Privacy Policy

This policy explains how we process personal data when you use the ShiftEgo app or visit shiftego.com, and what rights you have.

1. Controller

For any privacy question or request, write to apps@stackbytes.de.

2. Our website

When you visit our website, our hosting provider processes technical data that your browser sends automatically, such as your IP address, the time of access and the page requested. We need this to deliver the website securely. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in a secure and functioning website).

We don't use cookies, analytics or tracking on our website. Settings such as light or dark mode and your language are stored only in your browser.

3. Using the app

We process the following data to provide the app:

• Account data: your email address, your password (stored only in protected, hashed form) and the language, country and time zone of your device.
• Usage and progress data: the courses and exercises you choose, your ratings and your progress, so the app can suggest exercises and show your progress.
• Technical data: such as IP address, device type and app version, to connect the app securely and keep you signed in.

Legal basis: Art. 6 (1) (b) GDPR (providing the app under our Terms of Service). If we send you emails related to your account, for example to confirm your email address or reset your password, the same legal basis applies. We don't send marketing emails without your consent.

We also analyze how people use the app's onboarding, without advertising IDs, to improve it. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in improving the app).

Reminders and the home screen widget are handled locally on your device.

4. Subscriptions

Purchases are made through the Apple App Store or Google Play. Apple and Google process your payment details as independent controllers; we never receive them. To manage your subscription across devices, we and our subscription service provider process your account ID and purchase information. Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for statutory retention of purchase records.

5. Error reports

If the app crashes or an error occurs, a technical error report is sent to our error monitoring provider (for example device model, operating system, app version, IP address and the course of the error). We use it only to find and fix errors. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in a stable app).

6. Install attribution

To measure which advertising leads people to install the app and start a subscription, we use an attribution provider. It processes device identifiers, your IP address, information about the installation and the campaign, and a few events in the app (such as starting a free trial). We use this only to evaluate and improve our advertising, not to show you personalized ads in the app.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to find out which advertising works, so that we can spend our advertising budget sensibly and keep the app financially viable.

On iPhone, your advertising ID (IDFA) is only used if you allow tracking when the app asks. You can change this at any time under Settings → Privacy & Security → Tracking. On Android, you can delete or reset your advertising ID in your device settings.

Right to object: you can object to attribution at any time by writing to apps@stackbytes.de. We will then no longer use your data for this purpose.

7. Service providers

We use carefully selected service providers who process data on our behalf and under our instructions (Art. 28 GDPR):

• Website hosting and content delivery: Cloudflare
• Server and database hosting (servers in the EU): Railway, Neon
• Account emails: Resend
• Subscription management: RevenueCat
• Error monitoring: Sentry
• Install attribution: AppsFlyer

Some of these providers are based in the USA or Israel, or are part of US companies. Transfers to the USA are based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). Transfers to Israel are based on an adequacy decision of the European Commission.

8. How long we keep your data

We keep your account and progress data as long as you have an account. When you delete your account, we delete this data, except where we are required to keep it by law (for example purchase records under tax law). Technical data and error reports are kept only as long as needed for their purpose and are then deleted automatically. Usage data from the onboarding is kept only in anonymized form after you delete your account.

9. Deleting your account

You can delete your account at any time in the app under Settings → Delete account, or on our Delete Account page. Deleting your account does not cancel a subscription; cancel it in the subscription settings of the App Store or Google Play.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Arts. 15 to 18 and 20 GDPR). You can withdraw consent at any time with effect for the future. To exercise your rights, write to apps@stackbytes.de.

Right to object (Art. 21 GDPR): where we process your data based on our legitimate interests, you can object at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority in your country or the one responsible for us, the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

11. Age

ShiftEgo is not directed at children under 13, and we don't knowingly collect data from them. If you are not yet of legal age where you live, you may only use ShiftEgo with the consent of a parent or legal guardian. If you believe a child under 13 has created an account, please contact us and we will delete it.

12. Changes

We update this policy when our app or the law changes. The current version is always available at shiftego.com/privacy.