Legal

Privacy Policy for ShiftSleep

Effective Date: April 27, 2026

This privacy policy explains how ShiftSleep ("the App", "we", "us") handles your data. ShiftSleep is developed and operated by Kevin Merz.

1. Our Privacy Commitment

ShiftSleep is built with privacy as a core value:

• No user accounts required — The app works entirely without registration
• No analytics or tracking — We do not use any third-party analytics, crash reporting, or tracking services
• No cross-app tracking — We do not track you across other apps or websites
• Local-first storage — All shift data, sleep logs, and settings stay on your device
• Health data stays on your device — Sleep samples imported from the system health database are processed locally and never sent to a server
• No external SDKs — The app uses only native system frameworks (HealthKit, UserNotifications, StoreKit)

2. Data Stored Locally on Your Device

ShiftSleep stores the following data locally on your device only:

2.1 Shift Patterns & Schedule

• What: Your shift rotation pattern, individual shift entries (early / late / night / off), shift dates and times
• Storage: Local file storage in the app sandbox (JSON on disk) and UserDefaults
• Purpose: To compute recommended sleep windows, wind-down times, and shift-aware notifications
• Your control: Editable in the app; deleted when you uninstall the app

2.2 Sleep Logs

• What: Manually entered or imported sleep entries (bedtime, wake time, quality 1–5, optional note, nap flag)
• Storage: Local file storage in the app sandbox (JSON on disk)
• Purpose: To display weekly summaries, compute sleep debt, and correlate sleep with shift type
• Your control: Editable and deletable in the app; removed when you uninstall the app

2.3 User Profile & Preferences

• What: Chronotype, target sleep duration, notification preferences, theme
• Storage: Local file storage and UserDefaults (local only)
• Purpose: To personalize sleep recommendations and remember your preferences
• Your control: Editable in Settings; reset by deleting the app

2.4 Subscription Status

• What: Whether your premium subscription is active
• Storage: Verified via StoreKit (system framework); current status is held in memory and re-verified on launch
• Purpose: To unlock premium features after purchase
• Your control: Managed through your store account; restore purchases at any time

2.5 Rating Prompt State

• What: Whether and how often you have skipped the rating prompt
• Storage: UserDefaults (local only)
• Purpose: To respect your decision and not show the rating prompt again after the configured limit
• Your control: Reset by deleting the app

3. HealthKit (Health Data)

ShiftSleep integrates with the system health database via the HealthKit framework to import your sleep history.

• Read access: Sleep Analysis (asleep / asleep core / asleep deep / asleep REM samples)
• Write access: None. ShiftSleep does not request permission to write any health data and does not modify your health database.
• Purpose: To pre-populate your sleep log from existing sleep samples on your device, so you do not have to re-enter sleep you already tracked elsewhere
• Storage of imported data: Imported sleep entries are stored locally inside ShiftSleep only (alongside your manually logged sleep). They are never sent to any server.
• Permission: You explicitly grant access via the system permission dialog. You can revoke access at any time in Settings → Health → Data Access & Devices → ShiftSleep.
• Compliance: Health data accessed via HealthKit is never used for advertising, never sold, never disclosed to third parties, and never shared with analytics providers, in accordance with the platform's HealthKit guidelines.

4. Notifications

ShiftSleep schedules local notifications via the system's UserNotifications framework. These notifications run entirely on your device:

• Wind-down reminders before your recommended sleep window
• Caffeine cut-off reminders
• Light-exposure reminders
• Optional weekly summary

No remote push notifications are sent. The app does not register for remote push and no server is contacted to deliver these reminders.

5. Data We Do NOT Collect

ShiftSleep does not collect, store, or transmit:

• Personal information (name, email, phone number, etc.)
• Location data
• Device identifiers for advertising purposes (no IDFA use)
• Photos, contacts, or calendar data
• Keyboard input beyond normal in-app text fields (e.g. sleep notes you type stay on device)
• Usage telemetry or session recordings
• Crash reports sent to third-party services

6. Advertising

ShiftSleep does not contain advertisements. There are no ad networks, ad SDKs, or ad identifiers integrated into the app.

7. Third-Party Services

ShiftSleep uses minimal third-party services.

7.1 StoreKit (Subscriptions)

• Purpose: Subscription processing (monthly / yearly) and entitlement verification
• Data shared: None by us; the platform processes payments according to its own privacy policy
• Trial: A 3-day free trial may be offered for new subscribers, managed entirely by the platform
• Privacy Policy: https://www.apple.com/legal/privacy/

7.2 HealthKit

• Purpose: Read access to existing sleep samples on your device (see Section 3)
• Data shared with us: None — health data is read locally on your device and is not transmitted

8. Data Security

• All app data is stored locally using standard system security mechanisms
• The app is sandboxed — no access to other apps or system areas beyond its own data and the explicit HealthKit read scope you granted
• No data is transmitted to external servers by us
• Purchase verification uses the secure StoreKit framework

9. Data Retention and Deletion

• Local data: Retained until you uninstall the app
• HealthKit data: Owned and controlled by you in the system Health app; ShiftSleep only reads samples you granted access to and stores its own local copies for analysis
• Purchase history: Managed through your store account
• Complete deletion: Uninstalling the app removes all locally stored data including shift patterns, sleep logs, profile, and settings

10. Tracking & Identifiers

ShiftSleep does not track you:

• No advertising identifiers — We do not use IDFA or any advertising tracking
• No fingerprinting — We do not use device fingerprinting techniques
• No cross-app or cross-site tracking — We do not track you across other apps or websites
• No analytics SDKs — We do not use Firebase, Mixpanel, Amplitude, or any other analytics service

11. Children's Privacy

ShiftSleep does not knowingly collect personal data from any user, including children under 13. The app contains no objectionable content and uses no analytics SDKs. It is rated 4+ and is a productivity / health utility intended for shift workers.

12. International Users

All your data remains locally on your device. No personal information is transferred internationally. Purchase transactions are handled by the platform according to its privacy policy.

13. Your Rights (GDPR)

If you are in the European Economic Area, you have rights under GDPR:

• Access: All your data is stored locally on your device — you have full access at all times via the app and via the system Health app for HealthKit data
• Deletion: Uninstall the app to delete all local app data immediately. HealthKit data can be deleted from the system Health app.
• Portability: Sleep logs and shift patterns are stored in standard JSON format on your device
• Revocation: You may revoke HealthKit and Notification permissions at any time in system Settings
• No remote data processing: Since no data leaves your device, there is no remote data processing to object to

For questions about data rights, contact: MerzKevin@me.com

14. California Privacy Rights (CCPA)

For California residents: ShiftSleep does not sell personal information. We do not collect personal information as defined by CCPA.

15. Medical Disclaimer

ShiftSleep is a productivity and lifestyle utility. It is not a medical device and does not provide medical advice, diagnosis, or treatment. The sleep recommendations are generated heuristically from your shift schedule and chronotype and are no substitute for professional medical advice. Consult a qualified healthcare provider for any medical questions.

16. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. The effective date at the top indicates when this policy was last revised. Continued use of the app after changes constitutes acceptance of the updated policy.

17. Contact

For questions about this Privacy Policy, please contact:

Kevin Merz
E-Mail: MerzKevin@me.com
Website: https://merzkevin.de