This summary helps you read the policy. It does not replace it; if they differ, the full policy controls.
We cannot read your direct messages, group chats, calls, or the photos, videos, voice notes and files you send in them. They are end-to-end encrypted, and only the devices of the people in the conversation hold the keys.
We can read some things: Community posts and votes, Stories, profile photos, usernames, bios, your SHFT look, your contacts list, who reacted to a message, reports, and records of who you message and when (not what). This policy lists every one of them, who can see it and how long we keep it.
We do not ask for your name, email address or phone number. theSHFT has no analytics. We do not sell your information, show you ads, or track you across other apps or websites.
Some information is visible to other signed in users, including your username, bio, public keys, your SHFT look, some of your settings, your account's status fields and, depending on your settings, your profile photo and whether you are online.
theSHFT deletes messages on timers and when a contact removes you, and we delete other records on the schedules below. Some records last longer: a legal hold, moderation and safety records, purchase records, and a few items this policy names.
If you apply to be a sales representative, we collect much more (including your name, contact details, a tax form and an ID), as Section 21 explains.
This Privacy Policy explains how theSHFT LLC ("theSHFT," "we," "us" or "our") collects, uses, shares, keeps and deletes information when you use the theSHFT mobile application, any web version of it we offer, our website at https://theshft.app, our support email, and our sales representative program (together, the "Services"). It applies everywhere we offer the Services. Words defined in our Terms of Service have the same meaning here. This policy describes what the Services do on the Last Updated date; where a feature is switched on for some users and not others, the policy says so.
PLEASE READ THIS POLICY CAREFULLY. IT DESCRIBES INFORMATION THAT OTHER USERS AND WE CAN SEE, AND WAYS YOUR INFORMATION CAN BE PERMANENTLY DELETED, INCLUDING BY OTHER PEOPLE'S ACTIONS.
1.1. The company responsible for your information (the "controller") is theSHFT LLC, 212 W. Troy St., Ste B, Dothan, AL 36303, United States, support@theshft.app.
1.2. This policy covers information about users of the Application, visitors to our website, people who email us, and applicants to and members of our sales representative program. It does not cover information handled by Apple, Google or other companies under their own policies, such as the App Store's purchase records or your device's operating system.
1.3. Other users of theSHFT decide what they do with the messages and Content you send them. This policy does not govern what they do with it.
Our servers create and keep the following records so the Services can work:
The following stays on your Device and is not sent to us, except as stated:
From users of the Application, we do not ask for or collect: your real name; your email address or phone number (unless you email us or apply to our sales program); your postal address; government identification numbers; payment card or bank details; GPS or precise location; your device's address book; your device's advertising identifier; biometric data; health information; or the content of your end-to-end encrypted messages, calls and media, which we cannot read. theSHFT has no analytics: we do not record which features you use, count your activity in the Application or measure your engagement, and we use no analytics or advertising software, advertising networks, tracking pixels or fingerprinting. We do not track you across other companies' apps or websites. The only diagnostic information we receive is the crash and stability reports described in Section 17, which you can turn off, and the delivery records described in Sections 3 and 5.
This Section describes the Application. If you email us, we receive your email address. If you apply to our sales representative program, we collect the information in Section 21, which includes your name, contact details, a tax form and an identity document.
We use information only for these purposes:
We do not sell your information, share it for cross-context behavioral advertising, or use it to target ads. Apart from the automated moderation described in Section 18, which can hide or remove Content and, for suspected child sexual abuse material, suspend an Account, we do not use your information to make automated decisions that have legal or similarly significant effects on you, and you can ask for a person to review an automated moderation decision by appealing it.
9.1. What Is End-to-End Encrypted. Direct Messages and Groups, and the photos, videos, voice notes and files sent in them, are encrypted on your Device before they leave it, and only the Devices of the people in the conversation hold the keys. The Application uses the following:
9.2. What We Can and Cannot Do. We cannot read, decrypt, moderate or produce the content of end-to-end encrypted messages, calls or media, because we do not have the keys. This is a property of the design, not a policy choice. We can see the metadata described in Section 3, such as who is in a conversation and when messages are sent and read.
9.3. Limits. End-to-end encryption does not protect Content on a Device that is unlocked, lost, stolen or compromised; Content a recipient copies, forwards, photographs or records; text captured by a keyboard or other software; information in an old backup of a Device; or metadata. When a Contact restores their Account their keys change, and the Application shows a notice when it notices the change; it cannot tell a restore from an attack, and it records a Contact's key without a notice the first time it sees it. The encryption module is published at github.com/wma1101/theshft-crypto; the rest of the Application and our servers are not open source, and no external audit has been commissioned.
9.4. Not End-to-End Encrypted. Community Content and votes, Stories (with their captions, reactions and viewer lists), which accounts reacted to messages in Direct Messages and Groups (and, for a reaction sent from a version before 9.5, which emoji), profile photos, group photos, your SHFT look, bios, usernames, your contacts list, Voice Room listings, reports, appeals, the text of a Community notification your Device fetches (Section 15), and all the records in Section 3 are not end-to-end encrypted. We can read them, and some of them are visible to other users as this policy explains.
10.1. Calls. Voice and video calls are end-to-end encrypted with AES-256-GCM. Between current versions of the Application the key is random for each call and is exchanged sealed under X25519; with older versions, and with devices that have not advertised the newer method (for example an Android phone), the key is derived from an X25519 exchange of the two identity keys and is the same for every call between the same two accounts. Calls do not yet have forward secrecy. Call audio and video pass through our call provider's relay servers as encrypted data that neither the provider nor we can decode.
10.2. No Recording by Us. We do not record, store or transcribe calls or Voice Rooms.
10.3. Call Records. While a call is ringing or in progress, our servers keep the record described in Section 3. A one to one call record is deleted when the call ends, and our servers delete any record left behind within minutes for a call that was never answered and within about twelve (12) hours for one that was. A group call record is deleted when the last participant leaves; if that does not happen, our servers delete it within about twenty (20) minutes after nobody is left in it, and in any case within about seven (7) hours after the call started. The call history you see is kept only on your Device.
10.4. Your Phone's Call History. theSHFT does not add your calls to your phone's own call history. They are not listed in Recents on iPhone, so iCloud does not copy them to your other devices, and they are not written to the call log on Android. Calls that an earlier version of theSHFT added to Recents stay there until you delete them in the Phone app; no app can delete them for you.
10.5. Who Can Call You. For one to one calls, our servers ring you only when the caller is one of your contacts. A group call rings every member of the Group unless the member blocked the caller or muted the Group.
10.6. Voice Rooms. A Voice Room is a live audio room in a Community. It is encrypted with a room key the host's Device creates and shares with each listener's Device. Any member of the Community who is not banned can join and listen, and people removed from a room may still hold its key, so treat a Voice Room as public to its listeners. The room's listing (its Community, channel, host and status) and the list of people in the room (their usernames and roles) are stored on our servers and readable by any signed in user while the room is live. When the host ends the room, the listing is deleted. If the host's Application disconnects instead, our servers end the room within a few minutes and remove the host's name; a record that the room existed and ended can remain. A scheduled room's host and start time are readable by any signed in user until about two (2) hours after the scheduled time.
Community posts are NOT end-to-end encrypted. Treat anything you post in a Community as public.
13.1. Search. Searching your contacts, messages and groups happens on your Device. Searching Communities sends the longest word you type to our database, which returns Communities whose name or topic matches it; your Device narrows the results with the rest of your words. When you look up a username to add a contact, your Device asks our database for that exact username. We do not keep a record of your searches, although our hosting provider's logs may show that a lookup happened. Your recent searches are kept on your Device.
13.2. Contacts. Your contacts list and the relationship records described in Section 2 are stored on our servers so that your contacts list works across restores and so our servers can enforce audience rules (for example who can see your Stories and who can call you). When you or a contact removes the other, the relationship record is deleted, and the one-to-one conversation is deleted as Section 25 explains.
13.3. Presence. Unless your Last Seen setting is Nobody, the Application stores whether you are online and when you were last seen in a record that any signed in user who has not been blocked by you can read, and the Application shows it according to your setting (Everyone or My Contacts). The My Contacts setting controls what the Application displays; it is not enforced by our servers, so a modified application could read your status. In addition, our real time relay may tell connected devices when an account comes online or goes offline, which a modified application could read, whatever your setting.
13.4. Blocking. When you block someone, we store that on our servers so we can stop their one-to-one messages, calls, contact requests and Story views from reaching you and hide your online status from them. We do not notify the blocked person, but the block record is readable by them, so a modified application could learn that you blocked them. The block record never says that you reported them: if an older version of the Application wrote a report reason there, our servers replace it with a plain block reason. Blocking does not remove anyone from a Group.
15.1. Optional. Push notifications are optional. You can turn them off in your Device settings, and choose kinds of notifications in the Application.
15.2. What Is Visible, and What Is Sent. The text of a notification our servers send for a direct or group message is always generic. If you choose Name only or Name and action under In App Banners, a notice theSHFT shows while it is open can name the sender, and your phone may keep it in its notification list. It never includes message text, a message preview, or the body of anything you have been sent in a direct or group chat. A typical notification says only that you have a new message. Three kinds of notification can show more:
15.3. The Routing Payload. Separately from the visible text, every push carries a routing payload that your Device uses to open the correct screen. It is not shown on your lock screen, but it is transmitted to and can be read by our push delivery providers. It never contains message content or Community post text. For most notification types it identifies the other person, group or post by an account, group, post or conversation identifier, and message notifications include a conversation identifier which, for a one-to-one chat, is derived from the two participants' account identifiers. A mention, reaction, story, group change or contact request includes the other person's account identifier, not their username; being added to a group includes the group's identifier, not its name. We may replace these identifiers with a random reference that only your own Account can resolve; where we do, the reference and what it points to are stored in your Account for seven (7) days. An incoming call includes the caller's username and account identifier, because Apple requires a name in order to display an incoming call before the Application has started, and your device uses the identifier to show the nickname you saved instead, if you saved one.
15.4. Delivery Providers. Notifications are delivered through Expo's push notification service and Apple Push Notification service (APNs), and on Android through Google's Firebase Cloud Messaging. These services receive your device push token, the visible title and body, and the routing payload described in 15.3. An incoming call reaches an iPhone through APNs directly, not through Expo; that push carries only the call identifier, the caller's account identifier and username, whether it is a video call, and the time it was sent. A second notification about the call goes through Expo with the call's channel identifier, the caller's account identifier and whether it is a video call, but not the caller's username, and group calls ring only through Expo. None of these services receives the content of your messages, calls or media, or the text of Community posts (only the headline of an official theSHFT announcement, as 15.2 explains).
15.5. If You Want Less Information Sent. Turn off Push Notifications in the Application's Settings, and turn off notifications for theSHFT in your Device settings. The Application keeps working, and messages arrive when you open it. Incoming calls still ring so you can answer them: a call from one of your contacts still reaches an iPhone through Apple with the caller's username and account identifier, and a second call notification with the caller's account identifier still goes through Expo (Section 15.4). To stop calls from someone, block them or remove them as a contact; for a Group call, mute the Group.
15.6. Community Notification Keys. When this feature is available and you allow notifications, your Device creates a random key so it can fetch the text of a Community notification, and our servers store a one-way hash of that key with a random identifier (up to eight per Account), plus short lived counts of those requests, including an hourly count keyed to a hash of your account and the post's author. The key itself stays on your Device, and your Device sends it only when it fetches a notification's text. Our servers refuse a key after ten (10) days, and your Device replaces it more often. The hashes are deleted when you sign out, when the Application is wiped while it can reach our servers, and when you delete your Account; a hash left by a wipe done offline cannot be used after ten (10) days.
16.1. Screen Capture Protection. Screen capture protection is always on, and there is no setting to turn it off. The Application draws its screens through a protected layer, so on iPhone and iPad a screenshot, a screen recording or AirPlay screen mirroring of theSHFT comes out blank, and on Android the system refuses the screenshot or records a black screen. This applies on your Device and on the Devices of the people you message that run version 9.5 or later of the Application. A screen recording blanks the picture, not the sound, so a voice note or video played in a conversation can still be heard in a recording. The one exception: our administrator can exempt a specific account, which we do only for accounts theSHFT itself uses to make promotional recordings. Each exemption is granted and removed only by our administrator through our servers, and each change is recorded in our administrative audit log. An exempt account's account record carries a single value saying so, which the Application of any signed in user can read. Even on an exempt account's Device, every screen that shows messages or content from someone who is not exempt stays blank. An exemption never makes your messages capturable on anyone's Device.
16.2. Screenshot Notices. When you take a screenshot in a one to one or group conversation on iPhone or iPad, iOS tells the Application, and the Application writes a system event to that conversation so the other participants learn a screenshot was taken (the screenshot itself is blank, as Section 16.1 explains). That record contains your user identifier as the sender, the event type ("screenshot taken") and a server timestamp. It does not contain any message content or an image of your screen. It is stored as a message in that conversation, is written with a 30 second disappearing timer, and is removed when the conversation is deleted. No notice is written while the Application is locked.
16.3. Limits. Limits we will not paper over: iOS does not tell Applications when a screen recording begins, so recordings are blanked but no notice is sent; screenshot notices are sent only from iPhone and iPad; the protection does not cover the on screen keyboard or alerts drawn by the operating system itself; it relies on how iOS and Android draw protected content, which a future system update could change; a modified copy of the Application, a jailbroken or rooted Device, or a version of theSHFT older than 9.5 may not apply it; a web version of theSHFT, if we offer one, cannot blank captures; and no software can prevent someone from photographing the screen with another device or copying out what they read.
17.1. What We Use. We use Sentry (sentry.io) for crash and stability reporting. It is on by default, and you can turn it off at any time in Settings, Privacy, Advanced privacy, "Send crash reports." When it is off, no reports are sent; turning it off stops reporting at once, and when it is off at launch the reporting software is not started.
17.2. What a Report Contains. Sentry receives: (a) the type and stack trace of errors; (b) device and app context attached to every event (device model, operating system version, Application version and build, locale and time zone, and technical details such as memory, screen size and whether the Device is jailbroken or rooted); (c) session records (when a session starts and ends and whether it ended in a crash); (d) app hang events; (e) sampled performance traces of app start, screen navigation and network requests, including screen and route names, from about ten percent (10%) of sessions (all sessions in test builds); and (f) a short trail of the screens opened and requests made before an error. Each report also carries a random identifier that Sentry's software creates when the Application is installed; it is not your account identifier or username.
17.3. What Is Removed Before Sending. Before a report is sent, the Application removes touches, taps and key presses, and filters the rest: for a request the Application makes, a report keeps its method and status, and keeps only the name of the server when it is one of theSHFT's own servers; every other address, including a link someone sent, is recorded as "not recorded." Account, chat and group identifiers, database paths and call channel names in the text of a report are replaced with placeholders, and values under names that identify a person are dropped. The Application is built so that Sentry does not receive message content, call media, your contacts list or precise location. Like any server, Sentry receives the network address of the connection that sends a report; we have set it not to store that address. We do not use crash reports for advertising or to build profiles.
17.4. Older Versions. Versions of the Application before 9.5 did not apply all of these filters. If crash reports were on, which was the default, a report from one of those versions could include the text of a message you touched in a chat, the words of your Recovery Phrase if you touched them while saving or checking it, the digits you touched on a PIN keypad, including a Duress PIN (a Pro feature), the web address of a link someone sent in a conversation, and file storage paths that contain the account identifiers of both people in a one-to-one conversation. We have switched off the key those versions used to send crash reports, so Sentry no longer accepts reports from them, and we have deleted the reports it had stored from them.
17.5. Retention. Sentry keeps reports for ninety (90) days. You can ask us at support@theshft.app to delete reports sooner; because reports from current versions do not contain your username or account identifier, we may not be able to find reports that relate to you.
18.1. Safety Prompts on Your Device. If Safety prompts is on (it is on unless you turn it off in Settings, Safety), the Application checks text you are about to send in a Direct Message or Group, on your Device only. If it finds signs you may need help, it offers help lines; if it finds words that may hurt someone, it asks whether you still want to send them. Nothing about this check is sent to us.
18.2. Content Filtering. The Application checks the text of new messages, captions, Community posts and replies, the name and description of a new Community, the name of a new Group, and your bio, on your Device, against a short list of patterns. Text matching patterns associated with child sexual abuse material is not sent; in Direct Messages and Groups, text matching patterns associated with threats of violence or self harm shows a warning you can dismiss. The check does not examine images, video, calls, Voice Rooms or Stories, and nothing about it is sent to us. For Community posts and replies, which are not end-to-end encrypted, our servers run an automated check for text that indicates child sexual abuse material. It checks text, not images. When it matches, the post and its media are removed from view at once and preserved as Section 18.8 describes, the Account that posted it is suspended pending review (for a copy another member reposted, a person reviews the original author's Account first), and a record of the action is kept for review. We do not and cannot scan end-to-end encrypted messages on our servers.
18.3. AutoMod and Crowd Removal. Community administrators can set automatic rules that hide, remove or flag posts based on their text, length, links or the age of the posting Account. When a rule flags a post, we keep a record of the flag and a copy of the post for the Community's moderators. The copy is deleted when a moderator acts on the post, and the record and any remaining copy are deleted ninety (90) days after the flag. A post whose downvotes exceed its upvotes by ten (10) or more is folded, and by twenty (20) or more is removed automatically; three removals in one Community ban the author from it.
18.4. Reports. When you report a person (from a conversation, their profile, a Story or a contact request), a Community post or reply, or a Community, we receive the reason you choose, anything you write, the reported account and the item. For server-readable Content, we save a copy of the reported item (its text, any photos, videos or files in it, its author and its time) with the report so moderators can review it even if it is later deleted. For end-to-end encrypted conversations, a report does not send us the content of your messages; we act on what you write and on what we can see. We do not tell the reported person who reported them. Reporting a person from a conversation, their profile, a Story or a contact request currently also blocks them (see Section 13.4). A report sends an email to our administrator mailbox with the reason, the reported account, the Community if there is one, your description and a report number. The email does not show your username, but the report number contains your account identifier. For a child safety report, the email says only that a report is waiting. Reports still open after twenty four (24) hours are flagged to our administrator. A Community post may be hidden automatically after an urgent report or after reports from three (3) different people.
18.5. Who Reviews. Community moderators can review reports about their Community's posts, including the reason and a short preview of a post that is still up. For the most serious categories (child safety, violence, doxxing, hate, self harm and copyright), the saved copy of an item that has been deleted is shown only to theSHFT's administrator. Reports about accounts go to theSHFT's administrator. The full record of a report of suspected child sexual abuse material opens only for theSHFT's administrator; a Community's moderators may see that a post still up in their Community was reported for it, with the reason and a short preview. Each time anyone views such a report, their account and the time are recorded.
18.6. Moderation Records and Retention. Reports and moderation records are kept as follows: the saved copy of reported Content is deleted when the report is resolved (where a removal is upheld, it is kept as evidence) and at the latest when its review queue entry expires after ninety (90) days, except for suspected child sexual abuse material, which we keep for review and as the law requires; review queue entries expire after ninety (90) days, except entries about suspected child sexual abuse material; Community moderation logs are kept for three (3) years after the action each one records, and then deleted; strike counts and Community ban records are kept while the Account they name exists and are deleted with it; report records and our administrative audit log do not yet have a fixed deletion date: we keep them while they are needed for appeals, repeat violations, safety and legal claims (records of child sexual abuse material are kept as Section 24 describes), and we will add the period to this policy when we set it.
18.7. Appeals. You can appeal an account suspension or warning in the Application; theSHFT's administrator decides it within fourteen (14) days. The administrator cannot decide an appeal of an action they took personally: that appeal waits for another administrator to review it, which can take longer than fourteen (14) days. Community bans and post removals are appealed in the Application to that Community's moderators, who decide them. We keep appeals and their outcomes with the moderation record.
18.8. Child Sexual Abuse Material. We report apparent child sexual abuse material to the National Center for Missing and Exploited Children, and preserve it, as 18 U.S.C. 2258A requires. A report to that center can include the Content, the account identifier, username and other information about the Account that posted it. If you report an account or a Community for child safety, your description may be included in our report to that center; your identity is not.
19.1. Status. Keep and Report and keep are built into the Application but are not available to users on the Last Updated date. This Section applies when we make them available to you.
19.2. Keep. A theSHFT Pro user can ask to keep a one-to-one conversation. Nothing is kept unless the other person accepts on their own Device. While Keep is on, both Devices show a banner, the conversation's timer is set to Off, and messages sent while Keep is on cannot be edited or deleted for everyone, even after Keep stops. Kept messages are copied into an encrypted vault on the keeper's Device. If the other person removes the keeper or deletes their Account while Keep is on, or within the closing period after it stopped, our servers hold the kept messages and their media, still encrypted, for the closing period (thirty (30) days unless we set a shorter or longer period, and never more than ninety (90) days) so the keeper's Device can finish its copy, and then delete them; everything that was not kept is deleted at once. Our servers can see that a conversation is under Keep, who keeps it, who accepted or stopped it, when Keep was requested, accepted, stopped or began closing and why, how many times it was requested in the last thirty (30) days, and a stamp on each message sent while it was on, but not the content.
19.3. Report and Keep. When you report a person in a one to one chat, you may choose to keep what that person sent you: your Device copies their messages that are still on your Device or not yet read, and that have not yet disappeared (up to five hundred (500)), into the encrypted vault on your Device, without marking them read and without telling them. View once messages are not copied; only a note of their type and time is kept. Nothing is kept for a report of child sexual abuse material. Kept photos, videos, voice notes and files can be viewed only inside the vault. We receive only a summary: how many messages, media files and view once notes were kept, a fingerprint of the kept set, and when we recorded it. To spot misuse, we note for seven (7) days whom you reported with a kept set, and a moderator reviews it if you keep sets against more than three (3) people, or more than two (2) against the same person, in that time. We do not record the summary at all until we have set how long we keep it and stated that period in this policy.
20.1. Purchases. Apple processes every purchase of theSHFT Pro. We use RevenueCat to manage subscriptions: the Application gives RevenueCat your internal account identifier as its customer identifier, and RevenueCat receives purchase information from Apple. We and RevenueCat receive whether you have theSHFT Pro, the product, whether it began with a free trial, and its dates, renewal, cancellation, billing and refund status. To offer a free trial, the Application asks Apple, through RevenueCat, whether your Apple Account can still use one. We do not receive your name, payment card or billing address. Your theSHFT Pro status, your plan, when it ends and when it last changed are stored on your account record, which other signed in users' Applications can read.
20.2. Purchase Records After Deletion. RevenueCat and Apple keep their own records of your purchases under their own policies, and deleting your theSHFT Account does not delete them. We also keep, after your Account is deleted and linked to your former account identifier: any App Store transaction record an earlier version of the Application created (transaction identifier, platform, product and time), for accounting, refund, tax and dispute purposes; our server's log entries of each time it checked your theSHFT Pro status with RevenueCat (whether you had theSHFT Pro and when it ended); and, for thirty (30) days, the notices RevenueCat sent us about your purchases.
20.3. Promotion Codes. If you redeem a promotion code, we record the code, the number of days of theSHFT Pro it gives, and when it was redeemed and ends, on your Account and in a list of redemptions, which we delete when you delete your Account.
20.4. State Codes. If you enter a state code on the upgrade screen and then buy theSHFT Pro, we record the code, the state, the product, the time and your account identifier, to measure where our promotions reach people. When you delete your Account, we remove your account identifier from these records and keep the rest, which no longer identifies you.
20.5. Sales Representative Referral Codes. If you enter a sales representative's referral code, we record the code and the representative on the private part of your Account, and the Application shows you the representative's name. If you then subscribe, a commission record is created with the product, the price and commission amounts, the commission status, your account identifier, your installation identifier and the representative's name and code; the representative can see the product, the commission amount and status and the date, but not your username or account identifier. Sales representative records about you are deleted when you delete your Account, except the record of each commission (the amount, the date, and which representative earned it), which is kept for four (4) years from the date it was paid to satisfy federal tax recordkeeping requirements, with your identity removed, as described in Section 24.
20.6. Referral Rewards. When we make it available, a referral program may give you and a person you invite thirty (30) days of theSHFT Pro each after the person you invited, a new account, sends messages on three (3) different days within fourteen (14) days of joining. We record who invited whom and when, the days the invited person sent messages in that period, and the reward; while an invitation is open we also keep a one way code of the network it was created from, to stop self referrals.
21.1. The Website. Our website is hosted by Vercel, which receives visitors' IP addresses and request details in its logs. Our pages load fonts from Google Fonts, so your browser sends your IP address and the page address to Google when a page loads. Our sales representative application, upload and dashboard pages load Google's Firebase software, and the upload page uses Google reCAPTCHA through Firebase App Check, which collects device and interaction information and may set a cookie to tell people from automated programs. Two partner pages show images loaded from those partners' websites, which receive your IP address. We do not use analytics, advertising or tracking cookies on the website. The sales representative dashboard page remembers your representative code in your browser's local storage until you sign out. Pages that open an invitation, a user or a Community link pass that link to the Application, and their App Store button adds the username, invitation code or Community identifier to the App Store link as Apple's campaign code, so Apple receives it if you tap the button.
21.2. Support Email. If you email us, we receive your email address, your name if you include it, and whatever you write and attach. Our support mailbox is provided by Microsoft (Microsoft 365, through GoDaddy). We use it to respond, to keep records of legal notices and requests, and to improve the Services, and we keep support email for up to three (3) years unless it is needed longer for a legal claim or obligation.
21.3. Sales Representative Program. If you apply to be a sales representative, we collect your name, email address, phone number, home address, PayPal email address, social media handles, the reason you give for applying, and a dashboard PIN (which we store only as a hash). We do not store the IP address an application came from; to limit abuse, a short lived counter is keyed to a shortened hash of it. If we approve you, we collect a signed representative agreement, an IRS Form W-9 (which includes your taxpayer identification number) and an image of your government issued identity document, and we record the commissions you earn and the payments we make. We use this to evaluate applications, verify identity, prevent fraud, pay commissions and meet tax obligations. We store it with Google Firebase, and we send application and account emails through Google's email service. Application details, including your phone number, address and PayPal address, are emailed to our administrator mailbox. We keep these records as follows: images of identity documents are deleted thirty (30) days after we decide your application; Form W-9 information is kept for four (4) years after the last payment we make to you (or after we approve you, if we never pay you), as tax law requires, and then deleted; the records of an application we reject are deleted one (1) year after we reject it; and the records of an approved representative (the agreement, commission and payment records and contact details) are kept while you are a representative and then for as long as tax and accounting law requires. You can ask us to delete your application at support@theshft.app, subject to records the law requires us to keep.
21.4. Using theSHFT in a Web Browser. If you link a web browser to your Account at app.theshft.app, the following applies in addition to the rest of this Privacy Policy.
(a) Storage in your browser. The browser keeps the keys it needs to send and read your messages, and the information it uses to check your PIN, in its own storage on that computer. Each stored value is sealed with an encryption key that the browser creates and does not allow any website to export. The messages the browser shows are held in that browser while you use it. Anyone who can use that browser profile, and any program or browser extension that can run code inside it, may be able to see what the browser shows.
(b) Removing a browser. You can remove a linked browser from your phone at any time, in Settings, Linked devices. The browser is signed out of your Account and its access ends. A linked browser also stops working 30 days after it was linked unless you link it again. Deleting your Account removes every linked browser.
(c) Hosting. The web version is served by Google Firebase Hosting, which receives your IP address, your browser's details and the addresses it requests, in its logs.
(d) Abuse protection. The web version uses Google reCAPTCHA Enterprise, through Firebase App Check, to tell real browsers from automated abuse. reCAPTCHA collects hardware and software information, such as device and browser data, and sends it to Google for analysis. Its use is subject to Google's Privacy Policy and Terms of Service.
(e) Notifications in a browser. If you allow notifications in your browser, your browser's push service (for example Google for Chrome, Apple for Safari, or Mozilla for Firefox) receives a push token for that browser and each notification we send to it. Notifications about direct and group messages never contain the message's content.
(f) What other people see. People you talk to are told that you also use theSHFT on the web, where screenshots cannot be blocked.
(g) Limits in a browser. In a browser, screen capture protection does not exist, the post-quantum step of the encryption runs in JavaScript rather than the phone's native code, using an open-source library (@noble/post-quantum) that has had no independent security review yet, and the browser does not check our server's certificate the way the phone does. Use the phone for anything you would not want shown on a computer screen.
We use the following providers. Each receives only what it needs to provide its service to us, under its own terms and privacy policy.
We use no analytics or advertising provider.
We do not sell your information or share it for cross-context behavioral advertising. We share information only:
Where this policy says a record has no fixed deletion date yet (report records and our administrative audit log), we keep it only while it is needed for the purpose we collected it for, and we will update this policy with the period once we set it.
25.1. Deleting Your Account. You can delete your Account at any time in Settings, Account Actions, Delete Account. Your sign in is removed at once and you cannot sign back in. Then:
25.2. What Stays After Deletion. Some records can stay after you delete your Account, for as long as Section 24 describes. They can include: records the law requires us to keep (for example records of reports of child sexual abuse material, tax and accounting records, and records under a legal hold); the server acceptance record of the versions of our terms you accepted (Section 3), for seven (7) years; reports naming your former Account, Community moderation logs (for three (3) years after the action each records), review queue entries about suspected child sexual abuse material, our administrative audit log (which has no fixed deletion date yet), a device restriction record if your Account was banned, App Store transaction records, Pro status check log entries and state code records without your account identifier (Section 20), records held under a legal hold, a record of the deletion kept for up to thirty (30) days if our deletion job cannot finish (which can include your username, contacts list and installation identifier while the step that needs each is unfinished, for us to complete the deletion), a removal record holding your former account identifier in each former contact's account for thirty one (31) days, contact removal signals for thirty (30) days, bug reports with your identity removed, and our server logs until they expire. RevenueCat, Apple, Sentry and our other providers keep their own records under their policies.
25.3. Deleting Your Account Does Not Cancel theSHFT Pro. Cancel your subscription in your Apple account settings; deleting your Account does not stop App Store billing.
25.4. When a Contact Removes You, or You Remove a Contact. When you remove a contact, or a contact removes you, the conversation between you is deleted from our servers and from both of your devices, including every message either of you sent in it. The other person's device deletes its copy the next time theSHFT runs on that device and connects to our service. This cannot be undone, and adding each other again does not bring the conversation back. We cannot delete anything either of you copied outside theSHFT, such as a screenshot or a photo of the screen.
25.5. When You Delete Your Account, the Other Person's Copy. When you delete your account, your one to one conversations are deleted from our servers, and each of your contacts' devices deletes its copy of its conversation with you, including the messages you sent and the messages you received, the next time theSHFT runs on that device and connects to our service. A device that does not open theSHFT again keeps its encrypted copy until it does or until theSHFT is removed from it. Messages you sent in group conversations remain on the other members' devices until their disappearing message timers end or the members delete them (a message sent with the timer off stays until it is deleted), as when you leave a group. We cannot delete anything another person copied outside theSHFT, such as a screenshot or a photo of their screen. Community messages you posted will remain as described in Section 11.
25.6. Keep. This applies only when Keep is available (Section 19). If you delete your account while the other person in a conversation is keeping it with the Keep feature, or stopped keeping it within the closing period, the encrypted messages that were kept in that conversation, and the media they refer to, stay on our servers only for the closing period, which is thirty (30) days unless we set a shorter or longer period, and never more than ninety (90) days, so that the other person's device can finish saving its copy. We cannot read these messages. At the end of that period, or sooner if the other person finishes saving or deletes their own account, they are permanently deleted. Messages in that conversation that were not kept are deleted when your account is deleted. A Legal Hold, as described in Section 27.2, may extend this period. The same closing period applies when the other person removes the keeper as a contact while the conversation is kept; if the keeper removes the other person, nothing is held on our servers.
25.7. Other Deletion Tools. You can delete a message for everyone within one (1) hour of sending it, delete your own Community posts and replies, delete a Story, leave a Group, turn off features that store preferences, sign out to erase theSHFT's data on your Device, and use Panic wipe (Settings, Security), which erases theSHFT from your Device and deletes your Account as Section 25.1 describes.
26.1. We Do Not Back Up Your Conversations. We do not keep a backup of your messages, and the Application offers no chat backup or transfer. Our hosting provider may keep recovery copies of our database and files for up to fourteen (14) days after a change or deletion, as part of its service; these hold end-to-end encrypted messages and media only in encrypted form.
26.2. Your Device's Backups. On iPhone, the Application leaves its message database, local storage and files out of any iCloud or computer backup made after a version of the Application that does so (version 9.5 or later) has been opened on that iPhone. A backup made before then keeps its copy until that backup is replaced or deleted. Items the Application stores in the iPhone Keychain, which it marks for this device only and which can include your Recovery Phrase and keys, can be included in a backup of your iPhone and restored to the same iPhone; a few such items written by installations older than May 19, 2026, which can include your Recovery Phrase, may be restorable to another iPhone. On Android, backups of the Application's data are turned off.
26.3. The Retired Chat Backup. Versions before 9.5 offered an encrypted backup of chats. It has been retired, and the first time version 9.5 or later is opened on your Device it deletes any backup an earlier version made there.
27.1. Legal Process. We disclose information in response to valid legal process, such as a subpoena, court order or search warrant, as the law requires. What we can and cannot provide is described in our Law Enforcement Guidelines. We cannot provide the content of end-to-end encrypted messages, calls or media, your PIN, your Recovery Phrase or your private keys.
27.2. Legal Holds. In rare circumstances, we may be required by valid legal process (court order, preservation request under 18 U.S.C. § 2703(f), grand jury subpoena, or comparable authority) to preserve specific messages or message metadata past the point they would otherwise be deleted. When such a legal hold is in place affecting you OR another participant in a conversation you are in, disappearing-message timers may be temporarily overridden for the server copies of the messages covered by the hold. Important properties of legal holds:
27.3. Notice. Where the law permits and we can reach you in the Application, we try to tell you about legal process seeking your information before we disclose it, unless doing so is prohibited, would risk harm to someone, or concerns an emergency.
27.4. Emergencies. We may disclose information without legal process where the law allows, if we believe in good faith that disclosure is necessary to prevent imminent death or serious physical injury, to protect a child, or to respond to fraud or a security threat.
28.1. Measures. We protect information with measures that include:
28.2. No Guarantee. No method of transmission or storage is completely secure. We cannot guarantee that information will never be accessed, disclosed, altered or destroyed by a breach of our safeguards, and we are not responsible for access that results from a compromised Device, malware on your Device, or your sharing of your PIN or Recovery Phrase.
28.3. Incidents. If the law requires us to notify you of a security incident, we will do so by a notice in the Application, a notice on our website, notice through major media where the law calls for it, and email to anyone who gave us an email address (including sales representatives and applicants), and by any other method the law requires, and we will notify regulators as the law requires.
30.1. Everyone. Wherever you live, you may ask us to: tell you what personal information we hold about you and give you a copy; correct inaccurate information; delete your information (you can delete your Account yourself at any time); give you your information in a portable format; and stop or limit processing you have consented to, such as notifications or crash reports. You can use many of these rights directly in the Application. Otherwise, email support@theshft.app and include your username, and we will respond within thirty (30) days or any shorter period the law requires.
30.2. Verifying Requests. Because we do not have your email address or phone number, we verify requests by asking you to show control of your Account, for example by confirming the request from inside the Application. We cannot give anyone the content of end-to-end encrypted messages, because we do not have it. We may refuse or limit a request where the law allows, for example where it would reveal another person's information or where we must keep the information for a legal reason, and we will tell you why.
30.3. Appeals. If we deny your request, you may appeal by replying to our decision with the subject line "Privacy Appeal." We will respond within the time the law requires (for example forty five (45) or sixty (60) days in states whose laws provide for appeals) and explain how to contact your state attorney general if you disagree with the result.
30.4. Authorized Agents. Where the law allows, you may use an authorized agent to make a request for you. We may require proof of the agent's authority and confirmation from you in the Application.
30.5. No Discrimination. We will not deny you the Services, charge you a different price or give you a different quality of service because you exercised a privacy right.
31.1. California. This Section applies to California residents and supplements the rest of this policy. We describe the categories of personal information defined by the California Consumer Privacy Act, as amended (CCPA), that we collected in the past twelve (12) months:
Sources, purposes and recipients are described in Sections 2 to 6, 8, 22 and 23, and retention in Section 24. We disclose each category for a business purpose only to the service providers in Section 22 that process it, to other users as Section 23 describes, and as the law requires. We do not sell or share personal information as the CCPA defines those terms, including for cross-context behavioral advertising, and we have not done so in the past twelve (12) months; we have no actual knowledge of selling or sharing the personal information of anyone under sixteen (16). California residents have the rights in Section 30, including to know, delete, correct, and not be discriminated against, and may use an authorized agent. We do not offer financial incentives for personal information; promotion codes and referral rewards are not offered in exchange for personal information. California's "Shine the Light" law (Civil Code 1798.83) permits requests about disclosures for direct marketing; we do not disclose personal information to third parties for their direct marketing purposes.
31.2. Other States. Residents of states with comprehensive privacy laws (for example Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) have the rights in Section 30, including the right to appeal a denied request, and residents of Oregon and Minnesota may ask for a list of the specific third parties we disclosed their personal data to. We do not sell personal data, process it for targeted advertising, or profile you in furtherance of decisions that produce legal or similarly significant effects. Because we do not sell or share personal information or use it for targeted advertising, there is nothing for a universal opt out signal such as Global Privacy Control to turn off, and we treat such a signal as a request to opt out of any future sale or sharing.
31.3. Nevada. We do not sell covered information as Nevada law defines it.
31.4. Washington and Other Health Data Laws. We do not collect consumer health data. The Safety prompts check (Section 18.1) runs only on your Device. The only thing it keeps is when it last showed each kind of prompt, on your Device, so it does not repeat too often; its result is never sent to us or anyone else and is not used for any other purpose.
32.1. Not Offered There. theSHFT is not offered in the European Economic Area, the United Kingdom or Switzerland, and the Application is not available in the App Store in those places. We do not direct the Services to people there or monitor people there. If you use the Services while you are in one of those places anyway, for example while travelling, this policy still describes how we handle your information, and you can use the rights in Section 30.
32.2. If That Changes. Before we offer the Services in any of those places, we will update this policy to describe the controller, our legal bases for each purpose, your rights under the General Data Protection Regulation and the United Kingdom's and Switzerland's laws, how you can complain to a supervisory authority, how we transfer information to the United States, and the representative we appoint there.
If you live in another country, you may have rights under local law similar to those in Section 30, for example under Brazil's Lei Geral de Protecao de Dados, Canada's Personal Information Protection and Electronic Documents Act, Australia's Privacy Act 1988, South Korea's Personal Information Protection Act, Singapore's Personal Data Protection Act or Japan's Act on the Protection of Personal Information. Contact us at support@theshft.app to use them. Your information is transferred to and processed in the United States, whose laws may differ from those where you live.
theSHFT is for adults eighteen (18) and over, and older where our regional minimum or local law requires. It is not directed to children and we do not knowingly collect personal information from anyone under eighteen (18). If you are a parent or guardian and believe your child is using theSHFT, contact us at support@theshft.app with the username if you know it, and we will close the Account and delete its information, except records we must keep by law. If we learn that an Account belongs to someone under the minimum age, we will close it.
We are based in the United States, and our providers store and process information in the United States (Google's Firebase database in a United States multi-region, and our server functions and relay in the us-central1 region) and in other countries where they operate. By using the Services from outside the United States, you understand that your information will be transferred to and processed in the United States.
We do not allow third parties to collect personal information about your activity over time or across other websites through the Application. The Application does not use cookies for tracking, advertising identifiers or tracking pixels, and it does not track you across other companies' apps or websites, so it does not show Apple's App Tracking Transparency prompt. Our sign in and database software stores session information on your Device so you stay signed in. The website uses no tracking or advertising cookies, and its sales representative dashboard stores your representative code in your browser's local storage. Because we do not track you across other sites, we do not respond differently to browser "Do Not Track" signals.
Apple's App Store shows a summary of our data practices that we provide, in Apple's categories. We keep it consistent with this policy; if you find a difference, tell us at support@theshft.app and we will correct it.
We may change this policy when the Services or the law change. The "Last Updated" date and version show when it last changed. If a change is material, we will tell you in the Application before it takes effect and, where the law requires, ask for your consent. We will not use information we already collected in a materially different way without telling you and, where required, obtaining your consent.
theSHFT LLC, Attn: Privacy, 212 W. Troy St., Ste B, Dothan, AL 36303, United States
Email: support@theshft.app (privacy requests, appeals, California requests, EEA and UK requests, account deletion help, and law enforcement requests)
Website: https://theshft.app
Please include your username and a description of your request. We aim to acknowledge requests within five (5) business days, and we respond in full within thirty (30) days, or any shorter period the law requires.