data in the United States and other countries where they operate.
If you are in the European Economic Area, the United Kingdom or Switzerland, transfers outside your region rely on the European Commission's standard contractual clauses or another lawful transfer mechanism in the relevant provider's data processing terms.
If you are in the Republic of Korea, the recipients, the items transferred, the purposes, the retention periods and the countries are the ones listed in sections 5, 7 and 9. You may refuse the transfer, in which case do not enable a network connection for the app, or delete the app. Refusing does not stop the app working locally.
9. How long we keep it
| Where | How long |
|---|---|
| On your device | Until you delete records in the app, or delete the app. Session history and the weight log keep the most recent 400 entries, and older entries are dropped automatically |
| Session summaries and analytics events on the server | Until you delete them from the app, and in any case no longer than 24 months from the day they were received |
| The anonymous account record itself | Until you ask us to remove it, see section 10 |
| Purchase records held by Apple and RevenueCat | For the period those companies state in their own policies, and for as long as we need them for tax and accounting obligations |
10. Your choices and your rights
Delete everything on the device. Open Profile, then Data. The screen shows how many records exist. Confirm, then hold the delete button. This removes your profile, session history, weight log, weight goal, body measurement, settings, progress and track records. The age block flag is deliberately kept so the age check cannot be bypassed by deleting data. Deletion cannot be undone.
Delete what is on the server. The same delete action also asks our server to delete your session summaries and analytics events, and discards the anonymous session on the device. The empty account record can remain after that, so if you want it removed as well, write to contact@shakefit.app. We will remove it within 30 days of confirming the request.
Turn off the parts you do not want. Revoke camera access or Health access in iOS Settings at any time. Camera access is only needed to score a session, and Health access is only needed for heart rate.
Ask us directly. Write to contact@shakefit.app to access, correct, delete, restrict or object to processing, to ask for a copy of what the server holds for your identifier, or to withdraw a consent. Because we hold no name or email, we may need the anonymous identifier from your device to find your records, and we will explain how to read it. If we cannot identify your records, we will say so rather than guess.
Depending on where you live you may also have the right to lodge a complaint with a supervisory authority: the Personal Information Protection Commission in the Republic of Korea, or your national data protection authority in the European Economic Area and the United Kingdom.
We do not offer a data export feature in the app.
11. Children
ShakeFit is not for children under 13. The app asks for a date of birth once, keeps only the age in years, and blocks the app permanently below the minimum age. Where the country you live in requires a higher age for using an online service without the consent of a parent or legal guardian, use the app only if you meet that age or have that consent.
We do not knowingly process data of a child below the minimum age. If you believe a child has used the app, write to contact@shakefit.app and we will delete what we hold.
12. Security
- The parts of the app that could leak the most, the camera frames and the pose coordinates, are protected by the absence of any code that stores or transmits them.
- Data on the device is held in the app's own storage, inside the app sandbox that iOS enforces, and is subject to your device passcode and encryption settings.
- Server access is restricted per identifier by row level security, so one anonymous identifier cannot read another's rows. The app carries only a public API key, never a service key.
- Requests to the server use HTTPS.
- Access to production data is limited to the people who need it, and every processor is bound by a data processing agreement.
No system is perfect. If a breach affects you, we will notify you and the competent authority as the law requires.
13. Marketing
We do not send marketing messages. The app has no push notifications, no newsletter and no advertising identifier. If that changes, we will ask for your consent separately before sending anything, as the law requires.
14. This website
https://shakefit.app serves static files. The page loads no analytics script, no advertising script and no third-party embed, and it collects nothing. If email collection is ever switched on, this policy will be updated first to state exactly what is collected, why, how long it is kept and how to have it deleted.
15. Changes to this policy
We will publish a new version at https://shakefit.app/privacy with a new version number and date. For a change that affects how we use data you already gave us, we will give notice in the app at least 30 days before it takes effect. For other changes, at least 7 days.
Related documents
- Terms of Use:
terms-of-use.md, published at https://shakefit.app/terms - Health data notice:
health-data.md - Korean version of this policy:
privacy-policy.ko.md
Change history
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-07-27 | First version. Data inventory verified field by field against the app source at commit 6a77bf9. Review record in review-notes.md |