Privacy Policy

For the ErgoShift iOS app.
Effective 30 August 2026. Last updated 30 August 2026.

ErgoShift is made by one person — Evgeniy Timofeev, an independent developer. There is no company, no advertising business, and no data broker behind it. This policy describes exactly what the app stores, what leaves your phone, and why.

The short version. ErgoShift does not track you, does not show ads, carries no analytics or advertising SDK, and never sells or shares your data. Almost everything the app knows stays on your device. What travels to the server does so for two reasons: so a stage boundary reaches you while the app is asleep, and so the developer can count a handful of plain product events — which by construction cannot contain your text, your name, or anything about the SOS breathing.

Using ErgoShift without an account

You can install ErgoShift and use it without signing in. Shifts, stages, sounds, settings and the SOS breathing all work offline and locally. An account is only needed to keep a Pro subscription attached to you across devices and reinstalls, and to let the server send stage-boundary notifications while the app is not running.

What stays on your device and never leaves it

Your Screen Time selection. When you choose apps or categories to block during work stages, iOS gives ErgoShift opaque tokens, not app names. Those tokens are meaningless outside your device, are stored only in the app's own container and its app group, and are never transmitted anywhere. ErgoShift cannot see which apps you picked, cannot read what you use your phone for, and receives no usage statistics from Screen Time.
Your settings. Boundary sound, screen-awake preference, onboarding answers, permission answers.
Completed-session history. Stored locally on the device.
Your music choice. If you attach an Apple Music playlist to work stages, the app asks Apple Music to play it. ErgoShift does not receive, store or transmit your listening history or your Apple Music library.

What leaves your device, and why

Email address and name — only if you sign in: Provided by Sign in with Apple. Apple lets you hide your real address, and ErgoShift works exactly the same with a hidden one. The address identifies your account so a subscription survives a new phone. It is never used for marketing; ErgoShift sends no email newsletters of any kind. Your name, if you choose to share it, is shown back to you in Profile and nowhere else.
An account identifier: A random identifier generated by the server for your account. It labels your shifts and your subscription record.
Names of your shifts and stages: Text you wrote yourself. It travels to the server because the server is what schedules your stage boundaries and puts the stage name into the notification you receive. If you never sign in, this text never leaves the device.
A device identifier and a push token: The device identifier is a random value that ErgoShift generates itself and keeps in the device Keychain. It is not the advertising identifier (IDFA), not the vendor identifier (IDFV), and cannot be matched to you across other apps or by anyone else. Alongside it, the Apple Push Notification service token addresses your device so a boundary notification and a Live Activity update can reach it. Deleting the app invalidates both.
Subscription status and purchase history: Handled by RevenueCat on top of Apple's In-App Purchase system, so the app knows whether Pro is active. ErgoShift never sees your payment card, your billing address or your Apple ID password — those stay with Apple and are never shared with the developer.
A small number of product events: The server records plain facts about how the app is used — that a shift was started, that a subscription began — labelled with your account identifier, so the developer can tell whether a change made things better or worse. These events are recorded by the server, not by a tracking library inside the app, and they are never used for advertising or shared with advertisers.

What they cannot contain is enforced by the database itself, not by good intentions: the events table rejects any event carrying an email address, a name, a shift or stage title, a device identifier, or a token. The SOS breathing exercise is excluded entirely — the same rule refuses any event that so much as mentions it. Nobody, including the developer, can see whether or when you used it.

What ErgoShift never collects

No advertising identifier, no ad networks, no attribution or install-tracking SDK.
No analytics SDK inside the app, no session recording, no heatmaps, no crash reporter that reads your content. The product events described above are written by the server and are limited by the rules stated there.
No location, no contacts, no calendar, no photos, no camera, no microphone, no health or fitness data.
No browsing history and no record of which apps you use.
Nothing is sold, rented, or shared with data brokers. There is no "partner" list, because there are no partners.

ErgoShift performs no tracking as Apple defines it, which is why the app never asks for permission to track and declares NSPrivacyTracking: false in its privacy manifest.

The SOS breathing exercise

The breathing screen is a paced animation and a timer. It records nothing, measures nothing, and transmits nothing. It is a comfort feature, not a medical device, and it is not a diagnosis, treatment, or substitute for professional care.

Who processes data on the developer's behalf

Apple — Sign in with Apple, push notifications, Live Activities, In-App Purchase, Apple Music playback. Governed by Apple's privacy policy.
RevenueCat, Inc. — subscription state and purchase receipts. Privacy policy.
Supabase — authentication infrastructure. Privacy policy.
PostHog — the product events described above. Privacy policy.
Hetzner Online GmbH — the server that schedules your boundaries runs on Hetzner infrastructure in Germany. Privacy policy.

Each of these receives only what it needs to do its job. None of them is permitted to use your data for their own advertising.

How long data is kept, and how to delete it

Account data is kept while your account exists. You can delete your account from inside the app at any time: open Profile → Delete account. Deleting removes your account record, your shifts and stages, your scheduled boundaries, and your device registrations from the server. It cannot cancel an App Store subscription — Apple owns billing, and a subscription is cancelled in Settings → your name → Subscriptions on your device.

Data held locally on your device is removed when you delete the app.

Your rights

Depending on where you live, you may have the right to access, correct, export, or erase the personal data held about you, and to object to or restrict its processing. The delete-account button covers erasure directly and immediately. For anything else, write to the address below and you will get an answer from a human, because there is only one.

Children

ErgoShift is not directed to children and is not designed for use by children under 13. No knowingly collected data from children is processed.

Security

All traffic between the app and the server is encrypted in transit with TLS. Sign-in tokens and the device identifier are stored in the iOS Keychain, not in ordinary app storage. No system is perfectly secure, but nothing here is kept that would be worth stealing.

Changes to this policy

If this policy changes materially, the effective date at the top changes with it, and the change will be described in the app's release notes. Continued use after a change means the updated policy applies.

Contact

Questions, requests, or corrections: support@ergo-shift.app.