Privacy Policy

What we collect

ShadowGraph collects only what it needs to work. Here is the full list:

• Events and timestamps -- the things you track and when they happened, including the notes, property values and event-type names you type in yourself.
• HealthKit data -- only the categories you choose to enable (workouts, sleep, steps, active energy, and heart rate for workouts). We never read anything you have not explicitly configured.
• Location data -- only for geofence triggers you create. We never follow you around in the background. But when a geofence does fire, the event we log keeps the coordinates and the name you gave that place, so over time your geofences do build up a record of when you arrived at and left them.
• Place names -- whatever you call a geofence ("Gym", "Mum's house"). It is stored on the event and repeated in its note, so pick names you are comfortable having on our server.
• Calendar entries you import -- if you use Calendar Import, the title and description of each entry you choose are stored on our servers as events. See the Calendar section below, which also covers the opposite direction.
• Email address -- used to sign you in and recover your account, and to send you the waitlist or invitation emails you asked for.
• Account identifiers -- an internal user ID to keep your data separate from everyone else's.
• Subscription status -- which ShadowGraph plan you are on, whether it is active, when it renews or expires, and the transaction identifiers Apple issues for your purchase. We never see your card number or your billing address: Apple processes every payment.
• Device and app information -- device model, iOS version, app version and build, screen size, language and time zone, network type, and your App Store country. Sent alongside requests to the services listed below so that we can keep the app working and tell builds apart.
• Your choices and progress -- whether you allowed or denied the notification, location and HealthKit prompts, which onboarding steps you finished and when, and your settings.
• Things we work out from your events -- daily totals, streaks, target progress, achievements, and the correlations and patterns the app shows you as insights. We derive these and store them; they are about you, so they are yours, and they are in your export.

Why we collect it

Everything we collect exists for one reason: to make the app work for you.

• HealthKit data powers your health tracking features.
• Location data triggers geofence-based event logging.
• Your email lets you sign in and recover your account.
• Your subscription status tells the app which features to unlock.

We do not use your data for advertising. We do not sell your data. We do not build profiles to serve you ads. None of that.

How we store it

Your data is stored in a PostgreSQL database hosted on Neon, in the United States. The API that reads and writes it runs on Google Cloud Run, also in the United States. All data is encrypted in transit using TLS. Each user's data is isolated by account -- you can only access your own.

If you joined the waitlist before signing up, that is held separately from your account, in a Cloudflare database attached to this website: the email address and name you gave us, your referral code and where you came from, and the IP address the signup arrived from. Your address is also added to a mailing list hosted by Resend, and if you open or click one of those emails we record that, along with the IP address and browser that did it. These waitlist records are not removed when your invitation is used, and deleting your ShadowGraph account does not remove them -- email [email protected] and we will delete them.

The iOS app also stores data locally on your device using SwiftData so you can use it offline. Local data syncs to the server when you are back online.

Third-party services

These are the companies that receive your data, and what each one gets. We keep the list short on purpose, and we would rather name something borderline than leave it out.

• Clerk -- handles authentication. Clerk processes your email address, your credentials and your session tokens. They do not receive your event data.
• Google Cloud -- runs our backend API. Every request from the app passes through it, so it handles your event data in transit, and its request logs record your IP address alongside your account ID.
• Neon -- hosts the PostgreSQL database your account lives in. This is where your stored data actually sits.
• RevenueCat -- manages subscriptions. It receives your account identifier, your device's vendor identifier, your device model and app version, and the details of your purchase: which plan you bought, whether it is active, when it renews or expires, and the transaction identifiers Apple issued. It never receives your events, notes, HealthKit data or location.
• Apple -- processes every purchase as merchant of record, and reports the resulting subscription status to us by way of RevenueCat. We never see your payment details.
• Cloudflare -- hosts this website and the web app, so its logs record the IP address of anyone who visits either one. It also stores the waitlist described above, and routes mail sent to our support address.
• Resend -- delivers the waitlist and invitation emails. It receives the address each one is sent to, holds your address and name on a mailing list it hosts for us, and reports back when a message is opened or a link is clicked. We do not use it to send you anything you did not ask for.
• Your calendar provider -- Calendar Sync is on by default, and while it is on, every event you log by hand is also written into your device's default calendar, carrying the event-type name and your note. If that calendar belongs to iCloud, Google or a work Exchange account, iOS uploads it to that provider. We never see which provider that is -- but you should know the path exists. Turn it off in Settings › Event Types › Calendar Sync.
• Apple or Google, if you sign in with them -- choosing "Sign in with Apple" or "Sign in with Google" means that provider authenticates you and tells Clerk your email address. If you sign in with an email and password instead, neither is involved.
• PostHog -- product analytics, used only in TestFlight beta builds of the iOS app. In those builds it receives your account identifier and how you move through the app: which screens you open, which features you use, and whether you allowed or denied a permission prompt. It does not receive your email address, your events, your notes, your HealthKit data or your location. The App Store release of ShadowGraph ships with analytics switched off entirely.

This site's pages, including this one, also load a stylesheet framework from Tailwind and fonts from Google Fonts. Loading a file from someone else's server reveals your IP address to them, so we would rather name it than pretend a web page has no dependencies.

We do not use advertising SDKs, ad networks, attribution SDKs or data brokers. We do not sell your data, we do not share it for anyone else's advertising, and we do not track you across other apps or websites. None of the services above are permitted to use your data for their own purposes.

Your rights

You are in control of your data:

• View -- all your data is visible in the app at any time.
• Export -- in the iOS app, Settings › Export My Data produces a single JSON file containing everything we hold about your account: your events with their notes and properties, your event types, geofences, targets, achievements, streaks, insights and your subscription status. The web app at app.shadowgraph.app also exports your events as CSV or JSON, filtered by date range or event type.
• Delete -- delete your account from Settings in the iOS app. Your sign-in identity and your data are erased from our database straight away and cannot be restored. Two things lag: the copy held on your own device is wiped the next time you open the app, and the app's diagnostic log is only cleared when you clear it yourself in Settings › App Logs. See Data retention for the one record we keep.

Data retention

Active account: your data is kept for as long as your account exists.

Deleted account: deletion is immediate and permanent. When you delete your account we erase your sign-in identity and every row of your data -- events, event types, properties, geofences, targets, achievements, streaks, subscription state and settings -- from our database straight away. There is no grace period and no recovery: we cannot restore a deleted account even if you ask us to. You are welcome to sign up again with the same email address, but you will start with an empty account.

The one exception: our record of the subscription notices RevenueCat sent us is kept after deletion, for accounting. Those entries hold the account identifier the purchase was made under and what RevenueCat told us about it -- never your events, notes, health or location data. Ask us at [email protected] and we will delete them too. Your subscription record held by Apple and by RevenueCat is theirs, not ours, and we cannot delete it for you.

Encrypted database backups may retain residual copies for up to 6 hours before they age out. Those backups exist only for disaster recovery and are never used to restore an individual deleted account.

HealthKit

ShadowGraph integrates with Apple HealthKit to let you track health-related events automatically. Here is how we handle HealthKit data:

• We only read the HealthKit categories you explicitly enable in Settings.
• When you enable workout tracking we also read heart rate, solely to record the average and peak heart rate for each workout we log for you.
• HealthKit data you share with ShadowGraph is stored on our servers to power your tracking features.
• We do not share HealthKit data with third parties. The infrastructure providers listed above store and transmit it on our behalf; beyond those, nobody receives it. It is never sent to RevenueCat and never sent to an analytics provider.
• We do not use HealthKit data for advertising or marketing.
• You can disconnect HealthKit at any time in the app's Settings.

Calendar

ShadowGraph touches your calendar in two directions, and they have different consequences.

• Out -- Calendar Sync, on by default. While it is on, each event you log by hand is also written into your device's default calendar with the event-type name as its title and your note as its description. If that calendar is backed by iCloud, Google or Exchange, your calendar provider receives both. Switch it off in Settings › Event Types › Calendar Sync.
• In -- Calendar Import, only when you ask. You pick which entries to import; their titles and descriptions are then stored on our servers as ordinary events, and we keep the calendar's own identifier so the same entry is not imported twice.
• We only read calendars after you grant permission, and only the entries you select.
• We do not use calendar data for advertising, and we never send it to our analytics provider.

Location data

ShadowGraph uses location data exclusively for geofence triggers -- for example, automatically logging an event when you arrive at the gym.

• We do not continuously track your location. The app never asks iOS for a running stream of your position -- only to be woken when you cross a boundary you drew.
• We do not collect any location outside your geofences. Nothing is recorded about where else you go.
• We do keep the geofence crossings themselves. Each one is an event with a timestamp, the coordinates of that geofence and the name you gave it, stored on our servers like any other event -- so your own geofences accumulate a history of when you came and went. Delete those events, or the geofence, to remove it.
• You can remove geofences at any time to stop location-based triggers.

Contact

Questions about this policy or your data? Reach us at [email protected].