Shreddy App Privacy Policy

SHREDDY Privacy Policy

1. Who we are

SHREDDY is operated by SHREDDY LIMITED (company number 12231699), a company registered in England and Wales.

Registered office: 2nd Floor Connaught House, 1–3 Mount Street (Entrance Via Davies Street), London, United Kingdom, W1K 3NB. [Confirm this address immediately before publication.]

In this policy, “SHREDDY”, “we”, “us” and “our” refer to SHREDDY LIMITED. This policy applies to the SHREDDY mobile app, our websites, online shop and related services.

For privacy questions or requests, contact hello@shreddy.com.

2.  Information we collect

    The information we collect depends on which SHREDDY features you use.

    Account and contact information

    This may include your name, email address, account identifier, login and authentication information, country, communication preferences, and messages you send to support.

    Profile, fitness and wellbeing information

    This may include your age, gender, height, weight, activity level, fitness goals, diet preferences, workout preferences, pregnancy or postnatal information when you choose a related programme, and other answers you choose to provide. Some of this information may be considered health-related or otherwise sensitive under local law.

    Activity and progress information

    This may include workout and meal plans, scheduled and completed workouts, exercise results, fitness-test results, habits, check-ins, favourites, notes, progress measurements and progress photos.

    If you choose to connect a supported health or fitness service, such as Apple Health or Google Fit, we may receive fitness information you allow that service to share, such as workout activity, calories or heart-rate information. We ask for permission before accessing this information.

    Photos, camera and shared content

    If you choose to use these features, we may process photos or videos you upload or capture, including profile and progress photos, content shared in community features, and images saved to your device. We only request camera or photo-library access when it is needed for a feature you choose to use.

    Community and communications

    If you use community or chat features, we may process your display name, profile image, messages, reactions, uploaded media, channel membership and moderation information.

    Purchases and subscriptions

    We may receive information about your purchases, subscriptions, renewal status, refunds, currency and transaction identifiers. Payment-card details are normally collected directly by the relevant app store or payment provider rather than by SHREDDY.

    Device, usage and diagnostic information

    This may include your IP address, device and advertising identifiers where permitted, device model, operating system, app version, language, time zone, network information, pages or screens viewed, buttons and features used, referral and campaign information, notification information, crash reports and performance data.

    Information from device permissions

    Depending on the features you choose, SHREDDY may ask for access to notifications, camera, photo library, device calendar, and health or fitness data. You can manage these permissions in your device settings. Refusing a permission may prevent the related feature from working, but should not prevent you from using unrelated parts of SHREDDY.

    Google Calendar information

    If you choose to connect Google Calendar, we process the limited information described in section 5 below.

    Device calendars and calendar subscription links

    If you choose the direct device-calendar option, SHREDDY asks for calendar permission and may view your available calendar accounts and existing SHREDDY workout calendars, read events from those workout calendars, remove an earlier workout calendar, create a replacement calendar, and add workout events. This happens through the calendar accounts configured on your device.

    SHREDDY may also generate a private calendar-subscription link containing your workout schedule and open it in a calendar service you select. Anyone who obtains that link may be able to view the feed, so keep it private and revoke or replace it from SHREDDY if you believe it has been shared. [Confirm the server-side feed contents, token lifetime, access logging, revocation behaviour and deletion retention before publication.]

    3. How we use information

    We use personal information to:

    • create and manage your SHREDDY account;

    • provide workout, meal, progress, community and subscription features;

    • personalise content and recommendations using information you provide;

    • save and synchronise your choices and progress across devices;

    • process purchases and manage subscriptions;

    • send service messages, reminders and notifications you request;

    • provide support and respond to questions;

    • maintain security, prevent misuse and investigate technical problems;

    • understand how SHREDDY is used and improve its reliability and features;

    • measure marketing campaigns and, where required, show advertising only with the appropriate permission or consent; and

    • comply with legal, tax, accounting and regulatory obligations.

    We do not use Google Calendar data for advertising, marketing audiences, general product analytics, credit decisions, or to build a profile about you. Section 5 controls our use of all information received from Google APIs.

    4. Our legal reasons for processing information

    Where UK or European data-protection law applies, we rely on one or more of the following legal bases:

    • Contract: processing needed to provide the SHREDDY service or a purchase you requested.

    • Consent: for optional permissions, health or fitness integrations, certain marketing, and other processing where consent is required. You may withdraw consent at any time, although this does not affect processing already carried out lawfully.

    • Legitimate interests: operating, securing, supporting and improving SHREDDY, provided those interests are not overridden by your rights.

    • Legal obligation: keeping records or disclosing information when the law requires us to do so.

    [Legal review must confirm the legal basis used for each sensitive-data, analytics, advertising and international-transfer activity.]

    5. Google Calendar and Google API data

    This section applies only if you choose Connect Google Calendar. Connecting is optional.

    What access SHREDDY requests

    SHREDDY requests permission to:

    • identify the Google account you selected, using its Google account identifier and email address; and

    • create a separate secondary Google calendar and see, create, change and delete events in calendars created by SHREDDY.

    The calendar permission is https://www.googleapis.com/auth/calendar.app.created. SHREDDY does not request access to all calendars in your account, your primary calendar, your contacts, or your Google Drive.

    What SHREDDY does with that access

    After you approve access, SHREDDY:

    1. creates a separate calendar called SHREDDY Workout Program;

    2. sends your SHREDDY workout schedule to Google so the relevant workout names, descriptions, dates, times, time zone and location information can appear in that calendar;

    3. checks only events marked as managed by SHREDDY in that SHREDDY-created calendar so it can add missing workouts, update changed workouts and remove workouts that are no longer in your schedule; and

    4. displays the connected Google account email and synchronisation status to you.

    SHREDDY does not import events from your primary calendar or other calendars. It does not read events you create yourself. The separate calendar is intended only for SHREDDY workouts; if you add your own events to it, disconnecting SHREDDY may remove the whole calendar, including those events. It does not use information obtained from Google Calendar for advertising, marketing, analytics, personalised recommendations, or any purpose unrelated to providing and securing the Google Calendar connection.

    What Google-related information SHREDDY stores

    To keep the connection working, SHREDDY stores:

    • the Google account identifier and email address you authorised;

    • the identifier and name of the SHREDDY-created calendar;

    • your selected time zone;

    • encrypted access and refresh credentials and the access-token expiry time;

    • the SHREDDY product or workout plan connected to the calendar; and

    • connection and synchronisation status, timestamps and non-sensitive error codes.

    During connection setup, SHREDDY also creates a one-time security record containing a hashed random state value, an encrypted security verifier, your SHREDDY user and vendor identifiers, the requested product, time zone, return target, expiry time and use status. The authorisation link expires after 10 minutes. [Confirm and insert how soon expired and consumed security records are permanently purged from the database.]

    Google access credentials are encrypted when stored. They are not sent to the SHREDDY mobile app, advertising providers or analytics providers.

    Sharing of Google data

    SHREDDY shares workout-event information with Google only because you asked SHREDDY to place those workouts in your Google Calendar. We may use infrastructure and security providers acting on our instructions to host and protect the connection. Authorised SHREDDY personnel may access limited connection information only when necessary to provide support, investigate security or technical problems, or comply with law.

    We do not sell Google user data. We do not share or transfer it to advertising platforms, data brokers or information resellers, and we do not use it to serve personalised or interest-based advertising.

    SHREDDY’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

    If another part of this policy appears to allow broader use of information for analytics, advertising, marketing, product development or aggregated reporting, that broader wording does not apply to information received from Google APIs. This section takes priority for Google API data.

    Disconnecting and deleting Google Calendar data

    You can disconnect Google Calendar from SHREDDY at any time. When you disconnect, SHREDDY will:

    • try to delete the SHREDDY-created Google calendar and the workout events in it;

    • try to revoke SHREDDY’s Google authorisation; and

    • delete its locally stored Google access credentials, calendar identifier and connected-account details even if Google is temporarily unavailable.

    Deleting the SHREDDY-created calendar also deletes anything you added to that calendar yourself, so you should move any personal events you want to keep before disconnecting. If Google is unavailable when you disconnect, the calendar or authorisation may remain in your Google account even though SHREDDY has deleted its local access credentials and can no longer access it. You can remove the calendar directly in Google Calendar and revoke SHREDDY’s access in your Google Account permissions.

    SHREDDY also invokes this disconnect process when the Product API receives the app’s account-data deletion request. [Confirm that the complete production account-deletion workflow always reaches this Product API endpoint before stating this without qualification.]

    6. When we share information

    We do not sell personal information. We may share personal information only as needed with:

    • Hosting, database and authentication providers, including Amazon Web Services, to run and secure SHREDDY.

    • Analytics, attribution and app-performance providers, which may include Google Firebase, Segment, Mixpanel, Adjust, AppsFlyer, Meta and Microsoft App Center, to understand use, diagnose problems and measure campaigns. [Confirm the final active list and regional consent behaviour.]

    • Notification and messaging providers, including OneSignal, to deliver notifications and messages you request.

    • Community providers, including Stream, to provide in-app community and chat features.

    • Subscription and payment providers, including Apple, Google, RevenueCat, Stripe, Shopify and Klarna, to process purchases and manage subscriptions. These providers may process payment information under their own privacy policies.

    • Email and marketing providers, including Klaviyo, when you choose to receive marketing or where otherwise permitted by law.

    • Health and device-platform providers, including Apple Health and Google Fit, when you choose to connect those features.

    • Google, when you choose to connect Google Calendar, strictly as described in section 5.

    • Professional advisers, regulators, courts or law-enforcement bodies when reasonably necessary to obtain advice, protect rights and safety, or comply with law.

    • A buyer or successor organisation if SHREDDY is involved in a merger, acquisition, financing, reorganisation or sale, subject to appropriate confidentiality and data-protection safeguards.

    Our service providers may use personal information only to provide contracted services to us, unless a provider clearly acts as an independent controller under its own privacy notice.

    7. International transfers

    SHREDDY is available worldwide, and we and our service providers may process information in countries other than the country where you live. Where required, we use recognised safeguards for international transfers, such as adequacy regulations, approved contractual clauses or another lawful transfer mechanism.

    [Confirm the locations of the production systems, each provider’s role, and the transfer safeguards actually in place. Add links or a method for requesting copies of applicable safeguards.]

    8. How long we keep information

    We keep personal information only for as long as needed for the purposes described in this policy, including legal, accounting, security and dispute-resolution requirements.

    • Account, profile, workout, meal, progress and community information is generally kept while your account is active and then deleted or anonymised according to our deletion schedule. [Insert the production retention period.]

    • Google connection information and credentials are kept while Google Calendar remains connected and are deleted locally when you disconnect, subject to the specific remote-deletion outcome explained in section 5.

    • A Google Calendar authorisation link expires after 10 minutes. [Insert the purge period for the related database record.]

    • Purchase and transaction records may be kept for the period required by tax, accounting and consumer-protection law.

    • Support messages, analytics records, security logs and backups are kept according to separate schedules. [Insert or link the applicable periods.]

    When immediate deletion from a backup is not practical, the information is isolated from normal use and deleted when that backup expires. [Confirm this matches the backup process.]

    9. Security

    We use organisational and technical measures designed to protect personal information, including access controls, encryption for sensitive Google access credentials, secure transport, logging controls and restricted staff access. No service can guarantee absolute security.

    Please protect your login details and contact us promptly at hello@shreddy.com if you believe your account has been compromised.

    10. Your choices and rights

    Depending on where you live, you may have rights to:

    • access personal information we hold about you;

    • correct inaccurate information;

    • delete information or your account;

    • receive a portable copy of certain information;

    • object to or restrict certain processing;

    • withdraw consent;

    • opt out of marketing; and

    • complain to your local data-protection authority.

    You can manage some information and permissions in the SHREDDY app or your device settings. You can unsubscribe from marketing emails using the link in the email. You can request help or exercise privacy rights by emailing hello@shreddy.com.

    We may need to verify your identity before completing a request. Some rights are subject to legal exceptions. UK users may complain to the Information Commissioner’s Office at ico.org.uk.

    [Add any required US state, Canadian, Australian or other regional notices after legal review of SHREDDY’s actual user locations, revenue and data practices.]

    11. Age requirement

    SHREDDY is not intended for anyone under the age of 16, and people under 16 must not create an account or use the service. We do not knowingly collect personal information from anyone under 16. If you believe that a person under 16 has provided personal information, contact hello@shreddy.com so we can investigate and delete it where required.

    [Legal and app-store review should confirm whether parental consent or a higher local age threshold is required in any country where SHREDDY is offered.]

    12. Third-party services and links

    Some SHREDDY features connect to services operated by other organisations. Their own privacy notices apply when they act independently, for example when an app store processes a purchase or Google provides Google Calendar. We encourage you to review those notices.

    13. Changes to this policy

    We may update this policy when our services, providers or legal obligations change. We will change the effective date and provide additional notice when required. If we materially change how we use Google user data, we will update this policy and obtain any further consent required before using that data for the new purpose.

    14. Contact us

    SHREDDY LIMITED
    Company number: 12231699
    2nd Floor Connaught House
    1–3 Mount Street (Entrance Via Davies Street)
    London W1K 3NB
    United Kingdom
    Email: hello@shreddy.com