theSHFT ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our mobile application and web application (collectively, the "Application" or "App"). The web application provides equal functionality to the mobile application and adheres to the same privacy and data-collection standards described in this Policy. This Policy applies globally to all users regardless of location.

1. INFORMATION WE COLLECT

1.1 Information You Provide Directly

• Username: A unique identifier you choose during account creation. This is the only personally identifiable information we require.
• Recovery Phrase: A 12-word BIP39 mnemonic phrase used for account recovery. The phrase itself is generated locally on your device and is NEVER transmitted to or stored by our servers. A one-way SHA-256 hash of the phrase IS stored under your owner-only private subcollection so you can restore your account on a new device. The hash cannot be reversed to recover the phrase.
• PIN: Your access code for the Application. This is stored ONLY on your device using encrypted local storage and is NEVER transmitted to our servers.
• Contact List: Usernames of people you add as contacts within the Application.
• Community Posts: Messages you post in Community channels. Community messages are NOT end-to-end encrypted and are stored on our servers in a form accessible to us.
• Community Votes: Upvotes and downvotes you cast on Community posts are recorded and associated with your anonymous user ID.
• Stories: Photos or media you share as Stories. Stories are ephemeral and automatically deleted after twenty-four (24) hours. Story media is encrypted at rest using a random per-asset key stored alongside the Story record; this protects against leaked Storage URLs but is NOT end-to-end encryption, because the per-asset key is server-readable.
• Profile Pictures (Avatars): The image you set as your profile photo, stored as an encrypted blob with a random per-asset key on your user record. Same posture as Stories: encrypted at rest, not end-to-end encrypted.
• User Reports: Information you voluntarily provide when reporting abuse or contacting support.

1.2 Information Collected Automatically

• Device Identifier: An anonymous, non-personally identifiable device ID used to ensure account uniqueness and prevent fraud.
• Crash Reports (Sentry): We use Sentry (sentry.io) to receive crash reports: stack traces of unhandled errors that cause the App to fail. Sentry receives: the exception type and stack trace of unhandled errors; standard device and app context attached automatically to every event, being device model, operating system version, App version and build number, locale and time zone; session records, meaning when a session starts and ends and whether it ended in a crash; and app-hang and performance traces. Before any event is sent, a scrubber replaces long base64-style strings and uid, token and key patterns with [REDACTED] in error messages and exception values, replaces identifiers inside recorded URLs with placeholders such as /users/:id, and drops console logs entirely. Sentry never receives message content, call media, or your contact list. You can disable crash reporting at any time in the mobile App at Settings → Privacy → "Send crash reports". When disabled, no events are sent to Sentry.
• Push Notification Token: If you enable notifications, we receive a device token from Apple Push Notification Service (APNs) to deliver notifications.

We do NOT use product-analytics or advertising SDKs. We do not use Mixpanel, Amplitude, Segment, Firebase Analytics, Adjust, AppsFlyer, Branch, or any similar SDK, and we build no user profiles, funnels, cohorts, or engagement metrics. The one exception is the Sentry stability reporting described above, which records when a session starts and ends and whether it ended in a crash, and which captures app-hang and performance traces. We use these only to find and fix defects.

• Rate-Limit Buckets (Hashed Network Address): To slow down password guessing and account-recovery abuse, our servers keep a short-lived counter keyed by a one-way hash of the network address that made a login or account-restore attempt. The address itself is not stored, the counter is never linked to message content or contacts, and it expires automatically within two hours.
• Invite Records: When you create an invite link (for a contact or, as a group admin, for a group), we store the invite code, your account identifier and username, the optional group identifier and name, and, once used, the redeemer's identifier and username. Invites expire fourteen (14) days after creation.
• Moderation and Administration Logs: Actions taken on your account or content by community moderators or theSHFT administrators (for example a warning, a suspension, a removed post) are recorded with the actor, the target, the reason and the time, so that every such action can be reviewed and appealed.
• Device Restriction Records: If an account is deleted after a ban, a record tied to its anonymous device identifier prevents new sign-ups from that device for up to 365 days, after which it expires automatically.
• Call Preferences: If you turn on "Calls from contacts only", that preference is stored server-side so calls from strangers are never delivered to your device.
• Link Previews: When you send a link, your own device fetches the page title and description and sends them inside the encrypted message. The recipient's device never contacts the linked site, and we never see the preview. You can turn this off in Settings.
• Group Photos: A group's photo is stored as an encrypted file; the key is held on the group's conversation record, readable only by its members.

1.3 Information We Do NOT Collect

Due to our privacy-focused design and end-to-end encryption, we explicitly DO NOT collect:

• Direct message and group chat content (these are end-to-end encrypted; we cannot read them). Community posts and Stories use per-asset encryption with server-side keys so they can be served to other community members and viewers. See §1.1 for what we do collect from those surfaces.
• Photos, images, or media you send
• Voice messages, audio recordings, or voice call content
• Your real name, legal name, or identity
• Phone number or email address
• Physical address or location data
• Contacts from your device's address book
• Browsing history or search history
• Photos, files, or other content from your device
• Voice or video call content (all calls are end-to-end encrypted)
• QR code sharing data (QR codes are generated locally on your device)
• Biometric data (biometric authentication data stays on your device)
• Financial information (payments processed by Apple)
• Social Security numbers or government IDs
• Health or medical information
• Racial or ethnic origin, political opinions, religious beliefs
• Sexual orientation or gender identity
• Trade union membership
• Genetic or biometric data for identification

2. HOW WE USE YOUR INFORMATION

We use the limited information we collect for the following purposes:

• Provide Services: To operate, maintain, and provide the features of the Application
• User Discovery: To enable you to find and message other users by username
• Account Management: To manage your account and verify account uniqueness
• Purchases: To process and manage your Pro subscription through Apple
• Notifications: To send push notifications if you enable them
• Bug Fixes: To identify and fix technical issues and crashes (via Sentry crash reports, scoped per §1.2)
• Security: To prevent fraud, abuse, and unauthorized access
• Legal Compliance: To comply with applicable laws and legal processes
• Support: To respond to your inquiries and provide customer support

3. END-TO-END ENCRYPTION

theSHFT uses end-to-end encryption for direct messages, group chats, voice and video calls, voice messages, and shared media within those surfaces. Community posts and Stories are not end-to-end encrypted. They use per-asset encryption with server-side keys so they can be served to other community members and viewers. This is a fundamental architectural decision that affects your privacy:

• Encryption Protocols: Direct messages use X3DH (Extended Triple Diffie-Hellman) for initial key agreement, the Double Ratchet protocol for forward secrecy, NaCl (Curve25519-XSalsa20-Poly1305) for message payload encryption, and ML-KEM-768 (a NIST-standardized post-quantum key encapsulation mechanism) layered alongside Curve25519 so an adversary must defeat both classical and post-quantum primitives to derive a session key. Group chats use Sender Keys for efficient group messaging encryption. Voice and video calls use AES-256-GCM with per-call keys derived locally via X25519 ECDH.
• Message Privacy: Only you and your intended recipients can read messages. Messages are encrypted on your device before transmission. This applies to direct messages, group chats, voice messages, and all shared media.
• Calls Encrypted Regardless of Plan: All voice and video calls are end-to-end encrypted for every user. Encryption does not depend on your subscription tier, and any limits on call length or features (described in our Terms of Service and EULA) do not change the encryption applied to your calls.
• No Server Access: We cannot access, read, decrypt, or store the content of your messages. We do not have the encryption keys.
• No Content Moderation: Due to encryption, we cannot moderate or review message content.
• Legal Requests: We cannot comply with requests for message content because we do not have access to it. We can only provide the limited metadata we collect.
• Automatic Deletion: Messages are automatically deleted based on the disappearing timer set on the conversation. Every chat starts with a 10 second timer; either participant can change it or turn it off, and the choice applies to both sides. Free accounts can choose 10 seconds or 30 seconds. Pro adds 5 seconds, 1 minute, 5 minutes, 1 hour, and 24 hours.
• Transit Storage: Messages may be stored in encrypted form on our servers solely to deliver them to offline recipients. We cannot decrypt them. The disappearing timer starts when the recipient opens the message, so a message that is never opened is retained as ciphertext and automatically deleted one (1) year after it was sent.

4. DATA STORAGE AND SECURITY

4.1 Local Device Storage

The following data is stored ONLY on your device using encrypted local storage:

• Your PIN (never transmitted)
• Your recovery phrase words (the phrase itself is never transmitted: only a one-way hash is sent to our servers for account-restore lookup; see §1.1)
• Application settings and preferences
• Decrypted message content (until timer expiration)
• Biometric authentication data (managed by your device OS)

4.2 Cloud Storage

The following data is stored on our servers (Firebase/Google Cloud). This list is illustrative of the main categories rather than exhaustive:

• Your username (for account identification and discovery)
• Anonymous device identifier (for account uniqueness)
• Contact list (for each contact, their username and account identifier, plus any nickname you have set for them)
• Push notification token (if notifications enabled)
• Pro purchase status (synced from Apple)
• Account creation timestamp
• Group membership and group names, including who is in each group and who created it
• Presence information (whether you are online, and a last-seen timestamp)
• Your profile picture, stored encrypted
• Community posts, Stories, and Community votes, which are not end-to-end encrypted
• Public encryption keys and pre-key bundles

4.3 Security Measures

We implement industry-standard security measures including:

• End-to-end encryption for direct messages, group chats, voice and video calls, and voice messages (community posts and Stories use server-side per-asset encryption; see §3)
• Encrypted data transmission (TLS/HTTPS)
• Secure cloud infrastructure (Google Cloud/Firebase)
• Regular security assessments
• Access controls and authentication

However, no security system is 100% secure. We cannot guarantee absolute security. You use the Application at your own risk.

5. DATA SHARING AND DISCLOSURE

We do NOT sell, trade, rent, or otherwise share your personal information with third parties for their marketing purposes. We may share information only in these limited circumstances:

5.1 Service Providers

We use the following third-party service providers who may have access to limited data:

• Firebase (Google): Cloud infrastructure, authentication, database, encrypted file storage, push notification delivery. We do NOT use Firebase Analytics.
• Agora: Voice and video call infrastructure. Agora receives an anonymous session token to facilitate call connections and processes only the end-to-end encrypted (AES-256-GCM) media stream and routing metadata. Agora does not receive your username, identity, or any personal information, and cannot read call audio or video content.
• Apple Inc.: In-app purchases, push notifications, App Store distribution
• RevenueCat: Purchase management and payment processing
• Expo: Push notification delivery. Expo receives your device push token, the visible notification title and body, and a routing payload. The visible title and body are generic and never contain message content, with one exception: an official theSHFT announcement, a public post written by theSHFT for every member, shows its headline on your lock screen. An announcement is never a message someone sent you, and you can turn announcements off with the Communities switch under Notifications. The routing payload is what your device needs to open the right screen, and for some notification types it does include identifying information: see section 16.3. Expo never receives the content of a message, a call, or any media, all of which are end to end encrypted and cannot be read by us or by Expo.
• Sentry: Crash reporting only, scoped per §1.2. You can disable this in the mobile App at Settings → Privacy → "Send crash reports".

These providers are bound by their own privacy policies and data processing agreements.

5.2 Legal Requirements

We may disclose information if required by law, subpoena, court order, or government request. However, due to our encryption design:

• We CAN provide: username, anonymous device identifier, account creation date, subscription/purchase status, in-app contact list (each entry's username and account identifier), any nicknames you have saved for your contacts, public encryption keys, Community message content, and Community vote data (Community posts and votes are not end-to-end encrypted)
• We CANNOT provide: the content of direct messages or group chat messages, private media files, voice messages, voice/video call content or recordings, PIN codes, recovery phrases, or private encryption keys (these are end-to-end encrypted and we do not have access)

5.3 Safety and Protection

We may disclose information to protect the safety of any person, to address fraud or security issues, or to protect our rights and property.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred to the successor entity. We will provide notice before your information becomes subject to a different privacy policy.

5.5 With Your Consent

We may share information with third parties when you explicitly consent to such sharing.

6. DATA RETENTION

We retain different types of data for different periods:

• Messages: Deleted based on your timer setting (Free: 10 or 30 seconds; Pro: 5 seconds up to 24 hours)
• Undelivered (Unopened) Messages: Retained as ciphertext until opened; a message never opened is deleted one (1) year after it was sent
• Account Data: Retained until you delete your account
• Crash Reports (Sentry): Retained by Sentry for 90 days, scoped per §1.2. Removal before then can be requested at support@theshft.app.
• Invite Records: Deleted fourteen (14) days after creation, or sooner if revoked
• Rate-Limit Buckets: Expire automatically within two hours of the last attempt
• Device Restriction Records: Expire 365 days after the related account was deleted
• Moderation and Administration Logs: Retained while the related account or community exists and for up to 3 years afterwards
• Call Signaling: A record of who is calling whom exists only while a call is being set up and is deleted when the call ends; calls are never recorded
• Support Requests: Retained for up to 3 years for legal compliance
• Legal Hold: Data may be retained longer if required for legal proceedings

7. YOUR PRIVACY RIGHTS

You have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct your username
• Deletion: Delete your account and all associated data
• Portability: Request your data in a portable format
• Opt-Out (Crash Reports): Disable Sentry crash reporting in the mobile App at Settings → Privacy → "Send crash reports"
• Withdraw Consent: Withdraw consent for optional data processing
• Restrict Processing: Request restriction of certain processing activities
• Object: Object to certain types of processing

To exercise these rights, contact us at support@theshft.app. We will respond within 30 days (or as required by applicable law).

8. ACCOUNT DELETION

You can delete your account at any time through Settings → Delete Account. Upon deletion:

• Your username is immediately released and may be claimed by others
• All local data on your device is permanently erased
• Your account record is deleted from our servers
• Your contact relationships are removed
• This action is PERMANENT and CANNOT be undone

Note: Messages you previously sent may still appear on recipients' devices until their timers expire. We cannot delete messages from other users' devices.

9. CHILDREN'S PRIVACY

9.1. Age Restriction: theSHFT is intended for users aged eighteen (18) and older, or older still where local law sets a higher minimum, including nineteen (19) in South Korea and twenty-one (21) in Indonesia and Singapore. We do not knowingly collect personal information from anyone under the applicable minimum age.

9.2. Parental Notice: If you are a parent or guardian and believe your child under 17 has provided personal information to us, please contact us immediately at support@theshft.app.

9.3. Deletion: If we discover that we have collected personal information from a child under 17, we will take immediate steps to delete that information.

9.4. COPPA Compliance: We comply with the Children's Online Privacy Protection Act (COPPA) by not knowingly collecting information from children under 13.

10. INTERNATIONAL DATA TRANSFERS

10.1. Server Location: Our servers are primarily located in the United States.

10.2. Cross-Border Transfers: If you access the Application from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

10.3. Legal Basis: For transfers from the European Economic Area (EEA), UK, or Switzerland, we rely on: (a) Standard Contractual Clauses approved by the European Commission; (b) adequacy decisions; (c) your explicit consent where applicable.

10.4. Different Laws: Data protection laws in the United States and other countries may differ from those in your jurisdiction. By using the Application, you consent to such transfers.

11. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

11.1 Right to Know

You have the right to request disclosure of:

• Categories of personal information collected
• Specific pieces of personal information collected
• Categories of sources from which information is collected
• Purpose for collecting or selling personal information
• Categories of third parties with whom information is shared

11.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions.

11.3 Right to Opt-Out

You have the right to opt-out of the "sale" or "sharing" of personal information. WE DO NOT SELL YOUR PERSONAL INFORMATION.

11.4 Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

11.5 Right to Correct

You have the right to request correction of inaccurate personal information.

11.6 Right to Limit Use of Sensitive Information

We do not collect sensitive personal information as defined under CPRA.

11.7 Contact for California Requests

To exercise your California privacy rights, contact us at support@theshft.app with subject line "California Privacy Request."

11.8 "Do Not Sell My Personal Information"

We do not sell personal information. We do not have a "Do Not Sell" link because we do not sell data.

12. EUROPEAN PRIVACY RIGHTS (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and similar laws:

12.1 Legal Basis for Processing

We process your personal data based on:

• Contract Performance: Processing necessary to provide the Application services you requested
• Legitimate Interests: Processing necessary for our legitimate business interests (e.g., security, fraud prevention, improvement)
• Consent: Where you have given explicit consent (e.g., crash reporting, push notifications)
• Legal Obligation: Processing necessary to comply with legal requirements

12.2 Your GDPR Rights

You have the following rights under GDPR:

• Right of Access (Art. 15): Obtain confirmation of processing and access to your data
• Right to Rectification (Art. 16): Correct inaccurate personal data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time for consent-based processing
• Right to Lodge a Complaint (Art. 77): File a complaint with a supervisory authority

12.3 Data Protection Officer

For GDPR-related inquiries, contact our Data Protection Officer at: support@theshft.app

12.4 Supervisory Authority

You have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights.

13. OTHER INTERNATIONAL PRIVACY LAWS

13.1 Brazil (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including rights to access, correction, deletion, portability, and information about data sharing.

13.2 Canada (PIPEDA)

If you are located in Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including rights to access and correct your personal information.

13.3 Australia (Privacy Act)

If you are located in Australia, you have rights under the Privacy Act 1988, including the Australian Privacy Principles (APPs).

13.4 Other Jurisdictions

We strive to comply with applicable privacy laws in all jurisdictions where we operate. If you have questions about your specific rights, contact us at support@theshft.app.

14. DO NOT TRACK

14.1. Browser Signal: The Application does not respond to "Do Not Track" browser signals because we do not track users across third-party websites.

14.2. No Cross-Site Tracking: We do not track your activities across websites or applications owned by other companies.

15. APP TRACKING TRANSPARENCY (iOS)

15.1. No Cross-App Tracking: theSHFT does not track you across apps or websites owned by other companies.

15.2. No IDFA: We do not use or collect the Identifier for Advertisers (IDFA).

15.3. No Ad Networks: We do not participate in advertising networks or display third-party advertisements.

15.4. ATT Framework: We comply with Apple's App Tracking Transparency framework by not engaging in tracking activities that require user permission.

16. PUSH NOTIFICATIONS

16.1. Optional Feature: Push notifications are optional. You can enable or disable them in your device settings.

16.2. Delivery Infrastructure: Notifications are delivered through Expo Push Notification Service and Apple Push Notification Service (APNs). These services receive your device push token, the visible title and body, and the routing payload described in 16.3, including the identifying fields listed there. They do not receive the content of your messages, calls, or media, which are end to end encrypted and are never transmitted through a push notification.

16.3. What Is Visible, and What Is Sent: The text you see on your lock screen is always generic. It never includes message text, a message preview, or the body of anything you have been sent. A typical notification says only that you have a new message. The one exception is an official theSHFT announcement: a public post written by theSHFT for every member, whose headline is shown on your lock screen. It is never a message someone sent you, and you can turn announcements off with the Communities switch under Notifications.

Separately from that visible text, every push carries a routing payload that your device uses to open the correct screen. That payload is not shown on your lock screen, but it is transmitted to and can be read by our push delivery providers. For some notification types it identifies the other person or group: an incoming or missed call includes the caller's username, because Apple requires a name in order to display an incoming call; being added to a group includes the group name; a mention, reaction, or contact request includes the sender's username; and message notifications include a conversation identifier which, for a one to one chat, is derived from the two participants' account identifiers.

We are stating this precisely rather than summarizing it favorably. If you want no identifying information transmitted at all, disable push notifications for theSHFT in your device settings; the app continues to work and messages arrive when you open it.

16.4. Token Storage: We store your push notification token so we can deliver notifications to your device. Turning notifications off in the Application stops us sending alerts to that token, although incoming calls still ring. Turning them off in your device settings stops your device displaying them. The stored token is deleted when you delete your account.

17. COOKIES AND SIMILAR TECHNOLOGIES

17.1. Cookies: The mobile application does not use browser cookies, web beacons, or tracking pixels. The web application at theshft.app uses only the storage strictly necessary to keep you signed in and to hold your settings. We do not use advertising, analytics, or cross-site tracking cookies anywhere.

17.2. Local Storage: We use encrypted local storage on your device to store settings and preferences.

17.3. Third-Party SDKs: Third-party SDKs we use (Firebase, RevenueCat) may use their own data collection technologies. See their privacy policies for details.

18. THIRD-PARTY LINKS AND SERVICES

18.1. External Links: The Application may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties.

18.2. Review Policies: We encourage you to review the privacy policies of any third-party services you access.

19. CHANGES TO THIS PRIVACY POLICY

19.1. Updates: We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

19.2. Notice: We will notify you of material changes by posting the updated policy in the Application and updating the "Last Updated" date. For significant changes, we may also provide additional notice (e.g., in-app notification).

19.3. Continued Use: Your continued use of the Application after changes are posted constitutes your acceptance of the updated Privacy Policy.

19.4. Review: We encourage you to periodically review this Privacy Policy to stay informed about our data practices.

20. DATA CONTROLLER INFORMATION

For the purposes of applicable data protection laws:

Data Controller: theSHFT

Contact Email: support@theshft.app

Legal Entity and Mailing Address: theSHFT LLC, 212 W. Troy St., Ste B, Dothan, AL 36303, United States

Data Protection Officer: support@theshft.app

21. APPLE APP STORE DISCLOSURES

21.1. Distribution: This Application is distributed through the Apple App Store. Apple's Privacy Policy applies to information collected by Apple.

21.2. Data Controller: We are the data controller for information collected through the Application. Apple is not the data controller for Application data.

21.3. Privacy Nutrition Labels: We provide accurate information to Apple for display in App Store privacy nutrition labels.